| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: habe mir adware eingfangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.10.2015, 16:29
| #1 |
 |  habe mir adware eingfangen Hallo zuammen, habe mir eben eine adware JS Crossrider eingefangen, mein emsisoft schlägt dauernd an und ich bekomme den mist nicht mehr weg! wer kann mir denn helfen, bzw was muss ich den tun?+ bitte dringend um hilfe! danke!! FRST Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:24-10-2015
durchgeführt von MERCURY (Administrator) auf BILLY (24-10-2015 17:44:03)
Gestartet von C:\Users\MERCURY\Downloads
Geladene Profile: MERCURY & Gast (Verfügbare Profile: MERCURY & Gast)
Platform: Windows 10 Home (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Programme (x86)\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(RapidSolution Software AG) C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Spotify Ltd) C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
() C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Dropbox, Inc.) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Apple Inc.) C:\Program Files\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.13821.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.PowerPoint_17.6228.10041.0_x64__8wekyb3d8bbwe\pptim.exe
() C:\Program Files (x86)\RayDld\ihpmServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [5836888 2015-10-01] (Emsisoft Ltd)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Spotify Web Helper] => C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2025016 2015-09-19] (Spotify Ltd)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe [2412440 2015-09-18] ()
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Dropbox Update] => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-21] (Dropbox, Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [61200 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"
HKU\S-1-5-21-4024391792-2930209080-385294340-501\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-10-21] (Apple Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-06-22]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-20]
ShortcutTarget: Dropbox.lnk -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{a0a490e2-89f6-4e4a-a04c-a750cf07901a}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
FireFox:
========
FF ProfilePath: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: oursurfing
FF Homepage: hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-27] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\user.js [2015-10-24]
FF SearchPlugin: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\searchplugins\oursurfing.xml [2015-10-24]
FF Extension: deskCut - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\deskCutv2@gmail.com [2015-10-24] [ist nicht signiert]
FF Extension: ColorfulTabs - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-10-17]
FF Extension: FireFTP - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-05-30]
FF Extension: anonymoX - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\client@anonymox.net.xpi [2015-09-30]
FF Extension: Ghostery - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\firefox@ghostery.com.xpi [2015-09-19]
FF Extension: yaBeat - YouTube to MP3 - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid0-uqZgom7deYId1IGHnMog6eoQ2cI@jetpack.xpi [2015-05-30]
FF Extension: Google Selection Translate - For AltKey - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid1-f7dnBeTj8ElpOQ@jetpack.xpi [2015-09-13]
FF Extension: Zoom Page - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\zoompage@DW-dev.xpi [2015-10-17]
FF Extension: ImTranslator - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2015-10-17]
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [7084784 2015-10-01] (Emsisoft Ltd)
R2 AAV UpdateService; C:\Programme (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-18] (Intel Corporation)
R2 ihpmServer; C:\Program Files (x86)\RayDld\ihpmServer.exe [270568 2015-10-12] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448464 2015-03-30] (TeamViewer GmbH)
R2 Virtual CDAudio Service; C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe [179608 2015-09-18] (RapidSolution Software AG)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 epp64; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\epp64.sys [138504 2015-10-01] (Emsisoft GmbH)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-08-28] (Intel Corporation)
R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [25256 2015-04-21] (Audials AG)
R3 rsvcdwdr; C:\Windows\System32\drivers\rsvcdwdr.sys [45192 2015-04-21] (RapidSolution Software AG)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek )
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-25] (Acronis International GmbH)
S0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-25] (Acronis International GmbH)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-24 17:34 - 2015-10-24 17:34 - 00041917 _____ C:\Users\MERCURY\Downloads\Addition.txt
2015-10-24 17:33 - 2015-10-24 17:44 - 00022222 _____ C:\Users\MERCURY\Downloads\FRST.txt
2015-10-24 17:31 - 2015-10-24 17:33 - 02196480 _____ (Farbar) C:\Users\MERCURY\Downloads\FRST64.exe
2015-10-24 17:22 - 2015-10-24 17:22 - 00003252 _____ C:\WINDOWS\System32\Tasks\{EDEC19A0-1DB9-46CD-8B69-AB2543EA22CD}
2015-10-24 17:20 - 2015-10-24 17:22 - 00000000 ____D C:\Program Files (x86)\MaxDrivrUpdater
2015-10-24 17:20 - 2015-10-24 17:20 - 00000008 _____ C:\END
2015-10-24 17:20 - 2015-10-24 17:20 - 00000000 ____D C:\Program Files (x86)\MaxDrivrUpdater_v121.4491
2015-10-24 17:20 - 2015-10-24 17:20 - 00000000 ____D C:\Program Files (x86)\CinemaPlus_1.3dV24.10
2015-10-24 17:19 - 2015-10-24 17:19 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Opera Software
2015-10-24 17:19 - 2015-10-24 17:19 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Opera Software
2015-10-24 17:15 - 2015-10-24 17:22 - 00000000 ____D C:\Program Files (x86)\Opera
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\Public\Documents\Guid
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\Public\Documents\Baidu
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jogotempo
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Program Files (x86)\jogotempo
2015-10-24 17:13 - 2015-10-24 17:14 - 00000000 ____D C:\Program Files (x86)\RayDld
2015-10-24 17:12 - 2015-10-24 17:12 - 00000000 ____D C:\Program Files (x86)\mbot_de_014010123
2015-10-24 17:10 - 2015-10-24 17:10 - 00004264 _____ C:\WINDOWS\System32\Tasks\amiupdaterExi
2015-10-24 17:10 - 2015-10-24 17:10 - 00003464 _____ C:\WINDOWS\System32\Tasks\amiupdaterExd
2015-10-24 16:54 - 2015-10-24 16:54 - 00016148 _____ C:\WINDOWS\system32\BILLY_MERCURY_HistoryPrediction.bin
2015-10-24 15:26 - 2015-10-24 15:26 - 00000000 ___HD C:\OneDriveTemp
2015-10-24 15:22 - 2015-10-24 15:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-10-24 15:19 - 2015-10-24 15:19 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-10-24 15:19 - 2015-10-24 15:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-10-24 15:17 - 2015-10-24 15:19 - 00000000 ____D C:\Program Files\iTunes
2015-10-24 15:17 - 2015-10-24 15:17 - 00000000 ____D C:\Program Files\iPod
2015-10-20 13:26 - 2015-10-20 13:26 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-10-17 15:13 - 2015-10-17 15:13 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\PhotoSync
2015-10-17 15:11 - 2015-10-17 15:11 - 00002597 _____ C:\Users\Public\Desktop\PhotoSync.lnk
2015-10-17 15:11 - 2015-10-17 15:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoSync
2015-10-17 10:59 - 2015-10-17 15:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-14 13:54 - 2015-10-10 09:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-14 13:54 - 2015-10-10 08:40 - 21875712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-10-14 13:54 - 2015-10-10 08:07 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-10-14 13:54 - 2015-10-06 05:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-10-14 13:54 - 2015-10-06 04:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-10-14 13:54 - 2015-10-01 06:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-14 13:54 - 2015-10-01 06:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-14 13:54 - 2015-10-01 06:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-14 13:54 - 2015-10-01 06:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-14 13:54 - 2015-10-01 06:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-14 13:54 - 2015-10-01 05:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-14 13:54 - 2015-09-25 06:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-10-14 13:54 - 2015-09-25 06:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-10-14 13:54 - 2015-09-25 05:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-14 13:54 - 2015-09-25 05:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-10-14 13:54 - 2015-09-25 05:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-10-14 13:54 - 2015-09-25 05:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-14 13:54 - 2015-09-25 05:17 - 24595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-14 13:54 - 2015-09-25 05:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-10-14 13:54 - 2015-09-25 05:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-10-14 13:54 - 2015-09-25 05:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-14 13:54 - 2015-09-25 05:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-10-14 13:54 - 2015-09-25 05:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-10-14 13:54 - 2015-09-25 05:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-10-14 13:54 - 2015-09-25 05:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-14 13:54 - 2015-09-25 05:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-10-14 13:54 - 2015-09-25 05:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-10-14 13:54 - 2015-09-25 05:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-10-14 13:54 - 2015-09-25 05:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-10-14 13:54 - 2015-09-25 05:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-10-14 13:54 - 2015-09-25 04:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-10-14 13:54 - 2015-09-25 04:48 - 19325952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-14 13:54 - 2015-09-25 04:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-10-14 13:54 - 2015-09-25 04:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-10-14 13:54 - 2015-09-25 04:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-14 13:54 - 2015-09-25 04:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-10-14 13:54 - 2015-09-25 04:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-10-14 13:54 - 2015-09-25 04:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-10-14 13:54 - 2015-09-25 04:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-10-04 11:55 - 2015-10-04 12:05 - 58777218 _____ C:\Users\MERCURY\Downloads\Ecos Audio - Supersticiones_2.wma
2015-10-04 11:54 - 2015-10-04 12:07 - 73507735 _____ C:\Users\MERCURY\Downloads\Letzter Gruss aus Granada_2.wma
2015-10-01 12:25 - 2015-09-19 07:14 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2015-10-01 12:25 - 2015-09-17 08:50 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys
2015-10-01 12:25 - 2015-09-17 08:49 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2015-10-01 12:25 - 2015-09-17 08:49 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-10-01 12:25 - 2015-09-17 08:48 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-10-01 12:25 - 2015-09-17 08:48 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-10-01 12:25 - 2015-09-17 08:47 - 01397088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-10-01 12:25 - 2015-09-17 08:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-10-01 12:25 - 2015-09-17 08:43 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-10-01 12:25 - 2015-09-17 08:37 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2015-10-01 12:25 - 2015-09-17 08:37 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-10-01 12:25 - 2015-09-17 08:28 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2015-10-01 12:25 - 2015-09-17 08:28 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-10-01 12:25 - 2015-09-17 08:27 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-10-01 12:25 - 2015-09-17 08:27 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-10-01 12:25 - 2015-09-17 08:25 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-10-01 12:25 - 2015-09-17 08:21 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-10-01 12:25 - 2015-09-17 08:20 - 00764416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-10-01 12:25 - 2015-09-17 08:11 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-10-01 12:25 - 2015-09-17 08:10 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2015-10-01 12:25 - 2015-09-17 08:09 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-10-01 12:25 - 2015-09-17 08:09 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2015-10-01 12:25 - 2015-09-17 08:06 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-10-01 12:25 - 2015-09-17 08:06 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-10-01 12:25 - 2015-09-17 08:06 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-10-01 12:25 - 2015-09-17 08:05 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-10-01 12:25 - 2015-09-17 08:05 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-10-01 12:25 - 2015-09-17 08:03 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2015-10-01 12:25 - 2015-09-17 08:02 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-10-01 12:25 - 2015-09-17 08:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 02417664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KeywordDetectorMsftSidAdapter.dll
2015-10-01 12:25 - 2015-09-17 07:58 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-10-01 12:25 - 2015-09-17 07:55 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 12:25 - 2015-09-17 07:53 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2015-10-01 12:25 - 2015-09-17 07:50 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys
2015-10-01 12:25 - 2015-09-17 07:49 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2015-10-01 12:25 - 2015-09-17 07:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-10-01 12:25 - 2015-09-17 07:41 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 01918464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-10-01 12:25 - 2015-09-17 07:39 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-10-01 12:25 - 2015-09-17 07:39 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 12:25 - 2015-09-17 07:38 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2015-10-01 12:25 - 2015-09-17 07:37 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-10-01 12:25 - 2015-09-17 07:36 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:34 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2015-10-01 12:25 - 2015-09-17 07:31 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2015-10-01 12:25 - 2015-09-17 07:30 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-10-01 12:25 - 2015-09-17 07:28 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-10-01 12:25 - 2015-09-17 07:26 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-10-01 12:25 - 2015-09-17 07:16 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-10-01 12:25 - 2015-09-13 04:05 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-10-01 12:25 - 2015-09-13 03:41 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-09-30 15:29 - 2015-09-30 15:29 - 00000966 _____ C:\Users\Public\Desktop\Audials 12.lnk
2015-09-30 15:14 - 2015-10-24 15:03 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DD6E9A90-2E3B-4A9E-82CF-290362D3D5B2}
2015-09-30 14:52 - 2015-09-30 15:05 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\iFunbox_UserCache
2015-09-30 13:48 - 2015-09-30 14:57 - 00000000 ____D C:\Users\MERCURY\Downloads\Spanisch lernen PONS Sprachkurs fur Anf303244nger [PONS GmbH] (v2 60 2 3GS Univ i8 os61)-teflon rc325
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-24 17:44 - 2015-01-25 19:47 - 00000000 ____D C:\FRST
2015-10-24 17:27 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-10-24 17:24 - 2015-01-25 15:43 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-10-24 17:21 - 2015-01-31 11:41 - 00001201 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-10-24 17:16 - 2015-01-25 15:49 - 00001171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-10-24 17:16 - 2015-01-25 15:49 - 00001159 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-10-24 17:10 - 2015-07-10 14:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-24 17:08 - 2015-06-21 15:57 - 00001244 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job
2015-10-24 17:03 - 2015-04-28 19:51 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-10-24 15:46 - 2015-01-25 15:56 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Spotify
2015-10-24 15:46 - 2015-01-25 15:53 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Spotify
2015-10-24 15:29 - 2015-07-29 15:30 - 01790124 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-10-24 15:29 - 2015-07-10 18:34 - 00771100 _____ C:\WINDOWS\system32\perfh007.dat
2015-10-24 15:29 - 2015-07-10 18:34 - 00153964 _____ C:\WINDOWS\system32\perfc007.dat
2015-10-24 15:27 - 2015-01-25 16:22 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Dropbox
2015-10-24 15:27 - 2014-05-07 17:22 - 00000000 ___RD C:\Users\MERCURY\Dropbox
2015-10-24 15:26 - 2015-05-25 14:44 - 00000000 ___RD C:\Users\MERCURY\iCloudDrive
2015-10-24 15:26 - 2015-01-16 15:06 - 00000000 ___DO C:\Users\MERCURY\SkyDrive
2015-10-24 15:25 - 2015-07-29 15:13 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-10-24 15:25 - 2015-07-10 14:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-10-24 15:23 - 2015-07-10 11:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-10-24 15:22 - 2015-05-25 14:44 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Apple Inc
2015-10-24 15:21 - 2015-07-10 14:20 - 00054163 _____ C:\WINDOWS\setupact.log
2015-10-24 15:17 - 2015-02-24 14:50 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-10-24 15:17 - 2015-02-02 13:40 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-10-24 15:01 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-10-22 21:09 - 2015-06-28 18:07 - 00000000 ____D C:\Users\MERCURY\AppData\Local\JDownloader 2.0
2015-10-22 20:35 - 2015-09-06 11:46 - 00000000 ____D C:\Users\MERCURY\Ultimate
2015-10-22 20:35 - 2015-09-06 11:46 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\.Ultimate
2015-10-22 20:25 - 2014-11-12 13:05 - 00000000 ____D C:\Users\MERCURY\Documents\My Digital Editions
2015-10-20 14:08 - 2015-06-21 15:57 - 00001192 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job
2015-10-20 12:41 - 2015-07-10 12:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-20 12:36 - 2015-05-20 12:25 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-18 11:42 - 2015-01-25 17:50 - 00000999 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-10-18 11:42 - 2015-01-25 17:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-10-18 11:42 - 2015-01-25 17:50 - 00000000 ____D C:\Program Files\Calibre2
2015-10-17 15:11 - 2015-01-25 16:45 - 00000000 ____D C:\Program Files (x86)\PhotoSync
2015-10-17 15:04 - 2015-02-02 13:41 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Apple Computer
2015-10-17 15:00 - 2015-07-29 15:09 - 00014170 _____ C:\WINDOWS\PFRO.log
2015-10-17 15:00 - 2015-01-25 15:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-17 14:03 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-16 11:08 - 2015-05-20 12:25 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-10-16 11:08 - 2015-01-25 20:09 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-16 11:06 - 2015-01-25 20:09 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-10-16 05:10 - 2015-07-10 13:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-16 05:10 - 2015-07-10 13:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-09 13:49 - 2014-05-07 16:28 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Packages
2015-10-04 15:04 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\rescache
2015-10-01 16:39 - 2015-09-06 11:54 - 00000000 ____D C:\Users\MERCURY\Documents\My Kindle Content
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___SD C:\WINDOWS\system32\F12
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\L2Schemas
2015-09-30 15:29 - 2015-05-30 15:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 12
2015-09-30 15:14 - 2015-02-02 13:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieUserList
2015-09-30 15:14 - 2015-02-02 13:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieSiteList
2015-09-30 14:22 - 2015-02-15 12:39 - 00001427 _____ C:\Users\MERCURY\Desktop\CopyTrans Control Center.lnk
2015-09-30 14:22 - 2015-02-15 12:39 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center
2015-09-30 12:23 - 2015-01-27 20:36 - 00000000 ____D C:\Program Files\Microsoft Office 15
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-07-29 15:14 - 2015-07-29 15:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\MERCURY\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplfix3f.dll
C:\Users\MERCURY\AppData\Local\Temp\InstallHelper.exe
C:\Users\MERCURY\AppData\Local\Temp\Opera_NI_stable.exe
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole1073313854267173256.dll
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole8943514115781240311.dll
C:\Users\MERCURY\AppData\Local\Temp\Sony+walkman+nwz+s616f+fi__10924_i1723664572_il2295212.exe
C:\Users\MERCURY\AppData\Local\Temp\SynciosDeviceService.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-10-20 12:34
==================== Ende von FRST.txt ============================
Geändert von Pille77 (24.10.2015 um 16:50 Uhr) |
|
24.10.2015, 16:51
| #2 |
| | habe mir adware eingfangenCode:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:24-10-2015
durchgeführt von MERCURY (Administrator) auf BILLY (24-10-2015 17:44:03)
Gestartet von C:\Users\MERCURY\Downloads
Geladene Profile: MERCURY & Gast (Verfügbare Profile: MERCURY & Gast)
Platform: Windows 10 Home (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Programme (x86)\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(RapidSolution Software AG) C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Spotify Ltd) C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
() C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Dropbox, Inc.) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Apple Inc.) C:\Program Files\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.13821.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.PowerPoint_17.6228.10041.0_x64__8wekyb3d8bbwe\pptim.exe
() C:\Program Files (x86)\RayDld\ihpmServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [5836888 2015-10-01] (Emsisoft Ltd)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Spotify Web Helper] => C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2025016 2015-09-19] (Spotify Ltd)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe [2412440 2015-09-18] ()
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Dropbox Update] => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-21] (Dropbox, Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [61200 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"
HKU\S-1-5-21-4024391792-2930209080-385294340-501\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-10-21] (Apple Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-06-22]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-20]
ShortcutTarget: Dropbox.lnk -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{a0a490e2-89f6-4e4a-a04c-a750cf07901a}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.oursurfing.com/web/?type=ds&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-4024391792-2930209080-385294340-1001 -> hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
FireFox:
========
FF ProfilePath: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: oursurfing
FF Homepage: hxxp://www.oursurfing.com/?type=hp&ts=1445699591&z=f579f67bcd43fed6139b788gbz9z4w3qft3tawbtfg&from=amt&uid=st1000dm003-1ch162_z1d9zg2lxxxxz1d9zg2l
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-27] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\user.js [2015-10-24]
FF SearchPlugin: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\searchplugins\oursurfing.xml [2015-10-24]
FF Extension: deskCut - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\deskCutv2@gmail.com [2015-10-24] [ist nicht signiert]
FF Extension: ColorfulTabs - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-10-17]
FF Extension: FireFTP - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-05-30]
FF Extension: anonymoX - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\client@anonymox.net.xpi [2015-09-30]
FF Extension: Ghostery - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\firefox@ghostery.com.xpi [2015-09-19]
FF Extension: yaBeat - YouTube to MP3 - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid0-uqZgom7deYId1IGHnMog6eoQ2cI@jetpack.xpi [2015-05-30]
FF Extension: Google Selection Translate - For AltKey - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid1-f7dnBeTj8ElpOQ@jetpack.xpi [2015-09-13]
FF Extension: Zoom Page - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\zoompage@DW-dev.xpi [2015-10-17]
FF Extension: ImTranslator - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2015-10-17]
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [7084784 2015-10-01] (Emsisoft Ltd)
R2 AAV UpdateService; C:\Programme (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-18] (Intel Corporation)
R2 ihpmServer; C:\Program Files (x86)\RayDld\ihpmServer.exe [270568 2015-10-12] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448464 2015-03-30] (TeamViewer GmbH)
R2 Virtual CDAudio Service; C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe [179608 2015-09-18] (RapidSolution Software AG)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 epp64; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\epp64.sys [138504 2015-10-01] (Emsisoft GmbH)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-08-28] (Intel Corporation)
R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [25256 2015-04-21] (Audials AG)
R3 rsvcdwdr; C:\Windows\System32\drivers\rsvcdwdr.sys [45192 2015-04-21] (RapidSolution Software AG)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek )
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-25] (Acronis International GmbH)
S0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-25] (Acronis International GmbH)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-24 17:34 - 2015-10-24 17:34 - 00041917 _____ C:\Users\MERCURY\Downloads\Addition.txt
2015-10-24 17:33 - 2015-10-24 17:44 - 00022222 _____ C:\Users\MERCURY\Downloads\FRST.txt
2015-10-24 17:31 - 2015-10-24 17:33 - 02196480 _____ (Farbar) C:\Users\MERCURY\Downloads\FRST64.exe
2015-10-24 17:22 - 2015-10-24 17:22 - 00003252 _____ C:\WINDOWS\System32\Tasks\{EDEC19A0-1DB9-46CD-8B69-AB2543EA22CD}
2015-10-24 17:20 - 2015-10-24 17:22 - 00000000 ____D C:\Program Files (x86)\MaxDrivrUpdater
2015-10-24 17:20 - 2015-10-24 17:20 - 00000008 _____ C:\END
2015-10-24 17:20 - 2015-10-24 17:20 - 00000000 ____D C:\Program Files (x86)\MaxDrivrUpdater_v121.4491
2015-10-24 17:20 - 2015-10-24 17:20 - 00000000 ____D C:\Program Files (x86)\CinemaPlus_1.3dV24.10
2015-10-24 17:19 - 2015-10-24 17:19 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Opera Software
2015-10-24 17:19 - 2015-10-24 17:19 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Opera Software
2015-10-24 17:15 - 2015-10-24 17:22 - 00000000 ____D C:\Program Files (x86)\Opera
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\Public\Documents\Guid
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\Public\Documents\Baidu
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jogotempo
2015-10-24 17:14 - 2015-10-24 17:14 - 00000000 ____D C:\Program Files (x86)\jogotempo
2015-10-24 17:13 - 2015-10-24 17:14 - 00000000 ____D C:\Program Files (x86)\RayDld
2015-10-24 17:12 - 2015-10-24 17:12 - 00000000 ____D C:\Program Files (x86)\mbot_de_014010123
2015-10-24 17:10 - 2015-10-24 17:10 - 00004264 _____ C:\WINDOWS\System32\Tasks\amiupdaterExi
2015-10-24 17:10 - 2015-10-24 17:10 - 00003464 _____ C:\WINDOWS\System32\Tasks\amiupdaterExd
2015-10-24 16:54 - 2015-10-24 16:54 - 00016148 _____ C:\WINDOWS\system32\BILLY_MERCURY_HistoryPrediction.bin
2015-10-24 15:26 - 2015-10-24 15:26 - 00000000 ___HD C:\OneDriveTemp
2015-10-24 15:22 - 2015-10-24 15:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-10-24 15:19 - 2015-10-24 15:19 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-10-24 15:19 - 2015-10-24 15:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-10-24 15:17 - 2015-10-24 15:19 - 00000000 ____D C:\Program Files\iTunes
2015-10-24 15:17 - 2015-10-24 15:17 - 00000000 ____D C:\Program Files\iPod
2015-10-20 13:26 - 2015-10-20 13:26 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-10-17 15:13 - 2015-10-17 15:13 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\PhotoSync
2015-10-17 15:11 - 2015-10-17 15:11 - 00002597 _____ C:\Users\Public\Desktop\PhotoSync.lnk
2015-10-17 15:11 - 2015-10-17 15:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoSync
2015-10-17 10:59 - 2015-10-17 15:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-14 13:54 - 2015-10-10 09:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-14 13:54 - 2015-10-10 08:40 - 21875712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-10-14 13:54 - 2015-10-10 08:07 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-10-14 13:54 - 2015-10-06 05:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-10-14 13:54 - 2015-10-06 04:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-10-14 13:54 - 2015-10-01 06:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-14 13:54 - 2015-10-01 06:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-14 13:54 - 2015-10-01 06:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-14 13:54 - 2015-10-01 06:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-14 13:54 - 2015-10-01 06:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-14 13:54 - 2015-10-01 05:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-14 13:54 - 2015-09-25 06:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-10-14 13:54 - 2015-09-25 06:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-10-14 13:54 - 2015-09-25 05:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-14 13:54 - 2015-09-25 05:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-10-14 13:54 - 2015-09-25 05:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-10-14 13:54 - 2015-09-25 05:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-14 13:54 - 2015-09-25 05:17 - 24595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-14 13:54 - 2015-09-25 05:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-10-14 13:54 - 2015-09-25 05:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-10-14 13:54 - 2015-09-25 05:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-14 13:54 - 2015-09-25 05:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-14 13:54 - 2015-09-25 05:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-10-14 13:54 - 2015-09-25 05:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-10-14 13:54 - 2015-09-25 05:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2015-10-14 13:54 - 2015-09-25 05:02 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-10-14 13:54 - 2015-09-25 05:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-14 13:54 - 2015-09-25 05:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-10-14 13:54 - 2015-09-25 05:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-10-14 13:54 - 2015-09-25 05:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-10-14 13:54 - 2015-09-25 05:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-10-14 13:54 - 2015-09-25 05:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-10-14 13:54 - 2015-09-25 04:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-10-14 13:54 - 2015-09-25 04:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-10-14 13:54 - 2015-09-25 04:48 - 19325952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-14 13:54 - 2015-09-25 04:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-10-14 13:54 - 2015-09-25 04:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-10-14 13:54 - 2015-09-25 04:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-10-14 13:54 - 2015-09-25 04:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-10-14 13:54 - 2015-09-25 04:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-14 13:54 - 2015-09-25 04:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-10-14 13:54 - 2015-09-25 04:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-10-14 13:54 - 2015-09-25 04:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-10-14 13:54 - 2015-09-25 04:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-10-14 13:54 - 2015-09-25 04:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-10-04 11:55 - 2015-10-04 12:05 - 58777218 _____ C:\Users\MERCURY\Downloads\Ecos Audio - Supersticiones_2.wma
2015-10-04 11:54 - 2015-10-04 12:07 - 73507735 _____ C:\Users\MERCURY\Downloads\Letzter Gruss aus Granada_2.wma
2015-10-01 12:25 - 2015-09-19 07:14 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-10-01 12:25 - 2015-09-17 08:50 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2015-10-01 12:25 - 2015-09-17 08:50 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-10-01 12:25 - 2015-09-17 08:49 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys
2015-10-01 12:25 - 2015-09-17 08:49 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2015-10-01 12:25 - 2015-09-17 08:49 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-10-01 12:25 - 2015-09-17 08:48 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-10-01 12:25 - 2015-09-17 08:48 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-10-01 12:25 - 2015-09-17 08:48 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-10-01 12:25 - 2015-09-17 08:47 - 01397088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-10-01 12:25 - 2015-09-17 08:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-10-01 12:25 - 2015-09-17 08:43 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-10-01 12:25 - 2015-09-17 08:37 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2015-10-01 12:25 - 2015-09-17 08:37 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-10-01 12:25 - 2015-09-17 08:28 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2015-10-01 12:25 - 2015-09-17 08:28 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-10-01 12:25 - 2015-09-17 08:28 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-10-01 12:25 - 2015-09-17 08:27 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-10-01 12:25 - 2015-09-17 08:27 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-10-01 12:25 - 2015-09-17 08:26 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-10-01 12:25 - 2015-09-17 08:25 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-10-01 12:25 - 2015-09-17 08:21 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-10-01 12:25 - 2015-09-17 08:20 - 00764416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-10-01 12:25 - 2015-09-17 08:11 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-10-01 12:25 - 2015-09-17 08:10 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2015-10-01 12:25 - 2015-09-17 08:09 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-10-01 12:25 - 2015-09-17 08:09 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll
2015-10-01 12:25 - 2015-09-17 08:08 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2015-10-01 12:25 - 2015-09-17 08:06 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-10-01 12:25 - 2015-09-17 08:06 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-10-01 12:25 - 2015-09-17 08:06 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-10-01 12:25 - 2015-09-17 08:05 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-10-01 12:25 - 2015-09-17 08:05 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-10-01 12:25 - 2015-09-17 08:04 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-10-01 12:25 - 2015-09-17 08:03 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll
2015-10-01 12:25 - 2015-09-17 08:03 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2015-10-01 12:25 - 2015-09-17 08:02 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-10-01 12:25 - 2015-09-17 08:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 02417664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-10-01 12:25 - 2015-09-17 08:00 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KeywordDetectorMsftSidAdapter.dll
2015-10-01 12:25 - 2015-09-17 07:58 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-10-01 12:25 - 2015-09-17 07:57 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-10-01 12:25 - 2015-09-17 07:56 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2015-10-01 12:25 - 2015-09-17 07:55 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-10-01 12:25 - 2015-09-17 07:55 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-10-01 12:25 - 2015-09-17 07:54 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 12:25 - 2015-09-17 07:53 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-10-01 12:25 - 2015-09-17 07:52 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-10-01 12:25 - 2015-09-17 07:51 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2015-10-01 12:25 - 2015-09-17 07:50 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll
2015-10-01 12:25 - 2015-09-17 07:50 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys
2015-10-01 12:25 - 2015-09-17 07:49 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll
2015-10-01 12:25 - 2015-09-17 07:49 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2015-10-01 12:25 - 2015-09-17 07:47 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2015-10-01 12:25 - 2015-09-17 07:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2015-10-01 12:25 - 2015-09-17 07:46 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-10-01 12:25 - 2015-09-17 07:45 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-10-01 12:25 - 2015-09-17 07:41 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 01918464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-10-01 12:25 - 2015-09-17 07:40 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-10-01 12:25 - 2015-09-17 07:39 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-10-01 12:25 - 2015-09-17 07:39 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 12:25 - 2015-09-17 07:38 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2015-10-01 12:25 - 2015-09-17 07:37 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-10-01 12:25 - 2015-09-17 07:36 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-10-01 12:25 - 2015-09-17 07:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2015-10-01 12:25 - 2015-09-17 07:34 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-10-01 12:25 - 2015-09-17 07:32 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2015-10-01 12:25 - 2015-09-17 07:31 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2015-10-01 12:25 - 2015-09-17 07:30 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-10-01 12:25 - 2015-09-17 07:29 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-10-01 12:25 - 2015-09-17 07:28 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-10-01 12:25 - 2015-09-17 07:26 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-10-01 12:25 - 2015-09-17 07:16 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-10-01 12:25 - 2015-09-13 04:05 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-10-01 12:25 - 2015-09-13 03:41 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-09-30 15:29 - 2015-09-30 15:29 - 00000966 _____ C:\Users\Public\Desktop\Audials 12.lnk
2015-09-30 15:14 - 2015-10-24 15:03 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DD6E9A90-2E3B-4A9E-82CF-290362D3D5B2}
2015-09-30 14:52 - 2015-09-30 15:05 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\iFunbox_UserCache
2015-09-30 13:48 - 2015-09-30 14:57 - 00000000 ____D C:\Users\MERCURY\Downloads\Spanisch lernen PONS Sprachkurs fur Anf303244nger [PONS GmbH] (v2 60 2 3GS Univ i8 os61)-teflon rc325
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-24 17:44 - 2015-01-25 19:47 - 00000000 ____D C:\FRST
2015-10-24 17:27 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-10-24 17:24 - 2015-01-25 15:43 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-10-24 17:21 - 2015-01-31 11:41 - 00001201 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-10-24 17:16 - 2015-01-25 15:49 - 00001171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-10-24 17:16 - 2015-01-25 15:49 - 00001159 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-10-24 17:10 - 2015-07-10 14:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-24 17:08 - 2015-06-21 15:57 - 00001244 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job
2015-10-24 17:03 - 2015-04-28 19:51 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-10-24 15:46 - 2015-01-25 15:56 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Spotify
2015-10-24 15:46 - 2015-01-25 15:53 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Spotify
2015-10-24 15:29 - 2015-07-29 15:30 - 01790124 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-10-24 15:29 - 2015-07-10 18:34 - 00771100 _____ C:\WINDOWS\system32\perfh007.dat
2015-10-24 15:29 - 2015-07-10 18:34 - 00153964 _____ C:\WINDOWS\system32\perfc007.dat
2015-10-24 15:27 - 2015-01-25 16:22 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Dropbox
2015-10-24 15:27 - 2014-05-07 17:22 - 00000000 ___RD C:\Users\MERCURY\Dropbox
2015-10-24 15:26 - 2015-05-25 14:44 - 00000000 ___RD C:\Users\MERCURY\iCloudDrive
2015-10-24 15:26 - 2015-01-16 15:06 - 00000000 ___DO C:\Users\MERCURY\SkyDrive
2015-10-24 15:25 - 2015-07-29 15:13 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-10-24 15:25 - 2015-07-10 14:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-10-24 15:23 - 2015-07-10 11:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-10-24 15:22 - 2015-05-25 14:44 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Apple Inc
2015-10-24 15:21 - 2015-07-10 14:20 - 00054163 _____ C:\WINDOWS\setupact.log
2015-10-24 15:17 - 2015-02-24 14:50 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-10-24 15:17 - 2015-02-02 13:40 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-10-24 15:01 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-10-22 21:09 - 2015-06-28 18:07 - 00000000 ____D C:\Users\MERCURY\AppData\Local\JDownloader 2.0
2015-10-22 20:35 - 2015-09-06 11:46 - 00000000 ____D C:\Users\MERCURY\Ultimate
2015-10-22 20:35 - 2015-09-06 11:46 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\.Ultimate
2015-10-22 20:25 - 2014-11-12 13:05 - 00000000 ____D C:\Users\MERCURY\Documents\My Digital Editions
2015-10-20 14:08 - 2015-06-21 15:57 - 00001192 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job
2015-10-20 12:41 - 2015-07-10 12:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-20 12:36 - 2015-05-20 12:25 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-18 11:42 - 2015-01-25 17:50 - 00000999 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-10-18 11:42 - 2015-01-25 17:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-10-18 11:42 - 2015-01-25 17:50 - 00000000 ____D C:\Program Files\Calibre2
2015-10-17 15:11 - 2015-01-25 16:45 - 00000000 ____D C:\Program Files (x86)\PhotoSync
2015-10-17 15:04 - 2015-02-02 13:41 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Apple Computer
2015-10-17 15:00 - 2015-07-29 15:09 - 00014170 _____ C:\WINDOWS\PFRO.log
2015-10-17 15:00 - 2015-01-25 15:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-17 14:03 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-16 11:08 - 2015-05-20 12:25 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-10-16 11:08 - 2015-01-25 20:09 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-16 11:06 - 2015-01-25 20:09 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-10-16 05:10 - 2015-07-10 13:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-16 05:10 - 2015-07-10 13:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-09 13:49 - 2014-05-07 16:28 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Packages
2015-10-04 15:04 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\rescache
2015-10-01 16:39 - 2015-09-06 11:54 - 00000000 ____D C:\Users\MERCURY\Documents\My Kindle Content
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___SD C:\WINDOWS\system32\F12
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-10-01 16:05 - 2015-07-10 13:04 - 00000000 ____D C:\WINDOWS\L2Schemas
2015-09-30 15:29 - 2015-05-30 15:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 12
2015-09-30 15:14 - 2015-02-02 13:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieUserList
2015-09-30 15:14 - 2015-02-02 13:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieSiteList
2015-09-30 14:22 - 2015-02-15 12:39 - 00001427 _____ C:\Users\MERCURY\Desktop\CopyTrans Control Center.lnk
2015-09-30 14:22 - 2015-02-15 12:39 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center
2015-09-30 12:23 - 2015-01-27 20:36 - 00000000 ____D C:\Program Files\Microsoft Office 15
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-07-29 15:14 - 2015-07-29 15:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\MERCURY\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplfix3f.dll
C:\Users\MERCURY\AppData\Local\Temp\InstallHelper.exe
C:\Users\MERCURY\AppData\Local\Temp\Opera_NI_stable.exe
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole1073313854267173256.dll
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole8943514115781240311.dll
C:\Users\MERCURY\AppData\Local\Temp\Sony+walkman+nwz+s616f+fi__10924_i1723664572_il2295212.exe
C:\Users\MERCURY\AppData\Local\Temp\SynciosDeviceService.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-10-20 12:34
==================== Ende von FRST.txt ============================
|
|
24.10.2015, 16:59
| #3 |
| /// the machine /// TB-Ausbilder    | habe mir adware eingfangen Hi,
__________________bitte noch die Addition.txt von FRST posten 
__________________ |
|
24.10.2015, 17:20
| #4 |
| | habe mir adware eingfangen hi schrauber, oh das andere war wohl doppelt, .) danke schon mal für die Hilfe !! ach so, und so ein scheiß oursurfing kommt immer, wobei das hat sich in den brower eingschlichen! mistvieh! Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:24-10-2015
durchgeführt von MERCURY (2015-10-24 17:44:33)
Gestartet von C:\Users\MERCURY\Downloads
Windows 10 Home (X64) (2015-07-29 14:16:24)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-4024391792-2930209080-385294340-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4024391792-2930209080-385294340-503 - Limited - Disabled)
Gast (S-1-5-21-4024391792-2930209080-385294340-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4024391792-2930209080-385294340-1003 - Limited - Enabled)
MERCURY (S-1-5-21-4024391792-2930209080-385294340-1001 - Administrator - Enabled) => C:\Users\MERCURY
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.38 beta (HKLM-x32\...\7-Zip) (Version: - )
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20071 - Adobe Systems Incorporated)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Amazon Kindle) (Version: - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Audials (HKLM-x32\...\{BC9B1130-6992-4C49-A166-A2220E220815}) (Version: 12.1.10000.0 - Audials AG)
BILD Steuer 2015 (HKLM-x32\...\{90B7E6F3-25B5-4B5E-B9F5-ACA6287489E4}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DBF2A8AA-9EE9-454D-8958-F74F1FCB0789}) (Version: 2.41.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5571 - CDBurnerXP)
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\CopyTrans Suite) (Version: 4.004 - WindSolutions)
Dropbox (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Dropbox) (Version: 3.10.8 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.2.24.20150630 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
Epubor Ultimate (HKLM-x32\...\Epubor Ultimate) (Version: 3.0.4.19 - Epubor Inc.)
Freemake Video Converter Version 4.1.5 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
LibreOffice 4.3.7.2 (HKLM-x32\...\{8ED4A1FC-56CF-414C-A9AB-A37714AA9EA7}) (Version: 4.3.7.2 - The Document Foundation)
Microsoft OneNote 2013 - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 15.0.4753.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 41.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 de)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
PhotoSync (HKLM\...\{4449711E-4AC0-4231-A544-826CD6348502}) (Version: 3.0.6 - touchbyte GmbH)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
RarZilla Free Unrar (HKLM-x32\...\RarZilla Free Unrar) (Version: 6.50 - Philipp Winterberg)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RippMe (HKLM-x32\...\{F0D21B7C-CB99-4C14-9408-C45CF45EBC24}) (Version: 3.05.000 - Lindy)
Spotify (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Spotify) (Version: 1.0.14.124.g4dfabc51 - Spotify AB)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.40798 - TeamViewer)
VirtualDJ 8 (HKLM-x32\...\{F33070AA-1979-4192-9B75-C018C2F423FF}) (Version: 8.0.2162.0 - Atomix Productions)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
waterMark V2 (HKLM-x32\...\waterMark V2) (Version: - )
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
04-10-2015 13:25:15 Installed calibre 64bit
11-10-2015 13:34:39 Windows Update
16-10-2015 11:05:51 Windows Update
17-10-2015 11:45:34 PhotoSync wird installiert
20-10-2015 12:40:36 Windows Update
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {2A4C0426-4BEB-4818-BA9B-F0E1268D1DF8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {3352DA8A-D3C3-4688-BBD8-70DD563D7EFA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {37C8B6DE-3457-4CF6-AC49-BDD966E8C815} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {43DEA015-7B4C-4A61-A57D-59D7B4AEE93A} - System32\Tasks\{EDEC19A0-1DB9-46CD-8B69-AB2543EA22CD} => pcalua.exe -a "C:\Program Files (x86)\MaxDrivrUpdater\uninstall.exe"
Task: {455E1D2D-72ED-4E54-94A9-F9A53C750D61} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {460247E2-A94A-4DD8-8387-A00DD7BE5888} - System32\Tasks\amiupdaterExd => C:\Users\MERCURY\AppData\Local\Temp\task.vbs <==== ACHTUNG
Task: {625DA84E-98D9-4A70-81A2-87E41D262B0A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {6B4CAB6E-F2DE-4404-BB12-39B5844F7F22} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {734CC9CE-2F53-43D7-90A3-A332518CA45D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {7B3C768B-5BDB-4163-BE7B-19A6BAC275C8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {82B02B90-088F-424B-915A-353E75D02880} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-17] (Adobe Systems Incorporated)
Task: {88980258-7C2F-4057-8E33-0624C438A5F6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)
Task: {8BAAF8E1-DEF7-4D84-BC82-BD8332140B0B} - System32\Tasks\amiupdaterExi => C:\Users\MERCURY\AppData\Local\Temp\amiupdater1721.exe <==== ACHTUNG
Task: {8F24E449-EAB9-4729-AEA9-293295BF6713} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {907115CA-88D1-4780-834E-124F2ADBEC1C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {AA087389-78C7-4521-83BA-166BEFFF4C56} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {AB99A591-F04B-4883-93B7-91E3BDF9C32C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {B29FBF40-58FD-4389-906A-E46F7615975F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {B66C7CB6-9CA4-44E8-876A-C6B7B69CF117} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {CF524D95-765C-4B77-BF69-67E6DF43CF83} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-16] (Microsoft Corporation)
Task: {CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-07-29 16:04 - 2015-07-29 16:04 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2008-10-24 17:35 - 2008-10-24 17:35 - 00128296 _____ () C:\Programme (x86)\AAVUpdateManager\aavus.exe
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-27 20:36 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-07-18 00:35 - 2015-07-18 00:35 - 00396688 _____ () C:\WINDOWS\system32\igfxTray.exe
2015-09-18 12:06 - 2015-09-18 12:06 - 02412440 _____ () C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe
2015-10-13 05:45 - 2015-10-13 05:45 - 00306960 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2015-10-04 11:50 - 2015-10-04 11:51 - 00012288 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-10-04 11:50 - 2015-10-04 11:51 - 10814464 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-10-12 04:01 - 2015-10-12 04:01 - 00270568 _____ () C:\Program Files (x86)\RayDld\ihpmServer.exe
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2013-10-01 11:32 - 2013-10-01 11:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-07-10 12:59 - 2015-07-10 12:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 13:00 - 2015-07-10 18:45 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 00237328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2015-10-13 05:46 - 2015-10-13 05:46 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00049424 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_thread-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00048400 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_date_time-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00068504 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashRpt.dll
2015-09-18 12:07 - 2015-09-18 12:07 - 00580504 _____ () C:\Program Files (x86)\Audials\Audials 12\SQLite3.dll
2015-09-18 12:07 - 2015-09-18 12:07 - 00545176 _____ () C:\Program Files (x86)\Audials\Audials 12\StreamingClient.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00618256 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_regex-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00016144 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_system-vc90-mt-1_39.dll
2015-10-01 16:53 - 2015-10-01 16:53 - 00314880 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Utils\46d971b07904b91768d7b03518e89d26\Utils.ni.dll
2015-10-01 16:53 - 2015-10-01 16:53 - 00650752 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ManagedInterfaces\e5a94b46c30e6c66e8faeb75087915b9\ManagedInterfaces.ni.dll
2015-10-18 10:28 - 2015-10-18 10:28 - 03788800 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\AudialsComponents\7955b8ff218ca6d7b35fe4d221f3ff95\AudialsComponents.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00699904 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\RSControls\1d04c75938d88c62845b10406fa5f736\RSControls.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00176640 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\fastJSON\335bdd33a8aed053809c75e66b8f1b53\fastJSON.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00062464 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CrashHandlerNET\fa593e4278c15e5e6e69466ee9d8be23\CrashHandlerNET.ni.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00040856 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashHandlerNET.dll
2015-10-04 11:50 - 2015-10-13 01:33 - 00166416 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\EnterpriseDataAdapter.dll
2015-10-24 15:26 - 2015-10-24 15:26 - 00071168 _____ () c:\users\mercury\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplfix3f.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012800 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00779776 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-08-01 09:07 - 2015-09-24 01:07 - 00056320 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012288 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-02-04 19:25 - 2014-02-04 19:25 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-02-04 19:25 - 2014-02-04 19:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2015-01-27 20:56 - 2015-01-27 21:04 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-02-04 19:28 - 2014-02-04 19:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MERCURY\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{9a10159e-17a2-4a41-a001-37ac9fa5be30}.bmp
HKU\S-1-5-21-4024391792-2930209080-385294340-501\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Syncios device service"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{8061451B-F643-4B99-A490-DDC6E065689E}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [TCP Query User{A982388B-504B-420B-95FE-A50CA469588F}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [UDP Query User{13A919C3-410A-4DB0-91A5-FB8044BCFAD1}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{69B9C0A6-D2D2-47F8-9126-0842B8BAD47D}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{871586EC-0FD5-49EA-B54C-386A7495DC03}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4237546A-DDAB-45A7-86AA-21FAAB7E21FD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{2E607E93-1F83-4A93-84CC-0B35BF015604}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{706640FE-D64E-4572-A693-45A89AA5C856}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [UDP Query User{CF377A06-5F49-4BC0-B200-2DBB72885DC3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AA25D4F2-C0C3-4BF7-9685-001D5091687F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{79111066-FF93-4ED4-8C89-F713055C22AD}] => (Allow) C:\Users\MERCURY\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [UDP Query User{F3AE5496-C093-4361-818F-8839A9600F22}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [TCP Query User{C29A58EF-21F1-4CE8-AFCB-91B7B5E84F7E}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [UDP Query User{B95791A6-D810-47A2-B1AC-1F840A1EBE20}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{C914D378-A40F-4977-A557-C63AA402F5C6}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{B1DCE6FB-DA7D-4E5B-8772-94F416473FFD}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{5D42F60A-B46F-4B18-A662-77509C9817F0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{A2B74FFE-27C4-436C-86DB-25BCF63CE58B}] => (Allow) LPort=35722
FirewallRules: [{1B54A621-CE15-4F0E-9100-91E9190BB771}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F96EBB40-43BE-4CD3-8F2D-7F3226CD965C}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [UDP Query User{15D3438C-C7C6-4D4F-A52C-13FC938DB6E5}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{191DBCDB-902D-48B2-8B36-DD87873CE1F1}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{6C548063-1ECA-47EE-9B55-7E1D9AF76744}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{553D57C7-DC11-485B-B920-0A7122D25EF4}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{55D2950E-F23C-4056-BCA6-53EB9ED412D7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FD994CEE-718E-4043-BE8C-0A997ACADA04}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{225CE99E-B7A4-4680-B739-B9FD13FECF0C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DDDA9F47-D578-481B-A9B6-D455904E9D10}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{074405C9-A00C-4542-B1CB-8708AAA7872D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D255724A-A5F3-4128-AC66-250A07777C4A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{16F755AA-9B26-472F-BA9E-DBFD6ECB48AA}] => (Allow) C:\Program Files (x86)\Audials\Audials 12\Audials.exe
FirewallRules: [{65A6661E-D577-4AAB-9CC4-45C8AF9738D7}] => (Allow) LPort=12972
FirewallRules: [{8C86B038-EA54-4D8D-92DF-4B0D887FB315}] => (Allow) LPort=14714
FirewallRules: [{5672B5DA-80AC-4E88-9CA7-EBE027AC3C41}] => (Allow) LPort=31931
FirewallRules: [{E7A93153-50E8-4503-95D3-D0F4AFA2EE97}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1B2AF7F0-278A-4597-B2FA-92DB45B8E248}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/24/2015 05:14:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 148c
Startzeit: 01d10e6df438c665
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: f7517f68-7a61-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 05:09:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1810
Startzeit: 01d10e6d542cafee
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 31849478-7a61-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 05:04:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 27d8
Startzeit: 01d10e6c519626a4
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 91718420-7a60-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 04:57:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 13a0
Startzeit: 01d10e5f809935ec
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 8e8df5dc-7a5f-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 04:51:35 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:35 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/24/2015 04:51:24 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:24 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/24/2015 04:51:14 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:14 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Systemfehler:
=============
Error: (10/24/2015 05:14:00 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ihpmServer" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (10/24/2015 03:29:06 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:29:02 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:58 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:45 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:41 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:32 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:28 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
CodeIntegrity:
===================================
Date: 2015-10-24 15:42:21.309
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:21.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.744
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.617
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-04 15:04:41.650
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 15:03:48.796
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:45:25.604
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:24.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:00.513
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:43:57.829
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 42%
Installierter physikalischer RAM: 8070.03 MB
Verfügbarer physikalischer RAM: 4654.03 MB
Summe virtueller Speicher: 9350.03 MB
Verfügbarer virtueller Speicher: 5588.48 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:249.56 GB) (Free:143.49 GB) NTFS
Drive d: (Meins) (Fixed) (Total:681 GB) (Free:563.34 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
25.10.2015, 06:09
| #5 |
| /// the machine /// TB-Ausbilder | habe mir adware eingfangen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.10.2015, 09:09
| #6 |
| | habe mir adware eingfangen Malwarebytes Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 25.10.2015 Suchlaufzeit: 08:24 Protokolldatei: Logfile.txt Administrator: Ja Version: 2.2.0.1024 Malware-Datenbank: v2015.10.25.01 Rootkit-Datenbank: v2015.10.23.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: MERCURY Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 477666 Abgelaufene Zeit: 17 Min., 56 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 43 PUP.Optional.CrossRider, C:\Program Files (x86)\CinemaPlus_1.3dV24.10, In Quarantäne, [4cd9f566d3b860d66089ff57e71c7e82], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\tools, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\lib, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\module, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\pack, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\en, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\en-US, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\es, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\es-419, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-BE, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-CA, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-CH, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-LU, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\it, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\it-CH, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\pl, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\pt-BR, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\ru, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\ru-MO, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\tr, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\vi, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\zh-CN, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\zh-TW, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\defaults, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\defaults\preferences, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.GlobalUpdate, C:\Users\MERCURY\AppData\Local\Temp\comh.344638, In Quarantäne, [48ddc2996625a690e337183c9b679c64], PUP.Optional.MaxDriverUpdater, C:\Program Files (x86)\MaxDrivrUpdater_v121.4491, In Quarantäne, [24018ad12c5f0630e7923028d52d8c74], PUP.Optional.MaxDriverUpdater, C:\Users\MERCURY\AppData\Local\Temp\MAXDriverUpdater, In Quarantäne, [2401f5667b105fd7c8b3441430d2d030], PUP.Optional.MBot, C:\Program Files (x86)\mbot_de_014010123, In Quarantäne, [4ed71e3dbdce79bd443a5bfd22e055ab], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8h, In Quarantäne, [de47f16aa9e23df97424ee6cd0324db3], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8hEI, In Quarantäne, [28fd4b105932c2746a2ee07af90922de], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8hEI\Installr, In Quarantäne, [28fd4b105932c2746a2ee07af90922de], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8hEI\Installr\Cache, In Quarantäne, [28fd4b105932c2746a2ee07af90922de], PUP.Optional.Jogotempo.ShrtCln, C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jogotempo, In Quarantäne, [34f1f6651a7192a4202c1557f60c9967], Dateien: 66 PUP.Optional.CrossRider, C:\Program Files (x86)\CinemaPlus_1.3dV24.10\bgNova.html, In Quarantäne, [4cd9f566d3b860d66089ff57e71c7e82], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome.manifest, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\install.rdf, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\index.html, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\quick_start.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\icon.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\loading.gif, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\logo.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\luck.png, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\simple.css, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\chrome\skin\style.css, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\addonmanager.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\aes.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\config.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\dialogs.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\last_tab.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\misc.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\properties.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\remoterequest.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\restoreprefs.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\extensions\deskCutv2@gmail.com\modules\settings.js, In Quarantäne, [ca5b60fbd9b2b08659b8da76bf43dc24], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8hEI\Installr\Cache\0016304C.exe, In Quarantäne, [28fd4b105932c2746a2ee07af90922de], PUP.Optional.MindSpark, C:\Users\MERCURY\AppData\LocalLow\Allin1Convert_8hEI\Installr\Cache\files.ini, In Quarantäne, [28fd4b105932c2746a2ee07af90922de], PUP.Optional.QuickStart, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Ersetzt,[21041744dfac32043a9c490e13f17c84] PUP.Optional.DeskCut, C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\prefs.js, Gut: (), Schlecht: (deskCutv2@gmail.com), Ersetzt,[4ed71546b8d3f046e5b3cc92d72dc33d] Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Adware Code:
ATTFilter # AdwCleaner v5.014 - Bericht erstellt am 25/10/2015 um 08:54:03
# Aktualisiert am 18/10/2015 von Xplode
# Datenbank : 2015-10-18.5 [Server]
# Betriebssystem : Windows 10 Home (x64)
# Benutzername : MERCURY - BILLY
# Gestartet von : C:\Users\MERCURY\Downloads\AdwCleaner_5.014.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
[-] Ordner Gelöscht : C:\Program Files (x86)\RayDld
[-] Ordner Gelöscht : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\ScreenSnapshotTool
***** [ Dateien ] *****
[-] Datei Gelöscht : C:\END
***** [ DLLs ] *****
***** [ Verknüpfungen ] *****
***** [ Geplante Tasks ] *****
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{363F46BE-27B4-4C8D-99E7-B1E049B84376}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A753A1EC-973E-4718-AF8E-A3F554D45C44}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}
[-] Schlüssel Gelöscht : HKCU\Software\OCS
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\OCS
***** [ Internetbrowser ] *****
[-] [C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\prefs.js] [Preference] Gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[-] [C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[-] [C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Chrome Richtlinien gelöscht
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1969 Bytes] ##########
junkware Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 10 Home x64
Ran by MERCURY on 25.10.2015 at 8:58:20,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\Users\MERCURY\Appdata\Local\crashrpt
Successfully deleted: [Folder] C:\users\Public\Documents\guid
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.10.2015 at 9:02:17,90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-10-2015
durchgeführt von MERCURY (Administrator) auf BILLY (25-10-2015 09:07:58)
Gestartet von C:\Users\MERCURY\Downloads
Geladene Profile: MERCURY (Verfügbare Profile: MERCURY & Gast)
Platform: Windows 10 Home (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-15] (Apple Inc.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [5836888 2015-10-01] (Emsisoft Ltd)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-16] (Apple Inc.)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Spotify Web Helper] => C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2025016 2015-09-19] (Spotify Ltd)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe [2412440 2015-09-18] ()
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Dropbox Update] => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-21] (Dropbox, Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2014-12-01] (Apple Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-10-25]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-25]
ShortcutTarget: Dropbox.lnk -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{a0a490e2-89f6-4e4a-a04c-a750cf07901a}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-27] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Extension: ColorfulTabs - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-10-17]
FF Extension: FireFTP - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-05-30]
FF Extension: anonymoX - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\client@anonymox.net.xpi [2015-09-30]
FF Extension: Ghostery - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\firefox@ghostery.com.xpi [2015-09-19]
FF Extension: yaBeat - YouTube to MP3 - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid0-uqZgom7deYId1IGHnMog6eoQ2cI@jetpack.xpi [2015-05-30]
FF Extension: Google Selection Translate - For AltKey - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid1-f7dnBeTj8ElpOQ@jetpack.xpi [2015-09-13]
FF Extension: Zoom Page - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\zoompage@DW-dev.xpi [2015-10-17]
FF Extension: ImTranslator - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2015-10-17]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [7084784 2015-10-01] (Emsisoft Ltd)
S2 AAV UpdateService; C:\Programme (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation)
S2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-17] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448464 2015-03-30] (TeamViewer GmbH)
S2 Virtual CDAudio Service; C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe [179608 2015-09-18] (RapidSolution Software AG)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 epp64; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\epp64.sys [138504 2015-10-01] (Emsisoft GmbH)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-25] (Malwarebytes)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-08-28] (Intel Corporation)
R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [25256 2015-04-21] (Audials AG)
R3 rsvcdwdr; C:\Windows\System32\drivers\rsvcdwdr.sys [45192 2015-04-21] (RapidSolution Software AG)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek )
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-25] (Acronis International GmbH)
S0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-25] (Acronis International GmbH)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-25 09:06 - 2015-10-25 09:06 - 02196992 _____ (Farbar) C:\Users\MERCURY\Downloads\FRST64.exe
2015-10-25 09:02 - 2015-10-25 09:02 - 00000737 _____ C:\Users\MERCURY\Desktop\JRT.txt
2015-10-25 08:58 - 2015-10-05 23:23 - 01801288 _____ (Malwarebytes) C:\Users\MERCURY\Desktop\JRT.exe
2015-10-25 08:55 - 2015-10-25 08:55 - 00016148 _____ C:\WINDOWS\system32\BILLY_MERCURY_HistoryPrediction.bin
2015-10-25 08:53 - 2015-10-25 08:54 - 00000000 ____D C:\AdwCleaner
2015-10-25 08:47 - 2015-10-25 08:47 - 00000000 ___HD C:\OneDriveTemp
2015-10-25 08:33 - 2015-10-25 08:57 - 01798976 _____ (Malwarebytes) C:\Users\MERCURY\Downloads\JRT.exe
2015-10-25 08:32 - 2015-10-25 08:52 - 01691648 _____ C:\Users\MERCURY\Downloads\AdwCleaner_5.014.exe
2015-10-25 08:23 - 2015-10-25 08:56 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-10-25 08:22 - 2015-10-25 08:43 - 00001171 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-10-25 08:22 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-10-25 08:22 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-10-25 08:22 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2015-10-25 08:19 - 2015-10-25 08:22 - 22908888 _____ (Malwarebytes ) C:\Users\MERCURY\Downloads\mbam-setup-2.2.0.1024.exe
2015-10-24 17:40 - 2015-10-24 17:40 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-10-24 16:34 - 2015-10-24 16:44 - 00041917 _____ C:\Users\MERCURY\Downloads\Addition.txt
2015-10-24 16:33 - 2015-10-25 09:07 - 00015423 _____ C:\Users\MERCURY\Downloads\FRST.txt
2015-10-24 16:19 - 2015-10-24 16:19 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Opera Software
2015-10-24 16:19 - 2015-10-24 16:19 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Opera Software
2015-10-24 16:15 - 2015-10-24 16:22 - 00000000 ____D C:\Program Files (x86)\Opera
2015-10-24 16:14 - 2015-10-24 16:14 - 00000000 ____D C:\Users\Public\Documents\Baidu
2015-10-17 14:13 - 2015-10-17 14:13 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\PhotoSync
2015-10-17 14:11 - 2015-10-25 08:43 - 00002597 _____ C:\Users\Public\Desktop\PhotoSync.lnk
2015-10-17 14:11 - 2015-10-17 14:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoSync
2015-10-17 13:59 - 2015-10-24 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-10-17 10:11 - 2015-10-17 10:36 - 71807792 _____ (Apple Inc.) C:\Users\MERCURY\Downloads\iCloudSetup(2).exe
2015-10-17 09:59 - 2015-10-17 14:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-14 12:54 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-14 12:54 - 2015-10-10 07:40 - 21875712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-10-14 12:54 - 2015-10-10 07:07 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-10-14 12:54 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-10-14 12:54 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-10-14 12:54 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-14 12:54 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-14 12:54 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-14 12:54 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-14 12:54 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-14 12:54 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-14 12:54 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-10-14 12:54 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-10-14 12:54 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-14 12:54 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-10-14 12:54 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-10-14 12:54 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-14 12:54 - 2015-09-25 04:17 - 24595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-14 12:54 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-10-14 12:54 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-10-14 12:54 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-14 12:54 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-10-14 12:54 - 2015-09-25 04:04 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-10-14 12:54 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-14 12:54 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-10-14 12:54 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-10-14 12:54 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-14 12:54 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-10-14 12:54 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-10-14 12:54 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2015-10-14 12:54 - 2015-09-25 04:02 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-10-14 12:54 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-14 12:54 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-10-14 12:54 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-10-14 12:54 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-10-14 12:54 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-10-14 12:54 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-10-14 12:54 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-10-14 12:54 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-10-14 12:54 - 2015-09-25 03:48 - 19325952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-14 12:54 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-10-14 12:54 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-10-14 12:54 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-14 12:54 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-14 12:54 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-10-14 12:54 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-14 12:54 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-10-14 12:54 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-10-14 12:54 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-10-14 12:54 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-14 12:54 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-10-14 12:54 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-10-14 12:54 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-10-14 12:54 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-10-14 12:54 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-10-14 12:54 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-10-14 12:54 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-10-14 12:54 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-10-14 12:54 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-10-04 10:55 - 2015-10-04 11:05 - 58777218 _____ C:\Users\MERCURY\Downloads\Ecos Audio - Supersticiones_2.wma
2015-10-04 10:54 - 2015-10-04 11:07 - 73507735 _____ C:\Users\MERCURY\Downloads\Letzter Gruss aus Granada_2.wma
2015-10-01 11:25 - 2015-09-19 06:14 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2015-10-01 11:25 - 2015-09-17 07:50 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-10-01 11:25 - 2015-09-17 07:50 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-10-01 11:25 - 2015-09-17 07:50 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2015-10-01 11:25 - 2015-09-17 07:50 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-10-01 11:25 - 2015-09-17 07:49 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-10-01 11:25 - 2015-09-17 07:49 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-10-01 11:25 - 2015-09-17 07:49 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys
2015-10-01 11:25 - 2015-09-17 07:49 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2015-10-01 11:25 - 2015-09-17 07:49 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-10-01 11:25 - 2015-09-17 07:48 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-10-01 11:25 - 2015-09-17 07:48 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-10-01 11:25 - 2015-09-17 07:48 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-10-01 11:25 - 2015-09-17 07:47 - 01397088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-10-01 11:25 - 2015-09-17 07:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-10-01 11:25 - 2015-09-17 07:43 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-10-01 11:25 - 2015-09-17 07:37 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2015-10-01 11:25 - 2015-09-17 07:37 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-10-01 11:25 - 2015-09-17 07:28 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-10-01 11:25 - 2015-09-17 07:28 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-10-01 11:25 - 2015-09-17 07:28 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-10-01 11:25 - 2015-09-17 07:28 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2015-10-01 11:25 - 2015-09-17 07:28 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-10-01 11:25 - 2015-09-17 07:28 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-10-01 11:25 - 2015-09-17 07:27 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-10-01 11:25 - 2015-09-17 07:27 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-10-01 11:25 - 2015-09-17 07:26 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-10-01 11:25 - 2015-09-17 07:25 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-10-01 11:25 - 2015-09-17 07:21 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-10-01 11:25 - 2015-09-17 07:20 - 00764416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-10-01 11:25 - 2015-09-17 07:11 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-10-01 11:25 - 2015-09-17 07:10 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2015-10-01 11:25 - 2015-09-17 07:09 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-10-01 11:25 - 2015-09-17 07:09 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-10-01 11:25 - 2015-09-17 07:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-10-01 11:25 - 2015-09-17 07:08 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll
2015-10-01 11:25 - 2015-09-17 07:08 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2015-10-01 11:25 - 2015-09-17 07:06 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-10-01 11:25 - 2015-09-17 07:06 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-10-01 11:25 - 2015-09-17 07:06 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-10-01 11:25 - 2015-09-17 07:05 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-10-01 11:25 - 2015-09-17 07:05 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2015-10-01 11:25 - 2015-09-17 07:04 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-10-01 11:25 - 2015-09-17 07:04 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-10-01 11:25 - 2015-09-17 07:04 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2015-10-01 11:25 - 2015-09-17 07:03 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2015-10-01 11:25 - 2015-09-17 07:03 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-10-01 11:25 - 2015-09-17 07:03 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-10-01 11:25 - 2015-09-17 07:03 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll
2015-10-01 11:25 - 2015-09-17 07:03 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2015-10-01 11:25 - 2015-09-17 07:02 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-10-01 11:25 - 2015-09-17 07:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2015-10-01 11:25 - 2015-09-17 07:00 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-10-01 11:25 - 2015-09-17 07:00 - 02417664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-10-01 11:25 - 2015-09-17 07:00 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-10-01 11:25 - 2015-09-17 07:00 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KeywordDetectorMsftSidAdapter.dll
2015-10-01 11:25 - 2015-09-17 06:58 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-10-01 11:25 - 2015-09-17 06:57 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2015-10-01 11:25 - 2015-09-17 06:57 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-10-01 11:25 - 2015-09-17 06:57 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-10-01 11:25 - 2015-09-17 06:57 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-10-01 11:25 - 2015-09-17 06:56 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-10-01 11:25 - 2015-09-17 06:56 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-10-01 11:25 - 2015-09-17 06:56 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2015-10-01 11:25 - 2015-09-17 06:55 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-10-01 11:25 - 2015-09-17 06:55 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-10-01 11:25 - 2015-09-17 06:54 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-10-01 11:25 - 2015-09-17 06:54 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-10-01 11:25 - 2015-09-17 06:54 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 11:25 - 2015-09-17 06:53 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-10-01 11:25 - 2015-09-17 06:52 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-10-01 11:25 - 2015-09-17 06:51 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2015-10-01 11:25 - 2015-09-17 06:50 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-10-01 11:25 - 2015-09-17 06:50 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2015-10-01 11:25 - 2015-09-17 06:50 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-10-01 11:25 - 2015-09-17 06:50 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll
2015-10-01 11:25 - 2015-09-17 06:50 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll
2015-10-01 11:25 - 2015-09-17 06:50 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys
2015-10-01 11:25 - 2015-09-17 06:49 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll
2015-10-01 11:25 - 2015-09-17 06:49 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2015-10-01 11:25 - 2015-09-17 06:47 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2015-10-01 11:25 - 2015-09-17 06:47 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2015-10-01 11:25 - 2015-09-17 06:47 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2015-10-01 11:25 - 2015-09-17 06:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2015-10-01 11:25 - 2015-09-17 06:46 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll
2015-10-01 11:25 - 2015-09-17 06:45 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-10-01 11:25 - 2015-09-17 06:45 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-10-01 11:25 - 2015-09-17 06:45 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-10-01 11:25 - 2015-09-17 06:45 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-10-01 11:25 - 2015-09-17 06:45 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2015-10-01 11:25 - 2015-09-17 06:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2015-10-01 11:25 - 2015-09-17 06:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-10-01 11:25 - 2015-09-17 06:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2015-10-01 11:25 - 2015-09-17 06:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-10-01 11:25 - 2015-09-17 06:42 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-10-01 11:25 - 2015-09-17 06:41 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-10-01 11:25 - 2015-09-17 06:40 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-10-01 11:25 - 2015-09-17 06:40 - 01918464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-10-01 11:25 - 2015-09-17 06:40 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-10-01 11:25 - 2015-09-17 06:39 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-10-01 11:25 - 2015-09-17 06:39 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-10-01 11:25 - 2015-09-17 06:38 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2015-10-01 11:25 - 2015-09-17 06:37 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-10-01 11:25 - 2015-09-17 06:36 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll
2015-10-01 11:25 - 2015-09-17 06:35 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-10-01 11:25 - 2015-09-17 06:35 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-10-01 11:25 - 2015-09-17 06:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-10-01 11:25 - 2015-09-17 06:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2015-10-01 11:25 - 2015-09-17 06:34 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-10-01 11:25 - 2015-09-17 06:32 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-10-01 11:25 - 2015-09-17 06:32 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-10-01 11:25 - 2015-09-17 06:32 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2015-10-01 11:25 - 2015-09-17 06:31 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2015-10-01 11:25 - 2015-09-17 06:30 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2015-10-01 11:25 - 2015-09-17 06:29 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-10-01 11:25 - 2015-09-17 06:29 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-10-01 11:25 - 2015-09-17 06:29 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-10-01 11:25 - 2015-09-17 06:29 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-10-01 11:25 - 2015-09-17 06:28 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-10-01 11:25 - 2015-09-17 06:26 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-10-01 11:25 - 2015-09-17 06:16 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-10-01 11:25 - 2015-09-13 03:05 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-10-01 11:25 - 2015-09-13 02:41 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-09-30 14:29 - 2015-10-25 08:43 - 00000966 _____ C:\Users\Public\Desktop\Audials 12.lnk
2015-09-30 14:14 - 2015-10-25 08:17 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DD6E9A90-2E3B-4A9E-82CF-290362D3D5B2}
2015-09-30 13:52 - 2015-09-30 14:05 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\iFunbox_UserCache
2015-09-30 12:48 - 2015-09-30 13:57 - 00000000 ____D C:\Users\MERCURY\Downloads\Spanisch lernen PONS Sprachkurs fur Anf303244nger [PONS GmbH] (v2 60 2 3GS Univ i8 os61)-teflon rc325
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-25 09:08 - 2015-06-21 14:57 - 00001244 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job
2015-10-25 09:07 - 2015-01-25 18:47 - 00000000 ____D C:\FRST
2015-10-25 09:03 - 2015-04-28 18:51 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-10-25 08:59 - 2015-01-16 14:06 - 00000000 ___DO C:\Users\MERCURY\SkyDrive
2015-10-25 08:56 - 2015-05-25 13:44 - 00000000 ___RD C:\Users\MERCURY\iCloudDrive
2015-10-25 08:56 - 2015-01-25 15:22 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Dropbox
2015-10-25 08:56 - 2015-01-25 14:43 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-10-25 08:56 - 2014-05-07 16:22 - 00000000 ___RD C:\Users\MERCURY\Dropbox
2015-10-25 08:55 - 2015-07-29 14:13 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-10-25 08:55 - 2015-07-10 13:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-25 08:55 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-10-25 08:54 - 2015-07-29 14:09 - 00056310 _____ C:\WINDOWS\PFRO.log
2015-10-25 08:54 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-10-25 08:54 - 2015-07-10 10:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-10-25 08:50 - 2015-07-29 14:30 - 01790124 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-10-25 08:50 - 2015-07-10 17:34 - 00771100 _____ C:\WINDOWS\system32\perfh007.dat
2015-10-25 08:50 - 2015-07-10 17:34 - 00153964 _____ C:\WINDOWS\system32\perfc007.dat
2015-10-25 08:43 - 2015-09-19 12:33 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-10-25 08:43 - 2015-09-06 10:54 - 00002318 _____ C:\Users\MERCURY\Desktop\Kindle.lnk
2015-10-25 08:43 - 2015-09-06 10:46 - 00001200 _____ C:\Users\Public\Desktop\Epubor Ultimate.lnk
2015-10-25 08:43 - 2015-07-29 15:31 - 00001047 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optionale Features.lnk
2015-10-25 08:43 - 2015-07-29 15:21 - 00002360 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-10-25 08:43 - 2015-07-29 14:21 - 00001552 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-10-25 08:43 - 2015-07-22 12:12 - 00001492 _____ C:\Users\Public\Desktop\ElsterFormular.lnk
2015-10-25 08:43 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-25 08:43 - 2015-07-01 15:05 - 00001857 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-10-25 08:43 - 2015-06-28 17:09 - 00002119 _____ C:\Users\MERCURY\Desktop\JDownloader 2.lnk
2015-10-25 08:43 - 2015-06-08 12:52 - 00001484 _____ C:\Users\Public\Desktop\LibreOffice 4.3.lnk
2015-10-25 08:43 - 2015-05-20 16:09 - 00001167 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-10-25 08:43 - 2015-05-20 16:09 - 00001117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-10-25 08:43 - 2015-05-20 11:25 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-25 08:43 - 2015-05-20 11:25 - 00002067 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-10-25 08:43 - 2015-05-10 11:08 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2015-10-25 08:43 - 2015-04-12 11:06 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-10-25 08:43 - 2015-04-12 11:06 - 00001043 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-10-25 08:43 - 2015-04-04 11:24 - 00001714 _____ C:\Users\Public\Desktop\Recuva.lnk
2015-10-25 08:43 - 2015-03-28 16:58 - 00000966 _____ C:\Users\MERCURY\Desktop\VirtualDJ 8.lnk
2015-10-25 08:43 - 2015-03-27 14:23 - 00001103 _____ C:\Users\Public\Desktop\RarZilla Free Unrar.lnk
2015-10-25 08:43 - 2015-03-07 13:47 - 00001849 _____ C:\Users\Public\Desktop\BILD Steuer 2015.lnk
2015-10-25 08:43 - 2015-02-25 11:37 - 00001524 _____ C:\Users\MERCURY\Desktop\RippMe - Verknüpfung.lnk
2015-10-25 08:43 - 2015-02-15 11:39 - 00001437 _____ C:\Users\MERCURY\Desktop\CopyTrans Control Center.lnk
2015-10-25 08:43 - 2015-02-04 13:57 - 00002073 _____ C:\Users\MERCURY\Desktop\waterMark V2.lnk
2015-10-25 08:43 - 2015-02-02 12:40 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-10-25 08:43 - 2015-01-31 10:41 - 00001144 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-10-25 08:43 - 2015-01-31 10:00 - 00001336 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2015-10-25 08:43 - 2015-01-27 19:37 - 00001122 _____ C:\Users\Public\Desktop\Picasa 3.lnk
2015-10-25 08:43 - 2015-01-25 16:50 - 00000999 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-10-25 08:43 - 2015-01-25 16:14 - 00001217 _____ C:\Users\Public\Desktop\Acronis True Image 2014.lnk
2015-10-25 08:43 - 2015-01-25 15:41 - 00000991 _____ C:\Users\Public\Desktop\Mp3tag.lnk
2015-10-25 08:43 - 2015-01-25 15:30 - 00001023 _____ C:\Users\MERCURY\Desktop\Dropbox.lnk
2015-10-25 08:43 - 2015-01-25 15:29 - 00001014 _____ C:\Users\MERCURY\Desktop\IrfanView.lnk
2015-10-25 08:43 - 2015-01-25 15:07 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2015-10-25 08:43 - 2015-01-25 14:56 - 00001823 _____ C:\Users\MERCURY\Desktop\Spotify.lnk
2015-10-25 08:43 - 2015-01-25 14:56 - 00001809 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-10-25 08:43 - 2015-01-25 14:49 - 00001171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-10-25 08:43 - 2015-01-25 14:49 - 00001159 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-10-25 08:43 - 2015-01-25 14:43 - 00001103 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-10-25 08:43 - 2014-05-10 12:27 - 00000640 _____ C:\Users\MERCURY\Desktop\Total Commander.lnk
2015-10-24 19:09 - 2015-01-25 14:56 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Spotify
2015-10-24 18:53 - 2015-01-25 14:53 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Spotify
2015-10-24 17:32 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-10-24 17:11 - 2015-07-29 14:16 - 00000000 ____D C:\Users\MERCURY
2015-10-24 17:08 - 2015-09-19 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-10-24 17:08 - 2015-09-19 12:33 - 00000000 ____D C:\Program Files\iTunes
2015-10-24 17:08 - 2015-07-29 14:16 - 00000000 ___RD C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-10-24 17:08 - 2015-07-29 14:16 - 00000000 ____D C:\Users\Gast
2015-10-24 17:08 - 2015-07-10 10:05 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-10-24 17:08 - 2015-02-24 13:50 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-10-24 17:08 - 2015-01-25 14:17 - 00000000 ___HD C:\$SysReset
2015-10-24 17:01 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\registration
2015-10-24 17:00 - 2015-06-28 17:07 - 00000000 ____D C:\Users\MERCURY\AppData\Local\JDownloader 2.0
2015-10-24 17:00 - 2015-05-25 13:44 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Apple Inc
2015-10-24 16:59 - 2015-09-19 12:33 - 00000000 ____D C:\Program Files\iPod
2015-10-24 16:59 - 2015-02-02 12:40 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-10-24 14:21 - 2015-07-10 13:20 - 00054163 _____ C:\WINDOWS\setupact.log
2015-10-22 19:35 - 2015-09-06 10:46 - 00000000 ____D C:\Users\MERCURY\Ultimate
2015-10-22 19:35 - 2015-09-06 10:46 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\.Ultimate
2015-10-22 19:25 - 2014-11-12 12:05 - 00000000 ____D C:\Users\MERCURY\Documents\My Digital Editions
2015-10-18 13:08 - 2015-06-21 14:57 - 00001192 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job
2015-10-18 10:42 - 2015-01-25 16:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-10-18 10:42 - 2015-01-25 16:50 - 00000000 ____D C:\Program Files\Calibre2
2015-10-17 14:11 - 2015-01-25 15:45 - 00000000 ____D C:\Program Files (x86)\PhotoSync
2015-10-17 14:04 - 2015-02-02 12:41 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Apple Computer
2015-10-17 14:00 - 2015-01-25 14:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-17 13:03 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-16 10:08 - 2015-05-20 11:25 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-10-16 10:08 - 2015-01-25 19:09 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-16 10:06 - 2015-01-25 19:09 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-09 12:49 - 2014-05-07 15:28 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Packages
2015-10-04 14:04 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache
2015-10-01 15:39 - 2015-09-06 10:54 - 00000000 ____D C:\Users\MERCURY\Documents\My Kindle Content
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas
2015-09-30 14:29 - 2015-05-30 14:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 12
2015-09-30 14:14 - 2015-02-02 12:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieUserList
2015-09-30 14:14 - 2015-02-02 12:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieSiteList
2015-09-30 13:22 - 2015-02-15 11:39 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center
2015-09-30 11:23 - 2015-01-27 19:36 - 00000000 ____D C:\Program Files\Microsoft Office 15
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-07-29 14:14 - 2015-07-29 14:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\MERCURY\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpssnjih.dll
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole5674692022462984289.dll
C:\Users\MERCURY\AppData\Local\Temp\proxy_vole8817783468969832925.dll
C:\Users\MERCURY\AppData\Local\Temp\sqlite3.dll
C:\Users\MERCURY\AppData\Local\Temp\SynciosDeviceService.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-10-20 11:34
==================== Ende von FRST.txt ============================
Geändert von Pille77 (25.10.2015 um 09:05 Uhr) |
|
25.10.2015, 09:10
| #7 |
| | habe mir adware eingfangenCode:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:24-10-2015
durchgeführt von MERCURY (2015-10-24 17:44:33)
Gestartet von C:\Users\MERCURY\Downloads
Windows 10 Home (X64) (2015-07-29 14:16:24)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-4024391792-2930209080-385294340-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4024391792-2930209080-385294340-503 - Limited - Disabled)
Gast (S-1-5-21-4024391792-2930209080-385294340-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4024391792-2930209080-385294340-1003 - Limited - Enabled)
MERCURY (S-1-5-21-4024391792-2930209080-385294340-1001 - Administrator - Enabled) => C:\Users\MERCURY
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.38 beta (HKLM-x32\...\7-Zip) (Version: - )
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20071 - Adobe Systems Incorporated)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Amazon Kindle) (Version: - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Audials (HKLM-x32\...\{BC9B1130-6992-4C49-A166-A2220E220815}) (Version: 12.1.10000.0 - Audials AG)
BILD Steuer 2015 (HKLM-x32\...\{90B7E6F3-25B5-4B5E-B9F5-ACA6287489E4}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DBF2A8AA-9EE9-454D-8958-F74F1FCB0789}) (Version: 2.41.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5571 - CDBurnerXP)
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\CopyTrans Suite) (Version: 4.004 - WindSolutions)
Dropbox (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Dropbox) (Version: 3.10.8 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.2.24.20150630 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
Epubor Ultimate (HKLM-x32\...\Epubor Ultimate) (Version: 3.0.4.19 - Epubor Inc.)
Freemake Video Converter Version 4.1.5 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
LibreOffice 4.3.7.2 (HKLM-x32\...\{8ED4A1FC-56CF-414C-A9AB-A37714AA9EA7}) (Version: 4.3.7.2 - The Document Foundation)
Microsoft OneNote 2013 - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 15.0.4753.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 41.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 de)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
PhotoSync (HKLM\...\{4449711E-4AC0-4231-A544-826CD6348502}) (Version: 3.0.6 - touchbyte GmbH)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
RarZilla Free Unrar (HKLM-x32\...\RarZilla Free Unrar) (Version: 6.50 - Philipp Winterberg)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RippMe (HKLM-x32\...\{F0D21B7C-CB99-4C14-9408-C45CF45EBC24}) (Version: 3.05.000 - Lindy)
Spotify (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Spotify) (Version: 1.0.14.124.g4dfabc51 - Spotify AB)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.40798 - TeamViewer)
VirtualDJ 8 (HKLM-x32\...\{F33070AA-1979-4192-9B75-C018C2F423FF}) (Version: 8.0.2162.0 - Atomix Productions)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
waterMark V2 (HKLM-x32\...\waterMark V2) (Version: - )
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
04-10-2015 13:25:15 Installed calibre 64bit
11-10-2015 13:34:39 Windows Update
16-10-2015 11:05:51 Windows Update
17-10-2015 11:45:34 PhotoSync wird installiert
20-10-2015 12:40:36 Windows Update
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {2A4C0426-4BEB-4818-BA9B-F0E1268D1DF8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {3352DA8A-D3C3-4688-BBD8-70DD563D7EFA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {37C8B6DE-3457-4CF6-AC49-BDD966E8C815} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {43DEA015-7B4C-4A61-A57D-59D7B4AEE93A} - System32\Tasks\{EDEC19A0-1DB9-46CD-8B69-AB2543EA22CD} => pcalua.exe -a "C:\Program Files (x86)\MaxDrivrUpdater\uninstall.exe"
Task: {455E1D2D-72ED-4E54-94A9-F9A53C750D61} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {460247E2-A94A-4DD8-8387-A00DD7BE5888} - System32\Tasks\amiupdaterExd => C:\Users\MERCURY\AppData\Local\Temp\task.vbs <==== ACHTUNG
Task: {625DA84E-98D9-4A70-81A2-87E41D262B0A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {6B4CAB6E-F2DE-4404-BB12-39B5844F7F22} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {734CC9CE-2F53-43D7-90A3-A332518CA45D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {7B3C768B-5BDB-4163-BE7B-19A6BAC275C8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {82B02B90-088F-424B-915A-353E75D02880} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-17] (Adobe Systems Incorporated)
Task: {88980258-7C2F-4057-8E33-0624C438A5F6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)
Task: {8BAAF8E1-DEF7-4D84-BC82-BD8332140B0B} - System32\Tasks\amiupdaterExi => C:\Users\MERCURY\AppData\Local\Temp\amiupdater1721.exe <==== ACHTUNG
Task: {8F24E449-EAB9-4729-AEA9-293295BF6713} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {907115CA-88D1-4780-834E-124F2ADBEC1C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {AA087389-78C7-4521-83BA-166BEFFF4C56} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {AB99A591-F04B-4883-93B7-91E3BDF9C32C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {B29FBF40-58FD-4389-906A-E46F7615975F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {B66C7CB6-9CA4-44E8-876A-C6B7B69CF117} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {CF524D95-765C-4B77-BF69-67E6DF43CF83} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-16] (Microsoft Corporation)
Task: {CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-07-29 16:04 - 2015-07-29 16:04 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2008-10-24 17:35 - 2008-10-24 17:35 - 00128296 _____ () C:\Programme (x86)\AAVUpdateManager\aavus.exe
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-27 20:36 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-07-18 00:35 - 2015-07-18 00:35 - 00396688 _____ () C:\WINDOWS\system32\igfxTray.exe
2015-09-18 12:06 - 2015-09-18 12:06 - 02412440 _____ () C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe
2015-10-13 05:45 - 2015-10-13 05:45 - 00306960 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2015-10-04 11:50 - 2015-10-04 11:51 - 00012288 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-10-04 11:50 - 2015-10-04 11:51 - 10814464 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-10-12 04:01 - 2015-10-12 04:01 - 00270568 _____ () C:\Program Files (x86)\RayDld\ihpmServer.exe
2015-10-01 12:25 - 2015-09-17 08:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2013-10-01 11:32 - 2013-10-01 11:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2015-10-01 12:25 - 2015-09-17 07:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-07-10 12:59 - 2015-07-10 12:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll
2015-10-01 12:25 - 2015-09-17 07:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-10-01 12:25 - 2015-09-17 07:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-01 12:25 - 2015-09-17 07:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 13:00 - 2015-07-10 18:45 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 00237328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2015-10-13 05:46 - 2015-10-13 05:46 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00049424 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_thread-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00048400 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_date_time-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00068504 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashRpt.dll
2015-09-18 12:07 - 2015-09-18 12:07 - 00580504 _____ () C:\Program Files (x86)\Audials\Audials 12\SQLite3.dll
2015-09-18 12:07 - 2015-09-18 12:07 - 00545176 _____ () C:\Program Files (x86)\Audials\Audials 12\StreamingClient.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00618256 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_regex-vc90-mt-1_39.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00016144 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_system-vc90-mt-1_39.dll
2015-10-01 16:53 - 2015-10-01 16:53 - 00314880 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Utils\46d971b07904b91768d7b03518e89d26\Utils.ni.dll
2015-10-01 16:53 - 2015-10-01 16:53 - 00650752 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ManagedInterfaces\e5a94b46c30e6c66e8faeb75087915b9\ManagedInterfaces.ni.dll
2015-10-18 10:28 - 2015-10-18 10:28 - 03788800 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\AudialsComponents\7955b8ff218ca6d7b35fe4d221f3ff95\AudialsComponents.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00699904 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\RSControls\1d04c75938d88c62845b10406fa5f736\RSControls.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00176640 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\fastJSON\335bdd33a8aed053809c75e66b8f1b53\fastJSON.ni.dll
2015-10-01 16:54 - 2015-10-01 16:54 - 00062464 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CrashHandlerNET\fa593e4278c15e5e6e69466ee9d8be23\CrashHandlerNET.ni.dll
2015-09-18 12:06 - 2015-09-18 12:06 - 00040856 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashHandlerNET.dll
2015-10-04 11:50 - 2015-10-13 01:33 - 00166416 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\EnterpriseDataAdapter.dll
2015-10-24 15:26 - 2015-10-24 15:26 - 00071168 _____ () c:\users\mercury\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplfix3f.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012800 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00779776 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-08-01 09:07 - 2015-09-24 01:07 - 00056320 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012288 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-02-04 19:25 - 2014-02-04 19:25 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-02-04 19:25 - 2014-02-04 19:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2015-01-27 20:56 - 2015-01-27 21:04 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-02-04 19:28 - 2014-02-04 19:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MERCURY\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{9a10159e-17a2-4a41-a001-37ac9fa5be30}.bmp
HKU\S-1-5-21-4024391792-2930209080-385294340-501\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Syncios device service"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{8061451B-F643-4B99-A490-DDC6E065689E}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [TCP Query User{A982388B-504B-420B-95FE-A50CA469588F}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [UDP Query User{13A919C3-410A-4DB0-91A5-FB8044BCFAD1}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{69B9C0A6-D2D2-47F8-9126-0842B8BAD47D}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{871586EC-0FD5-49EA-B54C-386A7495DC03}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4237546A-DDAB-45A7-86AA-21FAAB7E21FD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{2E607E93-1F83-4A93-84CC-0B35BF015604}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{706640FE-D64E-4572-A693-45A89AA5C856}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [UDP Query User{CF377A06-5F49-4BC0-B200-2DBB72885DC3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AA25D4F2-C0C3-4BF7-9685-001D5091687F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{79111066-FF93-4ED4-8C89-F713055C22AD}] => (Allow) C:\Users\MERCURY\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [UDP Query User{F3AE5496-C093-4361-818F-8839A9600F22}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [TCP Query User{C29A58EF-21F1-4CE8-AFCB-91B7B5E84F7E}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [UDP Query User{B95791A6-D810-47A2-B1AC-1F840A1EBE20}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{C914D378-A40F-4977-A557-C63AA402F5C6}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{B1DCE6FB-DA7D-4E5B-8772-94F416473FFD}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{5D42F60A-B46F-4B18-A662-77509C9817F0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{A2B74FFE-27C4-436C-86DB-25BCF63CE58B}] => (Allow) LPort=35722
FirewallRules: [{1B54A621-CE15-4F0E-9100-91E9190BB771}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F96EBB40-43BE-4CD3-8F2D-7F3226CD965C}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [UDP Query User{15D3438C-C7C6-4D4F-A52C-13FC938DB6E5}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{191DBCDB-902D-48B2-8B36-DD87873CE1F1}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{6C548063-1ECA-47EE-9B55-7E1D9AF76744}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{553D57C7-DC11-485B-B920-0A7122D25EF4}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{55D2950E-F23C-4056-BCA6-53EB9ED412D7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FD994CEE-718E-4043-BE8C-0A997ACADA04}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{225CE99E-B7A4-4680-B739-B9FD13FECF0C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DDDA9F47-D578-481B-A9B6-D455904E9D10}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{074405C9-A00C-4542-B1CB-8708AAA7872D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D255724A-A5F3-4128-AC66-250A07777C4A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{16F755AA-9B26-472F-BA9E-DBFD6ECB48AA}] => (Allow) C:\Program Files (x86)\Audials\Audials 12\Audials.exe
FirewallRules: [{65A6661E-D577-4AAB-9CC4-45C8AF9738D7}] => (Allow) LPort=12972
FirewallRules: [{8C86B038-EA54-4D8D-92DF-4B0D887FB315}] => (Allow) LPort=14714
FirewallRules: [{5672B5DA-80AC-4E88-9CA7-EBE027AC3C41}] => (Allow) LPort=31931
FirewallRules: [{E7A93153-50E8-4503-95D3-D0F4AFA2EE97}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1B2AF7F0-278A-4597-B2FA-92DB45B8E248}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/24/2015 05:14:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 148c
Startzeit: 01d10e6df438c665
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: f7517f68-7a61-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 05:09:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1810
Startzeit: 01d10e6d542cafee
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 31849478-7a61-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 05:04:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 27d8
Startzeit: 01d10e6c519626a4
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 91718420-7a60-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 04:57:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10240.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 13a0
Startzeit: 01d10e5f809935ec
Beendigungszeit: 0
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 8e8df5dc-7a5f-11e5-8273-d43d7effa47b
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (10/24/2015 04:51:35 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:35 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/24/2015 04:51:24 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:24 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/24/2015 04:51:14 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5732) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/24/2015 04:51:14 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5732) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Systemfehler:
=============
Error: (10/24/2015 05:14:00 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ihpmServer" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (10/24/2015 03:29:06 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:29:02 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:58 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:45 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:41 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:32 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (10/24/2015 03:28:28 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
CodeIntegrity:
===================================
Date: 2015-10-24 15:42:21.309
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:21.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.744
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.617
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-04 15:04:41.650
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 15:03:48.796
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:45:25.604
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:24.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:00.513
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:43:57.829
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 42%
Installierter physikalischer RAM: 8070.03 MB
Verfügbarer physikalischer RAM: 4654.03 MB
Summe virtueller Speicher: 9350.03 MB
Verfügbarer virtueller Speicher: 5588.48 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:249.56 GB) (Free:143.49 GB) NTFS
Drive d: (Meins) (Fixed) (Total:681 GB) (Free:563.34 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
25.10.2015, 20:09
| #8 |
| /// the machine /// TB-Ausbilder | habe mir adware eingfangen Noch Kontrollscans ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.10.2015, 21:58
| #9 |
| | habe mir adware eingfangenCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=69d8e2391f91554282281617af641ede
# end=init
# utc_time=2015-10-25 07:14:40
# local_time=2015-10-25 08:14:40 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 26408
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=69d8e2391f91554282281617af641ede
# end=updated
# utc_time=2015-10-25 07:16:28
# local_time=2015-10-25 08:16:28 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=69d8e2391f91554282281617af641ede
# engine=26408
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-10-25 08:21:47
# local_time=2015-10-25 09:21:47 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 45201 9278519 0 0
# scanned=341734
# found=2
# cleaned=2
# scan_time=3919
sh=A2690E49E815CD7AD56DB4D2FB74EFBE59E49395 ft=1 fh=719d75498d7bf806 vn="Variante von Win32/ELEX.FK evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\MERCURY\AppData\Local\Temp\_@335E.tmp"
sh=A2690E49E815CD7AD56DB4D2FB74EFBE59E49395 ft=1 fh=719d75498d7bf806 vn="Variante von Win32/ELEX.FK evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\MERCURY\AppData\Local\Temp\_@9172.tmp"
Code:
ATTFilter Results of screen317's Security Check version 1.009 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Defender Emsisoft Anti-Malware Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 8 Update 45 Java version 32-bit out of Date! Adobe Flash Player 19.0.0.226 Mozilla Firefox (41.0.2) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe ESET ESET Online Scanner OnlineScannerApp.exe Emsisoft Anti-Malware a2service.exe Emsisoft Anti-Malware a2guard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-10-2015 02
durchgeführt von MERCURY (2015-10-25 22:01:35)
Gestartet von C:\Users\MERCURY\Downloads
Windows 10 Home (X64) (2015-07-29 14:16:24)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-4024391792-2930209080-385294340-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4024391792-2930209080-385294340-503 - Limited - Disabled)
Gast (S-1-5-21-4024391792-2930209080-385294340-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4024391792-2930209080-385294340-1003 - Limited - Enabled)
MERCURY (S-1-5-21-4024391792-2930209080-385294340-1001 - Administrator - Enabled) => C:\Users\MERCURY
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.38 beta (HKLM-x32\...\7-Zip) (Version: - )
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20071 - Adobe Systems Incorporated)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Amazon Kindle) (Version: - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{3540ADD5-822B-47FB-B1C2-CD7B2C8E9FEC}) (Version: 4.0.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{C9C0FE2C-602E-49D7-8C42-5B9E8FF04798}) (Version: 4.0.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Audials (HKLM-x32\...\{BC9B1130-6992-4C49-A166-A2220E220815}) (Version: 12.1.10000.0 - Audials AG)
BILD Steuer 2015 (HKLM-x32\...\{90B7E6F3-25B5-4B5E-B9F5-ACA6287489E4}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DBF2A8AA-9EE9-454D-8958-F74F1FCB0789}) (Version: 2.41.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5571 - CDBurnerXP)
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\CopyTrans Suite) (Version: 4.004 - WindSolutions)
Dropbox (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Dropbox) (Version: 3.10.8 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.2.24.20150630 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
Epubor Ultimate (HKLM-x32\...\Epubor Ultimate) (Version: 3.0.4.19 - Epubor Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Freemake Video Converter Version 4.1.5 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{88509E20-3936-4D88-A1C0-B274C7BB5151}) (Version: 12.3.0.44 - Apple Inc.)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
LibreOffice 4.3.7.2 (HKLM-x32\...\{8ED4A1FC-56CF-414C-A9AB-A37714AA9EA7}) (Version: 4.3.7.2 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft OneNote 2013 - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 15.0.4753.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 41.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 de)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
Mp3tag v2.66 (HKLM-x32\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
PhotoSync (HKLM\...\{4449711E-4AC0-4231-A544-826CD6348502}) (Version: 3.0.6 - touchbyte GmbH)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
RarZilla Free Unrar (HKLM-x32\...\RarZilla Free Unrar) (Version: 6.50 - Philipp Winterberg)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RippMe (HKLM-x32\...\{F0D21B7C-CB99-4C14-9408-C45CF45EBC24}) (Version: 3.05.000 - Lindy)
Spotify (HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Spotify) (Version: 1.0.16.104.g3b776c9e - Spotify AB)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.40798 - TeamViewer)
VirtualDJ 8 (HKLM-x32\...\{F33070AA-1979-4192-9B75-C018C2F423FF}) (Version: 8.0.2162.0 - Atomix Productions)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
waterMark V2 (HKLM-x32\...\waterMark V2) (Version: - )
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4024391792-2930209080-385294340-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
11-10-2015 12:34:39 Windows Update
16-10-2015 10:05:51 Windows Update
17-10-2015 10:45:34 PhotoSync wird installiert
20-10-2015 11:40:36 Windows Update
24-10-2015 16:56:41 Wiederherstellungsvorgang
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {2A4C0426-4BEB-4818-BA9B-F0E1268D1DF8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {3352DA8A-D3C3-4688-BBD8-70DD563D7EFA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {37C8B6DE-3457-4CF6-AC49-BDD966E8C815} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {455E1D2D-72ED-4E54-94A9-F9A53C750D61} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {625DA84E-98D9-4A70-81A2-87E41D262B0A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {6B4CAB6E-F2DE-4404-BB12-39B5844F7F22} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {734CC9CE-2F53-43D7-90A3-A332518CA45D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {7B3C768B-5BDB-4163-BE7B-19A6BAC275C8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {82B02B90-088F-424B-915A-353E75D02880} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-17] (Adobe Systems Incorporated)
Task: {88980258-7C2F-4057-8E33-0624C438A5F6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)
Task: {8F24E449-EAB9-4729-AEA9-293295BF6713} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {907115CA-88D1-4780-834E-124F2ADBEC1C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {98FFCDCD-31EA-44A7-878C-25D5201E0841} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-16] (Microsoft Corporation)
Task: {A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {AA087389-78C7-4521-83BA-166BEFFF4C56} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)
Task: {AB99A591-F04B-4883-93B7-91E3BDF9C32C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {B29FBF40-58FD-4389-906A-E46F7615975F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {B66C7CB6-9CA4-44E8-876A-C6B7B69CF117} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-07-29 15:04 - 2015-07-29 15:04 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2015-01-27 19:36 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 04:45 - 2015-09-15 13:25 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-01 11:25 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2013-10-01 10:32 - 2013-10-01 10:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll
2015-10-01 11:25 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-10-01 11:25 - 2015-09-17 06:42 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll
2015-10-01 11:25 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-07-10 11:59 - 2015-07-10 11:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll
2015-10-01 11:25 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-10-01 11:25 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-01 11:25 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 12:00 - 2015-07-10 17:45 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 02412440 _____ () C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe
2015-10-04 10:50 - 2015-10-04 10:51 - 00012288 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-10-04 10:50 - 2015-10-04 10:51 - 10814464 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-08-19 10:56 - 2015-08-11 10:10 - 00293376 _____ () C:\WINDOWS\SYSTEM32\textinputframework.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-02-04 18:28 - 2014-02-04 18:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2015-10-13 04:46 - 2015-09-15 13:25 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00049424 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_thread-vc90-mt-1_39.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00048400 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_date_time-vc90-mt-1_39.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00068504 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashRpt.dll
2015-09-18 11:07 - 2015-09-18 11:07 - 00580504 _____ () C:\Program Files (x86)\Audials\Audials 12\SQLite3.dll
2015-09-18 11:07 - 2015-09-18 11:07 - 00545176 _____ () C:\Program Files (x86)\Audials\Audials 12\StreamingClient.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00618256 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_regex-vc90-mt-1_39.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00016144 _____ () C:\Program Files (x86)\Audials\Audials 12\boost_system-vc90-mt-1_39.dll
2015-10-01 15:53 - 2015-10-01 15:53 - 00314880 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Utils\46d971b07904b91768d7b03518e89d26\Utils.ni.dll
2015-10-01 15:53 - 2015-10-01 15:53 - 00650752 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ManagedInterfaces\e5a94b46c30e6c66e8faeb75087915b9\ManagedInterfaces.ni.dll
2015-10-18 09:28 - 2015-10-18 09:28 - 03788800 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\AudialsComponents\7955b8ff218ca6d7b35fe4d221f3ff95\AudialsComponents.ni.dll
2015-10-01 15:54 - 2015-10-01 15:54 - 00699904 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\RSControls\1d04c75938d88c62845b10406fa5f736\RSControls.ni.dll
2015-10-01 15:54 - 2015-10-01 15:54 - 00176640 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\fastJSON\335bdd33a8aed053809c75e66b8f1b53\fastJSON.ni.dll
2015-10-01 15:54 - 2015-10-01 15:54 - 00062464 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CrashHandlerNET\fa593e4278c15e5e6e69466ee9d8be23\CrashHandlerNET.ni.dll
2015-09-18 11:06 - 2015-09-18 11:06 - 00040856 _____ () C:\Program Files (x86)\Audials\Audials 12\CrashHandlerNET.dll
2015-10-04 10:50 - 2015-10-13 00:33 - 00166416 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\EnterpriseDataAdapter.dll
2015-10-25 11:56 - 2015-10-25 11:56 - 00071168 _____ () c:\users\mercury\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpslbwwj.dll
2015-03-04 22:45 - 2015-09-24 00:07 - 00012800 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 22:45 - 2015-09-24 00:07 - 00779776 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-08-01 08:07 - 2015-09-24 00:07 - 00056320 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 22:45 - 2015-09-24 00:07 - 00012288 _____ () C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2015-01-27 19:56 - 2015-01-27 20:04 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MERCURY\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{48544deb-8e38-4d88-a697-11643f2737a2}.JPG
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Syncios device service"
HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{8061451B-F643-4B99-A490-DDC6E065689E}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [TCP Query User{A982388B-504B-420B-95FE-A50CA469588F}C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe] => (Allow) C:\users\mercury\appdata\local\jdownloader 2.0\jdownloader2.exe
FirewallRules: [UDP Query User{13A919C3-410A-4DB0-91A5-FB8044BCFAD1}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{69B9C0A6-D2D2-47F8-9126-0842B8BAD47D}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{871586EC-0FD5-49EA-B54C-386A7495DC03}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4237546A-DDAB-45A7-86AA-21FAAB7E21FD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{2E607E93-1F83-4A93-84CC-0B35BF015604}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{706640FE-D64E-4572-A693-45A89AA5C856}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [UDP Query User{CF377A06-5F49-4BC0-B200-2DBB72885DC3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AA25D4F2-C0C3-4BF7-9685-001D5091687F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{79111066-FF93-4ED4-8C89-F713055C22AD}] => (Allow) C:\Users\MERCURY\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [UDP Query User{F3AE5496-C093-4361-818F-8839A9600F22}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [TCP Query User{C29A58EF-21F1-4CE8-AFCB-91B7B5E84F7E}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [UDP Query User{B95791A6-D810-47A2-B1AC-1F840A1EBE20}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{C914D378-A40F-4977-A557-C63AA402F5C6}C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\mercury\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{B1DCE6FB-DA7D-4E5B-8772-94F416473FFD}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{5D42F60A-B46F-4B18-A662-77509C9817F0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{A2B74FFE-27C4-436C-86DB-25BCF63CE58B}] => (Allow) LPort=35722
FirewallRules: [{1B54A621-CE15-4F0E-9100-91E9190BB771}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F96EBB40-43BE-4CD3-8F2D-7F3226CD965C}] => (Allow) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [UDP Query User{15D3438C-C7C6-4D4F-A52C-13FC938DB6E5}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{191DBCDB-902D-48B2-8B36-DD87873CE1F1}C:\users\mercury\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mercury\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{6C548063-1ECA-47EE-9B55-7E1D9AF76744}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{553D57C7-DC11-485B-B920-0A7122D25EF4}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{55D2950E-F23C-4056-BCA6-53EB9ED412D7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FD994CEE-718E-4043-BE8C-0A997ACADA04}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{225CE99E-B7A4-4680-B739-B9FD13FECF0C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DDDA9F47-D578-481B-A9B6-D455904E9D10}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{074405C9-A00C-4542-B1CB-8708AAA7872D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D255724A-A5F3-4128-AC66-250A07777C4A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{F9790582-0BB1-4A81-A3E2-D929E8D32B3D}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{16F755AA-9B26-472F-BA9E-DBFD6ECB48AA}] => (Allow) C:\Program Files (x86)\Audials\Audials 12\Audials.exe
FirewallRules: [{65A6661E-D577-4AAB-9CC4-45C8AF9738D7}] => (Allow) LPort=12972
FirewallRules: [{8C86B038-EA54-4D8D-92DF-4B0D887FB315}] => (Allow) LPort=14714
FirewallRules: [{5672B5DA-80AC-4E88-9CA7-EBE027AC3C41}] => (Allow) LPort=31931
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/25/2015 09:58:30 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
Error: (10/25/2015 09:56:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
Error: (10/25/2015 08:14:25 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
Error: (10/25/2015 08:14:22 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
Error: (10/25/2015 02:21:49 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (8880) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/25/2015 02:21:49 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (8880) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/25/2015 02:21:39 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (8880) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/25/2015 02:21:39 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (8880) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Error: (10/25/2015 02:21:28 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (8880) Es konnte keine neue Protokolldatei erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (10/25/2015 02:21:28 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (8880) Der Versuch, die Datei "C:\WINDOWS\system32\edbtmp.log" zu erstellen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Erstellen von Dateien.
Systemfehler:
=============
Error: (10/25/2015 09:21:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (10/25/2015 09:21:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\MERCURY\AppData\Local\Temp\ehdrv.sys
Error: (10/25/2015 09:21:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (10/25/2015 09:21:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\MERCURY\AppData\Local\Temp\ehdrv.sys
Error: (10/25/2015 09:21:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (10/25/2015 09:21:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\MERCURY\AppData\Local\Temp\ehdrv.sys
Error: (10/25/2015 09:21:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (10/25/2015 09:21:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\MERCURY\AppData\Local\Temp\ehdrv.sys
Error: (10/25/2015 09:21:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (10/25/2015 09:21:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\MERCURY\AppData\Local\Temp\ehdrv.sys
CodeIntegrity:
===================================
Date: 2015-10-25 14:06:51.769
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-24 15:42:21.309
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:21.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.744
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-24 15:42:09.617
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-10-04 15:04:41.650
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 15:03:48.796
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:45:25.604
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:24.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-10-04 13:44:00.513
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll because the set of per-page image hashes could not be found on the system.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 40%
Installierter physikalischer RAM: 8070.03 MB
Verfügbarer physikalischer RAM: 4816.49 MB
Summe virtueller Speicher: 9350.03 MB
Verfügbarer virtueller Speicher: 5601.73 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:249.56 GB) (Free:142.75 GB) NTFS
Drive d: (Meins) (Fixed) (Total:681 GB) (Free:563.31 GB) NTFS
Drive l: (My Book) (Fixed) (Total:931.51 GB) (Free:274.75 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT.
========================================================
Disk: 6 (Size: 931.5 GB) (Disk ID: E8900690)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-10-2015 02 durchgeführt von MERCURY (Administrator) auf BILLY (25-10-2015 22:00:47) Gestartet von C:\Users\MERCURY\Downloads Geladene Profile: MERCURY (Verfügbare Profile: MERCURY & Gast) Platform: Windows 10 Home (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe () C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Dropbox, Inc.) C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.13821.0_x64__8wekyb3d8bbwe\Video.UI.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.PowerPoint_17.6228.10041.0_x64__8wekyb3d8bbwe\pptim.exe (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Spotify Ltd) C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6310.42251.0_x64__8wekyb3d8bbwe\HxMail.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6310.42251.0_x64__8wekyb3d8bbwe\HxTsr.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-15] (Apple Inc.) HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [5836888 2015-10-01] (Emsisoft Ltd) HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis) HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-16] (Apple Inc.) HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Spotify Web Helper] => C:\Users\MERCURY\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030912 2015-10-25] (Spotify Ltd) HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 12\AudialsNotifier.exe [2412440 2015-09-18] () HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [Dropbox Update] => C:\Users\MERCURY\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-21] (Dropbox, Inc.) HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64" HKU\S-1-5-21-4024391792-2930209080-385294340-1001\...\RunOnce: [Uninstall C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\MERCURY\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64" HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2014-12-01] (Apple Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-10-13] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] () ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] () ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] () Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-10-25] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation) Startup: C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-25] ShortcutTarget: Dropbox.lnk -> C:\Users\MERCURY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{a0a490e2-89f6-4e4a-a04c-a750cf07901a}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-27] (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.) FF Extension: ColorfulTabs - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2015-10-17] FF Extension: FireFTP - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-05-30] FF Extension: anonymoX - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\client@anonymox.net.xpi [2015-09-30] FF Extension: Ghostery - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\firefox@ghostery.com.xpi [2015-09-19] FF Extension: yaBeat - YouTube to MP3 - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid0-uqZgom7deYId1IGHnMog6eoQ2cI@jetpack.xpi [2015-05-30] FF Extension: Google Selection Translate - For AltKey - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\jid1-f7dnBeTj8ElpOQ@jetpack.xpi [2015-09-13] FF Extension: Zoom Page - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\zoompage@DW-dev.xpi [2015-10-17] FF Extension: ImTranslator - C:\Users\MERCURY\AppData\Roaming\Mozilla\Firefox\Profiles\k89j4gwx.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2015-10-17] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [7084784 2015-10-01] (Emsisoft Ltd) S2 AAV UpdateService; C:\Programme (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation) S2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-17] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448464 2015-03-30] (TeamViewer GmbH) S2 Virtual CDAudio Service; C:\Program Files (x86)\Audials\Audials 12\VCDWriter\64\VCDAudioService.exe [179608 2015-09-18] (RapidSolution Software AG) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R1 epp64; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\epp64.sys [138504 2015-10-01] (Emsisoft GmbH) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-25] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-08-28] (Intel Corporation) R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [25256 2015-04-21] (Audials AG) R3 rsvcdwdr; C:\Windows\System32\drivers\rsvcdwdr.sys [45192 2015-04-21] (RapidSolution Software AG) R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek ) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-25] (Acronis International GmbH) S0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-25] (Acronis International GmbH) S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-10-25 22:00 - 2015-10-25 22:01 - 00017520 _____ C:\Users\MERCURY\Downloads\FRST.txt 2015-10-25 22:00 - 2015-10-25 22:00 - 00000000 ____D C:\Users\MERCURY\Downloads\FRST-OlderVersion 2015-10-25 21:58 - 2015-10-25 21:58 - 00852720 _____ C:\Users\MERCURY\Downloads\SecurityCheck.exe 2015-10-25 21:55 - 2015-10-25 21:55 - 00016148 _____ C:\WINDOWS\system32\BILLY_MERCURY_HistoryPrediction.bin 2015-10-25 20:14 - 2015-10-25 20:14 - 02870984 _____ (ESET) C:\Users\MERCURY\Downloads\esetsmartinstaller_deu.exe 2015-10-25 20:14 - 2015-10-25 20:14 - 00000000 ____D C:\Program Files (x86)\ESET 2015-10-25 11:56 - 2015-10-25 11:56 - 00000000 ____D C:\Users\MERCURY\AppData\Local\CrashRpt 2015-10-25 09:06 - 2015-10-25 22:00 - 02197504 _____ (Farbar) C:\Users\MERCURY\Downloads\FRST64.exe 2015-10-25 09:02 - 2015-10-25 09:02 - 00000737 _____ C:\Users\MERCURY\Desktop\JRT.txt 2015-10-25 08:58 - 2015-10-05 23:23 - 01801288 _____ (Malwarebytes) C:\Users\MERCURY\Desktop\JRT.exe 2015-10-25 08:53 - 2015-10-25 08:54 - 00000000 ____D C:\AdwCleaner 2015-10-25 08:47 - 2015-10-25 08:47 - 00000000 ___HD C:\OneDriveTemp 2015-10-25 08:33 - 2015-10-25 08:57 - 01798976 _____ (Malwarebytes) C:\Users\MERCURY\Downloads\JRT.exe 2015-10-25 08:32 - 2015-10-25 08:52 - 01691648 _____ C:\Users\MERCURY\Downloads\AdwCleaner_5.014.exe 2015-10-25 08:23 - 2015-10-25 20:12 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-10-25 08:22 - 2015-10-25 08:43 - 00001171 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-10-25 08:22 - 2015-10-25 08:22 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-10-25 08:22 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-10-25 08:22 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-10-25 08:22 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2015-10-25 08:19 - 2015-10-25 08:22 - 22908888 _____ (Malwarebytes ) C:\Users\MERCURY\Downloads\mbam-setup-2.2.0.1024.exe 2015-10-24 17:40 - 2015-10-24 17:40 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-10-24 16:19 - 2015-10-24 16:19 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Opera Software 2015-10-24 16:19 - 2015-10-24 16:19 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Opera Software 2015-10-24 16:15 - 2015-10-24 16:22 - 00000000 ____D C:\Program Files (x86)\Opera 2015-10-24 16:14 - 2015-10-24 16:14 - 00000000 ____D C:\Users\Public\Documents\Baidu 2015-10-17 14:13 - 2015-10-17 14:13 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\PhotoSync 2015-10-17 14:11 - 2015-10-25 08:43 - 00002597 _____ C:\Users\Public\Desktop\PhotoSync.lnk 2015-10-17 14:11 - 2015-10-17 14:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoSync 2015-10-17 13:59 - 2015-10-24 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-10-17 09:59 - 2015-10-17 14:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-10-14 12:54 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-10-14 12:54 - 2015-10-10 07:40 - 21875712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-10-14 12:54 - 2015-10-10 07:07 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-10-14 12:54 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-10-14 12:54 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-10-14 12:54 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-10-14 12:54 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-10-14 12:54 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-10-14 12:54 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-10-14 12:54 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-10-14 12:54 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2015-10-14 12:54 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-10-14 12:54 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2015-10-14 12:54 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-10-14 12:54 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2015-10-14 12:54 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-10-14 12:54 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-10-14 12:54 - 2015-09-25 04:17 - 24595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-10-14 12:54 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll 2015-10-14 12:54 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll 2015-10-14 12:54 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-10-14 12:54 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2015-10-14 12:54 - 2015-09-25 04:04 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2015-10-14 12:54 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-10-14 12:54 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2015-10-14 12:54 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2015-10-14 12:54 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-10-14 12:54 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2015-10-14 12:54 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-10-14 12:54 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2015-10-14 12:54 - 2015-09-25 04:02 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2015-10-14 12:54 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-10-14 12:54 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-10-14 12:54 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2015-10-14 12:54 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-10-14 12:54 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll 2015-10-14 12:54 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll 2015-10-14 12:54 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll 2015-10-14 12:54 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-10-14 12:54 - 2015-09-25 03:48 - 19325952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-10-14 12:54 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll 2015-10-14 12:54 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll 2015-10-14 12:54 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-10-14 12:54 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-10-14 12:54 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2015-10-14 12:54 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-10-14 12:54 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-10-14 12:54 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2015-10-14 12:54 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2015-10-14 12:54 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-10-14 12:54 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2015-10-14 12:54 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-10-14 12:54 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll 2015-10-14 12:54 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll 2015-10-14 12:54 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll 2015-10-14 12:54 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll 2015-10-14 12:54 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll 2015-10-14 12:54 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-10-14 12:54 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll 2015-10-04 10:55 - 2015-10-04 11:05 - 58777218 _____ C:\Users\MERCURY\Downloads\Ecos Audio - Supersticiones_2.wma 2015-10-04 10:54 - 2015-10-04 11:07 - 73507735 _____ C:\Users\MERCURY\Downloads\Letzter Gruss aus Granada_2.wma 2015-10-01 11:25 - 2015-09-19 06:14 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll 2015-10-01 11:25 - 2015-09-17 07:50 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2015-10-01 11:25 - 2015-09-17 07:50 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll 2015-10-01 11:25 - 2015-09-17 07:50 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys 2015-10-01 11:25 - 2015-09-17 07:50 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll 2015-10-01 11:25 - 2015-09-17 07:49 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll 2015-10-01 11:25 - 2015-09-17 07:49 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll 2015-10-01 11:25 - 2015-09-17 07:49 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys 2015-10-01 11:25 - 2015-09-17 07:49 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2015-10-01 11:25 - 2015-09-17 07:49 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS 2015-10-01 11:25 - 2015-09-17 07:48 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll 2015-10-01 11:25 - 2015-09-17 07:48 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS 2015-10-01 11:25 - 2015-09-17 07:48 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys 2015-10-01 11:25 - 2015-09-17 07:48 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2015-10-01 11:25 - 2015-09-17 07:47 - 01397088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-10-01 11:25 - 2015-09-17 07:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2015-10-01 11:25 - 2015-09-17 07:43 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2015-10-01 11:25 - 2015-09-17 07:37 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll 2015-10-01 11:25 - 2015-09-17 07:37 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2015-10-01 11:25 - 2015-09-17 07:28 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll 2015-10-01 11:25 - 2015-09-17 07:28 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2015-10-01 11:25 - 2015-09-17 07:28 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll 2015-10-01 11:25 - 2015-09-17 07:28 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2015-10-01 11:25 - 2015-09-17 07:28 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-10-01 11:25 - 2015-09-17 07:28 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll 2015-10-01 11:25 - 2015-09-17 07:27 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2015-10-01 11:25 - 2015-09-17 07:27 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll 2015-10-01 11:25 - 2015-09-17 07:26 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll 2015-10-01 11:25 - 2015-09-17 07:25 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-10-01 11:25 - 2015-09-17 07:21 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2015-10-01 11:25 - 2015-09-17 07:20 - 00764416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll 2015-10-01 11:25 - 2015-09-17 07:11 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll 2015-10-01 11:25 - 2015-09-17 07:10 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll 2015-10-01 11:25 - 2015-09-17 07:09 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll 2015-10-01 11:25 - 2015-09-17 07:09 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll 2015-10-01 11:25 - 2015-09-17 07:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll 2015-10-01 11:25 - 2015-09-17 07:08 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll 2015-10-01 11:25 - 2015-09-17 07:08 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe 2015-10-01 11:25 - 2015-09-17 07:06 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll 2015-10-01 11:25 - 2015-09-17 07:06 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll 2015-10-01 11:25 - 2015-09-17 07:06 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll 2015-10-01 11:25 - 2015-09-17 07:05 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll 2015-10-01 11:25 - 2015-09-17 07:05 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll 2015-10-01 11:25 - 2015-09-17 07:04 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll 2015-10-01 11:25 - 2015-09-17 07:04 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll 2015-10-01 11:25 - 2015-09-17 07:04 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll 2015-10-01 11:25 - 2015-09-17 07:03 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll 2015-10-01 11:25 - 2015-09-17 07:03 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll 2015-10-01 11:25 - 2015-09-17 07:03 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe 2015-10-01 11:25 - 2015-09-17 07:03 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll 2015-10-01 11:25 - 2015-09-17 07:03 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe 2015-10-01 11:25 - 2015-09-17 07:02 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll 2015-10-01 11:25 - 2015-09-17 07:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll 2015-10-01 11:25 - 2015-09-17 07:00 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2015-10-01 11:25 - 2015-09-17 07:00 - 02417664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-10-01 11:25 - 2015-09-17 07:00 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll 2015-10-01 11:25 - 2015-09-17 07:00 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KeywordDetectorMsftSidAdapter.dll 2015-10-01 11:25 - 2015-09-17 06:58 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll 2015-10-01 11:25 - 2015-09-17 06:57 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll 2015-10-01 11:25 - 2015-09-17 06:57 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll 2015-10-01 11:25 - 2015-09-17 06:57 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll 2015-10-01 11:25 - 2015-09-17 06:57 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll 2015-10-01 11:25 - 2015-09-17 06:56 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2015-10-01 11:25 - 2015-09-17 06:56 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll 2015-10-01 11:25 - 2015-09-17 06:56 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll 2015-10-01 11:25 - 2015-09-17 06:55 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe 2015-10-01 11:25 - 2015-09-17 06:55 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll 2015-10-01 11:25 - 2015-09-17 06:54 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2015-10-01 11:25 - 2015-09-17 06:54 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2015-10-01 11:25 - 2015-09-17 06:54 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2015-10-01 11:25 - 2015-09-17 06:53 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll 2015-10-01 11:25 - 2015-09-17 06:52 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-10-01 11:25 - 2015-09-17 06:51 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll 2015-10-01 11:25 - 2015-09-17 06:50 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll 2015-10-01 11:25 - 2015-09-17 06:50 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys 2015-10-01 11:25 - 2015-09-17 06:50 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll 2015-10-01 11:25 - 2015-09-17 06:50 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll 2015-10-01 11:25 - 2015-09-17 06:50 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll 2015-10-01 11:25 - 2015-09-17 06:50 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys 2015-10-01 11:25 - 2015-09-17 06:49 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll 2015-10-01 11:25 - 2015-09-17 06:49 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll 2015-10-01 11:25 - 2015-09-17 06:48 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll 2015-10-01 11:25 - 2015-09-17 06:47 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll 2015-10-01 11:25 - 2015-09-17 06:47 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll 2015-10-01 11:25 - 2015-09-17 06:47 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe 2015-10-01 11:25 - 2015-09-17 06:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll 2015-10-01 11:25 - 2015-09-17 06:46 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll 2015-10-01 11:25 - 2015-09-17 06:45 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll 2015-10-01 11:25 - 2015-09-17 06:45 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll 2015-10-01 11:25 - 2015-09-17 06:45 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll 2015-10-01 11:25 - 2015-09-17 06:45 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-10-01 11:25 - 2015-09-17 06:45 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll 2015-10-01 11:25 - 2015-09-17 06:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll 2015-10-01 11:25 - 2015-09-17 06:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll 2015-10-01 11:25 - 2015-09-17 06:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2015-10-01 11:25 - 2015-09-17 06:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll 2015-10-01 11:25 - 2015-09-17 06:43 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll 2015-10-01 11:25 - 2015-09-17 06:43 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll 2015-10-01 11:25 - 2015-09-17 06:43 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll 2015-10-01 11:25 - 2015-09-17 06:43 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll 2015-10-01 11:25 - 2015-09-17 06:42 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2015-10-01 11:25 - 2015-09-17 06:41 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll 2015-10-01 11:25 - 2015-09-17 06:40 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll 2015-10-01 11:25 - 2015-09-17 06:40 - 01918464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-10-01 11:25 - 2015-09-17 06:40 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll 2015-10-01 11:25 - 2015-09-17 06:39 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll 2015-10-01 11:25 - 2015-09-17 06:39 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2015-10-01 11:25 - 2015-09-17 06:38 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll 2015-10-01 11:25 - 2015-09-17 06:37 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll 2015-10-01 11:25 - 2015-09-17 06:36 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll 2015-10-01 11:25 - 2015-09-17 06:35 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2015-10-01 11:25 - 2015-09-17 06:35 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-10-01 11:25 - 2015-09-17 06:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2015-10-01 11:25 - 2015-09-17 06:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll 2015-10-01 11:25 - 2015-09-17 06:34 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll 2015-10-01 11:25 - 2015-09-17 06:32 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll 2015-10-01 11:25 - 2015-09-17 06:32 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll 2015-10-01 11:25 - 2015-09-17 06:32 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll 2015-10-01 11:25 - 2015-09-17 06:31 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll 2015-10-01 11:25 - 2015-09-17 06:30 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2015-10-01 11:25 - 2015-09-17 06:29 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll 2015-10-01 11:25 - 2015-09-17 06:29 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll 2015-10-01 11:25 - 2015-09-17 06:29 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll 2015-10-01 11:25 - 2015-09-17 06:29 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-10-01 11:25 - 2015-09-17 06:28 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll 2015-10-01 11:25 - 2015-09-17 06:26 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll 2015-10-01 11:25 - 2015-09-17 06:16 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll 2015-10-01 11:25 - 2015-09-13 03:05 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2015-10-01 11:25 - 2015-09-13 02:41 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2015-09-30 14:29 - 2015-10-25 08:43 - 00000966 _____ C:\Users\Public\Desktop\Audials 12.lnk 2015-09-30 14:14 - 2015-10-25 20:55 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DD6E9A90-2E3B-4A9E-82CF-290362D3D5B2} 2015-09-30 13:52 - 2015-09-30 14:05 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\iFunbox_UserCache 2015-09-30 12:48 - 2015-09-30 13:57 - 00000000 ____D C:\Users\MERCURY\Downloads\Spanisch lernen PONS Sprachkurs fur Anf303244nger [PONS GmbH] (v2 60 2 3GS Univ i8 os61)-teflon rc325 ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-10-25 22:00 - 2015-01-25 18:47 - 00000000 ____D C:\FRST 2015-10-25 21:21 - 2015-01-25 14:43 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware 2015-10-25 21:16 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru 2015-10-25 21:08 - 2015-06-21 14:57 - 00001244 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001UA.job 2015-10-25 21:03 - 2015-04-28 18:51 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-10-25 15:22 - 2015-01-25 14:56 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Spotify 2015-10-25 15:19 - 2015-01-25 14:53 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Spotify 2015-10-25 15:09 - 2015-07-29 14:30 - 01790124 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-10-25 15:09 - 2015-07-10 17:34 - 00771100 _____ C:\WINDOWS\system32\perfh007.dat 2015-10-25 15:09 - 2015-07-10 17:34 - 00153964 _____ C:\WINDOWS\system32\perfc007.dat 2015-10-25 14:08 - 2015-06-21 14:57 - 00001192 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-4024391792-2930209080-385294340-1001Core.job 2015-10-25 14:07 - 2015-01-25 15:08 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\vlc 2015-10-25 13:55 - 2015-07-10 13:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log 2015-10-25 13:55 - 2015-07-10 13:20 - 00055045 _____ C:\WINDOWS\setupact.log 2015-10-25 12:33 - 2015-06-28 17:07 - 00000000 ____D C:\Users\MERCURY\AppData\Local\JDownloader 2.0 2015-10-25 12:12 - 2014-11-12 12:05 - 00000000 ____D C:\Users\MERCURY\Documents\My Digital Editions 2015-10-25 11:57 - 2015-01-25 15:22 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Dropbox 2015-10-25 11:57 - 2014-05-07 16:22 - 00000000 ___RD C:\Users\MERCURY\Dropbox 2015-10-25 11:56 - 2015-05-25 13:44 - 00000000 ___RD C:\Users\MERCURY\iCloudDrive 2015-10-25 11:56 - 2015-01-16 14:06 - 00000000 ___DO C:\Users\MERCURY\SkyDrive 2015-10-25 08:55 - 2015-07-29 14:13 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat 2015-10-25 08:55 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-10-25 08:54 - 2015-07-29 14:09 - 00056310 _____ C:\WINDOWS\PFRO.log 2015-10-25 08:54 - 2015-07-10 10:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI 2015-10-25 08:43 - 2015-09-19 12:33 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk 2015-10-25 08:43 - 2015-09-06 10:54 - 00002318 _____ C:\Users\MERCURY\Desktop\Kindle.lnk 2015-10-25 08:43 - 2015-09-06 10:46 - 00001200 _____ C:\Users\Public\Desktop\Epubor Ultimate.lnk 2015-10-25 08:43 - 2015-07-29 15:31 - 00001047 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optionale Features.lnk 2015-10-25 08:43 - 2015-07-29 15:21 - 00002360 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-10-25 08:43 - 2015-07-29 14:21 - 00001552 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-10-25 08:43 - 2015-07-22 12:12 - 00001492 _____ C:\Users\Public\Desktop\ElsterFormular.lnk 2015-10-25 08:43 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-10-25 08:43 - 2015-07-01 15:05 - 00001857 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2015-10-25 08:43 - 2015-06-28 17:09 - 00002119 _____ C:\Users\MERCURY\Desktop\JDownloader 2.lnk 2015-10-25 08:43 - 2015-06-08 12:52 - 00001484 _____ C:\Users\Public\Desktop\LibreOffice 4.3.lnk 2015-10-25 08:43 - 2015-05-20 16:09 - 00001167 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk 2015-10-25 08:43 - 2015-05-20 16:09 - 00001117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk 2015-10-25 08:43 - 2015-05-20 11:25 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2015-10-25 08:43 - 2015-05-20 11:25 - 00002067 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk 2015-10-25 08:43 - 2015-05-10 11:08 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk 2015-10-25 08:43 - 2015-04-12 11:06 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2015-10-25 08:43 - 2015-04-12 11:06 - 00001043 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk 2015-10-25 08:43 - 2015-04-04 11:24 - 00001714 _____ C:\Users\Public\Desktop\Recuva.lnk 2015-10-25 08:43 - 2015-03-28 16:58 - 00000966 _____ C:\Users\MERCURY\Desktop\VirtualDJ 8.lnk 2015-10-25 08:43 - 2015-03-27 14:23 - 00001103 _____ C:\Users\Public\Desktop\RarZilla Free Unrar.lnk 2015-10-25 08:43 - 2015-03-07 13:47 - 00001849 _____ C:\Users\Public\Desktop\BILD Steuer 2015.lnk 2015-10-25 08:43 - 2015-02-25 11:37 - 00001524 _____ C:\Users\MERCURY\Desktop\RippMe - Verknüpfung.lnk 2015-10-25 08:43 - 2015-02-15 11:39 - 00001437 _____ C:\Users\MERCURY\Desktop\CopyTrans Control Center.lnk 2015-10-25 08:43 - 2015-02-04 13:57 - 00002073 _____ C:\Users\MERCURY\Desktop\waterMark V2.lnk 2015-10-25 08:43 - 2015-02-02 12:40 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2015-10-25 08:43 - 2015-01-31 10:41 - 00001144 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk 2015-10-25 08:43 - 2015-01-31 10:00 - 00001336 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk 2015-10-25 08:43 - 2015-01-27 19:37 - 00001122 _____ C:\Users\Public\Desktop\Picasa 3.lnk 2015-10-25 08:43 - 2015-01-25 16:50 - 00000999 _____ C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk 2015-10-25 08:43 - 2015-01-25 16:14 - 00001217 _____ C:\Users\Public\Desktop\Acronis True Image 2014.lnk 2015-10-25 08:43 - 2015-01-25 15:41 - 00000991 _____ C:\Users\Public\Desktop\Mp3tag.lnk 2015-10-25 08:43 - 2015-01-25 15:30 - 00001023 _____ C:\Users\MERCURY\Desktop\Dropbox.lnk 2015-10-25 08:43 - 2015-01-25 15:29 - 00001014 _____ C:\Users\MERCURY\Desktop\IrfanView.lnk 2015-10-25 08:43 - 2015-01-25 15:07 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-10-25 08:43 - 2015-01-25 14:56 - 00001823 _____ C:\Users\MERCURY\Desktop\Spotify.lnk 2015-10-25 08:43 - 2015-01-25 14:56 - 00001809 _____ C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2015-10-25 08:43 - 2015-01-25 14:49 - 00001171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-10-25 08:43 - 2015-01-25 14:49 - 00001159 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-10-25 08:43 - 2015-01-25 14:43 - 00001103 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2015-10-25 08:43 - 2014-05-10 12:27 - 00000640 _____ C:\Users\MERCURY\Desktop\Total Commander.lnk 2015-10-24 17:32 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-10-24 17:11 - 2015-07-29 14:16 - 00000000 ____D C:\Users\MERCURY 2015-10-24 17:08 - 2015-09-19 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-10-24 17:08 - 2015-09-19 12:33 - 00000000 ____D C:\Program Files\iTunes 2015-10-24 17:08 - 2015-07-29 14:16 - 00000000 ___RD C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-10-24 17:08 - 2015-07-29 14:16 - 00000000 ____D C:\Users\Gast 2015-10-24 17:08 - 2015-07-10 10:05 - 00000000 ____D C:\WINDOWS\system32\Sysprep 2015-10-24 17:08 - 2015-02-24 13:50 - 00000000 ____D C:\Program Files (x86)\iTunes 2015-10-24 17:08 - 2015-01-25 14:17 - 00000000 ___HD C:\$SysReset 2015-10-24 17:01 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\registration 2015-10-24 17:00 - 2015-05-25 13:44 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Apple Inc 2015-10-24 16:59 - 2015-09-19 12:33 - 00000000 ____D C:\Program Files\iPod 2015-10-24 16:59 - 2015-02-02 12:40 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-10-22 19:35 - 2015-09-06 10:46 - 00000000 ____D C:\Users\MERCURY\Ultimate 2015-10-22 19:35 - 2015-09-06 10:46 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\.Ultimate 2015-10-18 10:42 - 2015-01-25 16:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management 2015-10-18 10:42 - 2015-01-25 16:50 - 00000000 ____D C:\Program Files\Calibre2 2015-10-17 14:11 - 2015-01-25 15:45 - 00000000 ____D C:\Program Files (x86)\PhotoSync 2015-10-17 14:04 - 2015-02-02 12:41 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Apple Computer 2015-10-17 14:00 - 2015-01-25 14:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-10-17 13:03 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-10-16 10:08 - 2015-05-20 11:25 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-10-16 10:08 - 2015-01-25 19:09 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-10-16 10:06 - 2015-01-25 19:09 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-09 12:49 - 2014-05-07 15:28 - 00000000 ____D C:\Users\MERCURY\AppData\Local\Packages 2015-10-04 14:04 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache 2015-10-01 15:39 - 2015-09-06 10:54 - 00000000 ____D C:\Users\MERCURY\Documents\My Kindle Content 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning 2015-10-01 15:05 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas 2015-09-30 14:29 - 2015-05-30 14:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 12 2015-09-30 14:14 - 2015-02-02 12:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieUserList 2015-09-30 14:14 - 2015-02-02 12:41 - 00000000 __SHD C:\Users\MERCURY\AppData\Local\EmieSiteList 2015-09-30 13:22 - 2015-02-15 11:39 - 00000000 ____D C:\Users\MERCURY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center 2015-09-30 11:23 - 2015-01-27 19:36 - 00000000 ____D C:\Program Files\Microsoft Office 15 ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-07-29 14:14 - 2015-07-29 14:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Einige Dateien in TEMP: ==================== C:\Users\MERCURY\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpslbwwj.dll C:\Users\MERCURY\AppData\Local\Temp\proxy_vole1377933991528586276.dll C:\Users\MERCURY\AppData\Local\Temp\sqlite3.dll C:\Users\MERCURY\AppData\Local\Temp\SynciosDeviceService.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-10-20 11:34 ==================== Ende von FRST.txt ============================ Nochmal Danke für die Hilfe, auf euch ist echt Verlaß´! wenn alles ok ist, muß dann noch irgedwas machen? die Programme entfernen oder drauflassen und ab und an mal was davon laufen lassen? Dankeeee!! Geändert von Pille77 (25.10.2015 um 22:08 Uhr) |
|
26.10.2015, 19:00
| #10 |
| /// the machine /// TB-Ausbilder | habe mir adware eingfangen Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Task: {3352DA8A-D3C3-4688-BBD8-70DD563D7EFA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {6B4CAB6E-F2DE-4404-BB12-39B5844F7F22} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {734CC9CE-2F53-43D7-90A3-A332518CA45D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {7B3C768B-5BDB-4163-BE7B-19A6BAC275C8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {8F24E449-EAB9-4729-AEA9-293295BF6713} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {907115CA-88D1-4780-834E-124F2ADBEC1C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {AB99A591-F04B-4883-93B7-91E3BDF9C32C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {B29FBF40-58FD-4389-906A-E46F7615975F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {B66C7CB6-9CA4-44E8-876A-C6B7B69CF117} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren .
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung:Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.10.2015, 19:34
| #11 |
| | habe mir adware eingfangenCode:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-10-2015 02
durchgeführt von MERCURY (2015-10-26 19:33:16) Run:1
Gestartet von C:\Users\MERCURY\Downloads
Geladene Profile: MERCURY (Verfügbare Profile: MERCURY & Gast)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
Task: {3352DA8A-D3C3-4688-BBD8-70DD563D7EFA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {6B4CAB6E-F2DE-4404-BB12-39B5844F7F22} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {734CC9CE-2F53-43D7-90A3-A332518CA45D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {7B3C768B-5BDB-4163-BE7B-19A6BAC275C8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {8F24E449-EAB9-4729-AEA9-293295BF6713} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {907115CA-88D1-4780-834E-124F2ADBEC1C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {AB99A591-F04B-4883-93B7-91E3BDF9C32C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {B29FBF40-58FD-4389-906A-E46F7615975F} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {B66C7CB6-9CA4-44E8-876A-C6B7B69CF117} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
*****************
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3352DA8A-D3C3-4688-BBD8-70DD563D7EFA}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3352DA8A-D3C3-4688-BBD8-70DD563D7EFA}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6B4CAB6E-F2DE-4404-BB12-39B5844F7F22}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B4CAB6E-F2DE-4404-BB12-39B5844F7F22}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{734CC9CE-2F53-43D7-90A3-A332518CA45D}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{734CC9CE-2F53-43D7-90A3-A332518CA45D}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7B3C768B-5BDB-4163-BE7B-19A6BAC275C8}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7B3C768B-5BDB-4163-BE7B-19A6BAC275C8}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8F24E449-EAB9-4729-AEA9-293295BF6713}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8F24E449-EAB9-4729-AEA9-293295BF6713}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{907115CA-88D1-4780-834E-124F2ADBEC1C}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{907115CA-88D1-4780-834E-124F2ADBEC1C}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A5CFC2EA-8A82-4CFD-AF3F-71F254E5DD28}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AB99A591-F04B-4883-93B7-91E3BDF9C32C}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB99A591-F04B-4883-93B7-91E3BDF9C32C}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B29FBF40-58FD-4389-906A-E46F7615975F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B29FBF40-58FD-4389-906A-E46F7615975F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B66C7CB6-9CA4-44E8-876A-C6B7B69CF117}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66C7CB6-9CA4-44E8-876A-C6B7B69CF117}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CFE30F15-CD8B-4DE5-93F2-C4A6381EC41F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => Schlüssel erfolgreich entfernt
==== Ende von Fixlog 19:33:22 ====
vielen dank! die kiste ist wohl wieder sauber! |
|
27.10.2015, 19:31
| #12 |
| /// the machine /// TB-Ausbilder | habe mir adware eingfangen Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu habe mir adware eingfangen |
| adware, crossrider, danke, dauernd, dnsapi.dll, dringend, eingefangen, emsisoft, gefangen, gen, hilfe, hilfe!, nicht mehr, onedrive, schlägt, windowsapps |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
