Hallo, nach einem kurzen pipton war mein PC plötzlich sehr langsam und ich glaubte schon er funktioniert gar nicht mehr. Der Virenscanner antivirus ließ sich zunächst nicht öffnen. Nun scannt er, jedoch alles schleppend langsam. Ich vermute, dass ich mir einen virus eingefangen habe. Nur welchen und wie werde ich ihn los bzw kann free antivir das ding überhaupt erkennen?

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Kein plan was LOGs sind???!! Avira ist durch und hat natürlich nichts gefunden.
Ich lade mir dann jetzt farbers recovery runter?! Und klick mich mal so durch. Ich bin da völlig hilflos auf dem Gebiet.

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:10-01-2015 01
durchgeführt von Rita (Administrator) auf RITA-PC (15-01-2016 00:55:54)
Gestartet von C:\Users\Rita\Downloads
Geladene Profile: Rita (Verfügbare Profile: Rita & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Sleep Memory Optimizer\FFSService.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIKE.EXE
(Atheros) C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe
(Spotify Ltd) C:\Users\Rita\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\Rita\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [981664 2011-09-30] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [799904 2011-09-30] (Atheros Commnucations)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-07-11] (Apple Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-15] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] => C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-05-09] (CyberLink Corp.)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-12-08] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [278112 2011-11-02] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Run: [Dropbox Update] => C:\Users\Rita\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-23] (Dropbox, Inc.)
HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Run: [Spotify Web Helper] => C:\Users\Rita\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-08-07] (Spotify Ltd)
HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Run: [Spotify] => C:\Users\Rita\AppData\Roaming\Spotify\Spotify.exe [7675448 2015-08-07] (Spotify Ltd)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
Startup: C:\Users\Rita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Rita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2015-04-17]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{FECA32EE-24CC-4152-95A3-771F4ACE3AC5}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2011-01-26] (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-09-30] (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2011-01-26] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000 -> Kein Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  Keine Datei
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll [2011-07-21] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll [2013-09-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\askcom.xml [2013-09-22]
FF SearchPlugin: C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\ixquick-https.xml [2013-07-02]
FF SearchPlugin: C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\kinoxto-suche.xml [2015-03-17]
FF Extension: WOT - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-12-14]
FF Extension: Avira Browser Safety - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\Extensions\abs@avira.com [2016-01-15]
FF Extension: ProxTube - Unblock YouTube - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\Extensions\ich@maltegoetz.de.xpi [2015-07-28]
FF Extension: ProxTube - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2015-06-19] [ist nicht signiert]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-12-13]
FF Extension: Adblock Plus - C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-17]
FF Extension: Kein Name - C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2016-01-08] [ist nicht signiert]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://ixquick.com/deu"
CHR Profile: C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-10-20]
CHR Extension: (Google Docs) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-19]
CHR Extension: (Google Drive) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-20]
CHR Extension: (Google-Suche) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-02]
CHR Extension: (Avira Browserschutz) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-12-18]
CHR Extension: (Google Docs Offline) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-29]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-20]
CHR Extension: (Google Mail) - C:\Users\Rita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-19]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [948392 2015-12-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1418560 2015-12-01] (Avira Operations GmbH & Co. KG)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [105120 2011-09-30] (Atheros Commnucations) [Datei ist nicht signiert]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [251160 2015-12-08] (Avira Operations GmbH & Co. KG)
S2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 FFSOpzSvc; C:\Program Files\Sleep Memory Optimizer\FFSService.exe [141192 2011-09-17] (Acer Incorporated)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227936 2013-12-10] (WildTangent)
S3 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [184320 2011-07-07] (Intel Corporation) [Datei ist nicht signiert]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe [57344 2011-08-10] (Atheros) [Datei ist nicht signiert]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162072 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [140448 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [75472 2015-12-01] (Avira Operations GmbH & Co. KG)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2011-06-16] (Intel Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-15 00:55 - 2016-01-15 00:56 - 00021675 _____ C:\Users\Rita\Downloads\FRST.txt
2016-01-15 00:55 - 2016-01-15 00:55 - 02370560 _____ (Farbar) C:\Users\Rita\Downloads\FRST64.exe
2016-01-15 00:55 - 2016-01-15 00:55 - 00000000 ____D C:\FRST
2016-01-15 00:54 - 2016-01-15 00:54 - 01721856 _____ (Farbar) C:\Users\Rita\Downloads\FRST(2).exe
2016-01-15 00:53 - 2016-01-15 00:53 - 01673728 _____ (Farbar) C:\Users\Rita\Downloads\FRST(1).exe
2016-01-15 00:52 - 2016-01-15 00:52 - 01721856 _____ (Farbar) C:\Users\Rita\Downloads\FRST.exe
2016-01-15 00:03 - 2016-01-15 00:03 - 04638208 _____ (Avira Operations GmbH & Co. KG) C:\Users\Rita\Downloads\avira_de_av_569828c806f8b__ws(1).exe
2016-01-15 00:01 - 2016-01-15 00:01 - 04638208 _____ (Avira Operations GmbH & Co. KG) C:\Users\Rita\Downloads\avira_de_av_569828c806f8b__ws.exe
2016-01-13 07:46 - 2015-11-17 02:11 - 00025024 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-01-13 07:46 - 2015-11-17 02:08 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-01-13 07:46 - 2015-11-17 02:08 - 00792064 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-01-13 07:46 - 2015-11-17 02:08 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-01-13 07:46 - 2015-11-17 02:08 - 00505856 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-01-13 07:46 - 2015-11-17 02:08 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-01-13 07:46 - 2015-11-16 21:17 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-01-13 07:25 - 2015-11-14 00:09 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2016-01-13 07:25 - 2015-11-14 00:09 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2016-01-13 07:25 - 2015-11-14 00:08 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2016-01-13 07:25 - 2015-11-13 23:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2016-01-13 07:25 - 2015-11-13 23:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2016-01-13 07:25 - 2015-11-13 23:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fixmapi.exe
2016-01-13 07:21 - 2015-12-24 00:13 - 00387784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-01-13 07:21 - 2015-12-23 23:52 - 00341192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-01-13 07:21 - 2015-12-12 19:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-01-13 07:21 - 2015-12-12 19:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-01-13 07:21 - 2015-12-12 19:16 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-01-13 07:21 - 2015-12-12 19:15 - 02887168 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-01-13 07:21 - 2015-12-12 19:15 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-01-13 07:21 - 2015-12-12 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-01-13 07:21 - 2015-12-12 19:07 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-01-13 07:21 - 2015-12-12 19:07 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-01-13 07:21 - 2015-12-12 19:03 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-01-13 07:21 - 2015-12-12 19:02 - 20367360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-01-13 07:21 - 2015-12-12 19:02 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-01-13 07:21 - 2015-12-12 18:55 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-01-13 07:21 - 2015-12-12 18:51 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-01-13 07:21 - 2015-12-12 18:49 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-01-13 07:21 - 2015-12-12 18:44 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-01-13 07:21 - 2015-12-12 18:37 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-01-13 07:21 - 2015-12-12 18:37 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-01-13 07:21 - 2015-12-12 18:37 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-01-13 07:21 - 2015-12-12 18:37 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-01-13 07:21 - 2015-12-12 18:36 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-01-13 07:21 - 2015-12-12 18:36 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-01-13 07:21 - 2015-12-12 18:35 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-01-13 07:21 - 2015-12-12 18:33 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-01-13 07:21 - 2015-12-12 18:31 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-01-13 07:21 - 2015-12-12 18:30 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-01-13 07:21 - 2015-12-12 18:28 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-01-13 07:21 - 2015-12-12 18:27 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-01-13 07:21 - 2015-12-12 18:27 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-01-13 07:21 - 2015-12-12 18:27 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-01-13 07:21 - 2015-12-12 18:23 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-01-13 07:21 - 2015-12-12 18:22 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-01-13 07:21 - 2015-12-12 18:20 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-01-13 07:21 - 2015-12-12 18:19 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-01-13 07:21 - 2015-12-12 18:18 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-01-13 07:21 - 2015-12-12 18:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-01-13 07:21 - 2015-12-12 18:12 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-01-13 07:21 - 2015-12-12 18:10 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-01-13 07:21 - 2015-12-12 18:10 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-01-13 07:21 - 2015-12-12 18:09 - 04610560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-01-13 07:21 - 2015-12-12 18:08 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-01-13 07:21 - 2015-12-12 18:02 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-01-13 07:21 - 2015-12-12 18:00 - 12856320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-01-13 07:21 - 2015-12-12 18:00 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-01-13 07:21 - 2015-12-12 18:00 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-01-13 07:21 - 2015-12-12 18:00 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-01-13 07:21 - 2015-12-12 17:54 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-01-13 07:21 - 2015-12-12 17:41 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-01-13 07:21 - 2015-12-12 17:38 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-01-13 07:21 - 2015-12-12 17:36 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-01-13 07:21 - 2015-12-11 19:57 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-01-13 07:21 - 2015-12-08 22:54 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2016-01-13 07:21 - 2015-12-08 22:54 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 01568768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVENCOD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 01325056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOE.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00902144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00815616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOE.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00740352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2016-01-13 07:21 - 2015-12-08 22:54 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVXENCD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSENCD.DLL
2016-01-13 07:21 - 2015-12-08 22:54 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VIDRESZR.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00970240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2adec.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00609280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFWMAAEC.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00509952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP4SDECD.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MPG4DECD.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP43DECD.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RESAMPLEDMO.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2016-01-13 07:21 - 2015-12-08 22:53 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COLORCNV.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP3DMOD.DLL
2016-01-13 07:21 - 2015-12-08 22:53 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devenum.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfvdsp.dll
2016-01-13 07:21 - 2015-12-08 22:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2016-01-13 07:21 - 2015-12-08 22:53 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2016-01-13 07:21 - 2015-12-08 22:53 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksuser.dll
2016-01-13 07:21 - 2015-12-08 22:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 01955328 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01575424 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01573888 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2adec.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01153024 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOE.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 01026048 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 01010688 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\MP4SDECD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00642048 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\MFWMAAEC.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\WMVSENCD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\VIDRESZR.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\RESAMPLEDMO.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\MPG4DECD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\MP43DECD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\COLORCNV.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2016-01-13 07:21 - 2015-12-08 20:07 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\devenum.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\mfvdsp.dll
2016-01-13 07:21 - 2015-12-08 20:07 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2016-01-13 07:21 - 2015-12-08 20:07 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\ksuser.dll
2016-01-13 07:21 - 2015-12-08 20:06 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2016-01-13 07:21 - 2015-12-08 20:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2016-01-13 07:21 - 2015-12-08 20:04 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2016-01-13 07:21 - 2015-12-08 19:54 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2016-01-13 07:21 - 2015-12-08 19:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2016-01-13 07:21 - 2015-12-08 19:11 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmkaud.sys
2016-01-13 07:21 - 2015-12-08 18:58 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-01-13 07:20 - 2015-12-12 19:54 - 25837568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-01-13 07:20 - 2015-12-12 19:15 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-01-13 07:20 - 2015-12-12 19:14 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-01-13 07:20 - 2015-12-12 19:07 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-01-13 07:20 - 2015-12-12 19:02 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-01-13 07:20 - 2015-12-12 19:02 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-01-13 07:20 - 2015-12-12 19:02 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-01-13 07:20 - 2015-12-12 18:40 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-01-13 07:20 - 2015-12-12 18:39 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-01-13 07:20 - 2015-12-12 18:25 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-01-13 07:20 - 2015-12-12 18:21 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-01-13 07:20 - 2015-12-12 18:06 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-01-13 07:20 - 2015-12-12 17:42 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-01-13 07:17 - 2015-12-30 20:08 - 05572544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-01-13 07:17 - 2015-12-30 20:08 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-01-13 07:17 - 2015-12-30 20:08 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-01-13 07:17 - 2015-12-30 20:05 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-01-13 07:17 - 2015-12-30 20:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-01-13 07:17 - 2015-12-30 20:01 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-01-13 07:17 - 2015-12-30 20:00 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-01-13 07:17 - 2015-12-30 19:59 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-01-13 07:17 - 2015-12-30 19:59 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-01-13 07:17 - 2015-12-30 19:59 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-01-13 07:17 - 2015-12-30 19:58 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-01-13 07:17 - 2015-12-30 19:58 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-01-13 07:17 - 2015-12-30 19:57 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-01-13 07:17 - 2015-12-30 19:57 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-01-13 07:17 - 2015-12-30 19:57 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-01-13 07:17 - 2015-12-30 19:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-01-13 07:17 - 2015-12-30 19:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-01-13 07:17 - 2015-12-30 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:47 - 03993536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-01-13 07:17 - 2015-12-30 19:47 - 03938240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-01-13 07:17 - 2015-12-30 19:44 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-01-13 07:17 - 2015-12-30 19:41 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-01-13 07:17 - 2015-12-30 19:40 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-01-13 07:17 - 2015-12-30 19:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-01-13 07:17 - 2015-12-30 19:39 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-01-13 07:17 - 2015-12-30 19:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-01-13 07:17 - 2015-12-30 19:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-01-13 07:17 - 2015-12-30 19:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-01-13 07:17 - 2015-12-30 19:38 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-01-13 07:17 - 2015-12-30 19:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 18:57 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-01-13 07:17 - 2015-12-30 18:50 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-01-13 07:17 - 2015-12-30 18:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-01-13 07:17 - 2015-12-30 18:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-01-13 07:17 - 2015-12-30 18:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-01-13 07:17 - 2015-12-30 18:42 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-01-13 07:17 - 2015-12-30 18:42 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-01-13 07:17 - 2015-12-30 18:41 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-01-13 07:17 - 2015-12-30 18:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-01-13 07:17 - 2015-12-30 18:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-01-13 07:17 - 2015-12-30 18:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-01-13 07:17 - 2015-12-30 18:32 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-01-13 07:17 - 2015-12-30 18:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-01-13 07:17 - 2015-12-30 18:30 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-01-13 07:17 - 2015-12-30 18:30 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 18:30 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 18:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 07:17 - 2015-12-30 18:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-13 07:17 - 2015-12-08 22:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-01-13 07:17 - 2015-12-08 22:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-01-13 07:17 - 2015-12-08 20:07 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-01-13 07:17 - 2015-12-08 20:07 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-01-08 00:36 - 2016-01-14 04:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-22 20:22 - 2015-12-22 20:22 - 00000000 ____D C:\Users\Rita\AppData\Local\Skype

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-15 00:55 - 2011-02-12 04:43 - 00000000 ____D C:\Windows
2016-01-15 00:51 - 2013-07-15 14:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-01-15 00:30 - 2015-06-23 16:20 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000UA.job
2016-01-15 00:30 - 2011-11-17 21:37 - 00000384 _____ C:\Windows\Tasks\Acer Registration - Data Sending task.job
2016-01-15 00:11 - 2015-10-20 14:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-15 00:04 - 2015-09-02 19:45 - 00001218 _____ C:\Users\Public\Desktop\Avira Launcher.lnk
2016-01-15 00:04 - 2013-02-28 21:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-01-15 00:03 - 2014-08-07 09:20 - 00000000 ____D C:\ProgramData\Package Cache
2016-01-15 00:02 - 2009-07-14 05:45 - 00031712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-15 00:02 - 2009-07-14 05:45 - 00031712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-14 23:56 - 2015-07-13 20:53 - 00000000 ____D C:\Users\Rita\AppData\Roaming\Spotify
2016-01-14 23:56 - 2013-12-10 10:10 - 00000000 ___RD C:\Users\Rita\Dropbox
2016-01-14 23:56 - 2013-12-10 10:06 - 00000000 ____D C:\Users\Rita\AppData\Roaming\Dropbox
2016-01-14 23:47 - 2015-07-13 20:55 - 00000000 ____D C:\Users\Rita\AppData\Local\Spotify
2016-01-14 23:43 - 2015-10-20 14:56 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-14 23:35 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-14 21:08 - 2012-10-26 19:52 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{1495EE08-252C-44AC-AF96-2BF968851521}
2016-01-14 17:30 - 2015-06-23 16:20 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000Core.job
2016-01-14 05:43 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2016-01-14 04:35 - 2011-10-18 20:44 - 00699682 _____ C:\Windows\system32\perfh007.dat
2016-01-14 04:35 - 2011-10-18 20:44 - 00149790 _____ C:\Windows\system32\perfc007.dat
2016-01-14 04:35 - 2009-07-14 06:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-14 04:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-01-14 04:23 - 2009-07-14 05:45 - 00412736 _____ C:\Windows\system32\FNTCACHE.DAT
2016-01-14 04:22 - 2013-03-16 13:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-01-14 04:22 - 2013-03-16 13:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-01-14 04:20 - 2015-09-21 10:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-14 04:11 - 2014-12-11 03:31 - 00000000 ____D C:\Windows\system32\appraiser
2016-01-14 04:11 - 2014-05-12 07:49 - 00000000 ___SD C:\Windows\system32\CompatTel
2016-01-14 03:33 - 2011-11-17 23:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2016-01-14 03:32 - 2013-03-16 13:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-01-14 03:28 - 2013-07-30 23:46 - 00000000 ____D C:\Windows\system32\MRT
2016-01-14 03:13 - 2011-11-19 16:48 - 143671360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-01-14 03:07 - 2009-07-14 03:34 - 00000510 _____ C:\Windows\win.ini
2016-01-10 19:10 - 2013-12-10 10:07 - 00004078 _____ C:\Windows\wininit.ini
2016-01-02 14:52 - 2013-07-15 14:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-01-02 14:52 - 2012-10-23 16:32 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-01-02 14:52 - 2011-09-02 23:29 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-01 19:37 - 2011-12-13 14:18 - 00058368 ___SH C:\Users\Rita\Documents\Thumbs.db
2015-12-31 14:20 - 2013-06-20 16:52 - 00000000 ____D C:\Users\Rita\AppData\Roaming\vlc
2015-12-30 14:31 - 2011-11-19 20:44 - 00000000 ____D C:\Users\Rita\AppData\Roaming\Skype
2015-12-23 12:32 - 2015-05-13 16:13 - 00000000 ____D C:\Users\Rita\Documents\Advo card
2015-12-20 23:06 - 2015-04-05 02:00 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-12-20 23:06 - 2015-04-05 02:00 - 00000000 ___SD C:\Windows\system32\GWX
2015-12-16 22:32 - 2015-10-20 14:58 - 00002179 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2011-10-18 11:08 - 2011-10-18 11:11 - 0015131 _____ () C:\ProgramData\ArcadeDeluxe5.log

Einige Dateien in TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\Rita\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-01-10 18:07

==================== Ende von FRST.txt ============================
         

Mein Antivir lässt sich auch nicht mehr schließen.

Und deswegen haben wir ausführlichste Schritt für Schritt Anleitungen. Die musst du einfach nur mal lesen.
Addition.txt Logfile von FRST fehlt, bitte nachreichen.

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:10-01-2015 01
durchgeführt von Rita (2016-01-15 00:57:27)
Gestartet von C:\Users\Rita\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2011-11-17 20:34:44)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1742361689-1913123934-3667058463-500 - Administrator - Disabled)
Gast (S-1-5-21-1742361689-1913123934-3667058463-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-1742361689-1913123934-3667058463-1002 - Limited - Enabled)
Rita (S-1-5-21-1742361689-1913123934-3667058463-1000 - Administrator - Enabled) => C:\Users\Rita

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2008.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.2008.00 - CyberLink Corp.) Hidden
Acer Deep Sleep Settings (HKLM-x32\...\{86F3E556-83B1-47E5-A36B-560A521B999B}) (Version: 1.00.3008 - Acer Incorporated)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3007 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3502 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.3.0 - WildTangent)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3501 - Acer Incorporated)
Adobe Flash Player 20 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 20.0.0.270 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.04.000.98 - Atheros)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.15.129 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{eac7da46-2097-4dd4-80a6-8b67cbb2b23f}) (Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG) Hidden
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Benutzerhandbuch - Grundlagen EPSON XP-302 303 305 306 Series (HKLM-x32\...\EPSON XP-302 303 305 306 Series Bog) (Version:  - )
Benutzerhandbuch EPSON XP-302 303 305 306 Series (HKLM-x32\...\EPSON XP-302 303 305 306 Series Useg) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon MG2100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2100_series) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.02 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
clear.fi (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 1.0.2016.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1517_36458 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 1.0.2016.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.7709 - CyberLink Corp.) Hidden
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3500 - Acer Incorporated)
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\CopyTrans Suite) (Version: 4.002 - WindSolutions)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
Dropbox (HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
Druckerdeinstallation für EPSON XP-302 303 305 306 Series (HKLM\...\EPSON XP-302 303 305 306 Series) (Version:  - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{30E01116-5666-4807-8EF1-D80E9FF16717}) (Version: 2.3.2.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (HKLM-x32\...\{BECE9CCD-83F6-4BAA-9B26-227DF7D2E932}) (Version: 3.01.0000 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.5.00 - SEIKO EPSON CORPORATION)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.18.0 (HKLM-x32\...\{9602841E-ECE2-1019-AAEE-906A4DE25D6B}) (Version: 1.2.18.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2476 - Intel Corporation)
Intel(R) Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5D6) (Version: 1.0.0.1008 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.6.0.1002 - Intel Corporation)
iTunes (HKLM\...\{6CF1A7E2-8001-4870-9F18-3C6CDD6FE9E3}) (Version: 12.2.1.16 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.4 - Acer Inc.)
Luxor MahJong (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 43.0.4 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.4 (x86 en-US)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.4.5848 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
Netzwerkhandbuch EPSON XP-302 303 305 306 Series (HKLM-x32\...\EPSON XP-302 303 305 306 Series Netg) (Version:  - )
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Qualcomm Atheros Fast Reconnect (HKLM-x32\...\{5C20A342-085D-4000-B69D-492F3BA4BF94}) (Version: 1.0 - QualComm Atheros)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6433 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39013 - Realtek Semiconductor Corp.)
SecureW2 EAP Suite 2.0.2 for Windows (HKLM-x32\...\SecureW2 EAP Suite) (Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sleep Memory Optimizer (HKLM-x32\...\{34BE2594-1D20-4A2E-97A0-B9E2837520AE}) (Version: 1.00.3004 - Acer Incorporated)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Spotify (HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\Spotify) (Version: 1.0.10.107.gd0dfca3a - Spotify AB)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3503 - Acer Incorporated)
WildTangent Games App (x32 Version: 4.0.10.17 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Rita\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {018AB0DA-840C-4C25-BE41-8BA8730DFAD0} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000Core => C:\Users\Rita\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-23] (Dropbox, Inc.)
Task: {071F5276-4AE6-4181-91AF-54987D42E541} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-08-16] (Acer Incorporated)
Task: {149F7FFE-02DD-453B-9CE8-C209243BA4AE} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {272BEFC0-FB5D-42F2-9C54-61BB57869A54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-02] (Adobe Systems Incorporated)
Task: {2ED7FF84-1BD3-4445-8FB9-74BD34EEB143} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-20] (Google Inc.)
Task: {5A40E926-9E86-4B89-9CFD-B12311724371} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {5AEC89C2-2268-458F-AFE8-623CDF327A4B} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-08-16] (CyberLink Corp.)
Task: {6CDD20C1-ACCB-42DC-8780-375BA6FDA658} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {7A003CFE-F43B-44DB-8C91-D9FCED32C576} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000UA => C:\Users\Rita\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-23] (Dropbox, Inc.)
Task: {8CC31684-81C5-4DCE-8770-0EA7F3026BDD} - System32\Tasks\0 => Iexplore.exe  <==== ACHTUNG
Task: {95C60974-E9CC-41AD-B246-6A15A76396C0} - System32\Tasks\Adobe ARM => c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {A126BF89-E8CF-424C-AB72-D20E212AF7F7} - System32\Tasks\4581 => C:\Windows\system32\wscript.exe [2013-10-12] (Microsoft Corporation) <==== ACHTUNG
Task: {B13D4583-C470-4273-88EE-2DCBA6ACC37F} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-08-16] (CyberLink)
Task: {B28E0703-DCF4-4465-9E7F-81EFEE74E1A8} - System32\Tasks\Adobe Reader Speed Launcher => c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
Task: {D7C21627-F2E2-414F-844A-BBBB10F0B527} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {DD9F510C-95F4-499A-90C8-BAC5BC372FF4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask => start sppsvc
Task: {E5028441-BA86-4AE0-AA5A-5698E3A47405} - System32\Tasks\Acer Registration - Data Sending task => /DS
Task: {E78D4488-E0EF-452B-8DA6-5D453877EC7B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-20] (Google Inc.)
Task: {E7B7DBDC-8CC5-4FA3-A24D-8BFB51FB2BCD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {E9E92AE6-4720-415D-B8D5-9EACE5F6F244} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Acer Registration - Data Sending task.job => C:\Program Files (x86)\Acer\Registration\GREG.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000Core.job => C:\Users\Rita\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1742361689-1913123934-3667058463-1000UA.job => C:\Users\Rita\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

ShortcutWithArgument: C:\Users\Rita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413292980&from=cor&uid=HitachiXHTS543232A7A384_E20342432SBRRJ2SBRRJX
ShortcutWithArgument: C:\Users\Rita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413292980&from=cor&uid=HitachiXHTS543232A7A384_E20342432SBRRJ2SBRRJX

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2011-10-18 20:28 - 2011-08-09 16:44 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-05-15 15:26 - 2015-05-15 15:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 15:26 - 2015-05-15 15:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-16 10:23 - 2011-08-16 10:23 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2015-12-13 23:00 - 2015-10-31 01:59 - 00034768 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00022848 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\Crypto.Random.OSRNG.winrandom.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00023352 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\Crypto.Util._counter.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00042296 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\Crypto.Cipher._AES.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00116688 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-13 23:00 - 2015-10-31 01:59 - 00093640 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00018376 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00019760 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00105928 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32api.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00392144 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-13 23:00 - 2015-12-08 22:36 - 00381752 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00692688 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00020816 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00109520 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 01737032 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00020808 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00020800 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_cffi_python_x66cf7a7cx17a72769.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00021840 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00038696 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\fastpath.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00024528 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00020936 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00114640 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00021320 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00124880 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32file.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00030160 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00043472 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00175560 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00028616 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32ts.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00048592 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32service.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00024392 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00036296 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\librsync.dll
2015-12-13 23:00 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\win32profile.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00117056 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00023376 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00134608 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2015-12-13 23:00 - 2015-10-31 01:59 - 00134088 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00240584 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00020280 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00052024 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00021304 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\Crypto.Util.strxor.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00350152 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00084792 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2015-12-13 23:00 - 2015-12-08 22:36 - 01826608 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-13 23:00 - 2015-10-31 02:00 - 00083912 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\sip.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 03891504 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 01950000 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00519984 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00133936 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00225080 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00207672 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00024904 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00486704 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-12-13 23:00 - 2015-12-08 22:36 - 00357680 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-03-04 22:45 - 2015-10-31 02:01 - 00019920 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00786904 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-30 01:33 - 2015-10-31 02:00 - 00063448 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Rita\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Rita\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{B9763676-F7F9-4378-9A91-054F311CC609}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{DFAF0E79-574B-42C1-A799-7247516BE18D}] => (Allow) LPort=2869
FirewallRules: [{82A025BB-F353-47DE-A92F-D2CD6E1A8616}] => (Allow) LPort=1900
FirewallRules: [{36D3D67A-C593-49CA-B755-72F2EC752125}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{3797FE93-79A8-4D0E-A2C6-5FE6F07FE239}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{4724BD55-6C43-4CE6-99A5-75F18AFC5E25}] => (Allow) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
FirewallRules: [{A49B74F6-AA85-456E-926E-7177B330D7D9}] => (Allow) C:\Program Files (x86)\Acer\Acer VCM\VC.exe
FirewallRules: [{E9E97E45-0B37-4AE2-96DB-421B311453AB}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{EAFCA592-E301-43F5-B22C-D48F8321561F}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe
FirewallRules: [{F86611F1-3B00-4265-AC5C-8118DFE7757B}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
FirewallRules: [{890D807C-EDC3-4034-B196-12520B96AC87}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{1C19D03B-A6CD-4A7E-8A22-2354F02091E5}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
FirewallRules: [{7792EC86-2D21-429E-8741-BF51B172D5FD}] => (Allow) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
FirewallRules: [{558DAFE6-66E6-4998-BC54-02DD7D013E71}] => (Block) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
FirewallRules: [{F2838420-8772-4E11-A3DC-4E6E3225FCB7}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{4DABDF80-F643-4790-B9CD-BF27B3B3F561}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [TCP Query User{6E11296F-B952-4EF4-9155-0CA219510E72}C:\program files (x86)\thehunter\launcher\launcher.exe] => (Allow) C:\program files (x86)\thehunter\launcher\launcher.exe
FirewallRules: [UDP Query User{D92C9A62-8DCB-4A38-97EE-945FE59D7ED2}C:\program files (x86)\thehunter\launcher\launcher.exe] => (Allow) C:\program files (x86)\thehunter\launcher\launcher.exe
FirewallRules: [{C18E2515-CB5B-49FD-A8EC-EBBBAA2E6621}] => (Allow) D:\EPSON (D)\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [{618586FA-838A-45F5-9908-0E6E92D2B6DA}] => (Allow) D:\EPSON (D)\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [TCP Query User{26CB889D-C205-4710-B3A2-132FD027AE18}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{439A2BE6-79DA-494B-8E6B-66515E762C3C}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [TCP Query User{E304A438-69C1-43CF-99C6-1FD7D9326C5D}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{0D32AC94-9C03-41D7-AA6D-0F1B0A948118}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [{8C017751-EB56-40B1-B8DB-F520CF2AB312}] => (Allow) C:\Users\Rita\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{1CAFD797-20B0-4439-9CFB-61701AB3E9C5}] => (Allow) C:\Users\Rita\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{79D882E7-94B5-400E-B3E5-C23039268649}C:\users\rita\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\rita\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{984A9A7C-FC38-49B4-89FF-072E7144F28A}C:\users\rita\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\rita\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{C0E2A292-CB41-4381-A34E-4D80B28B2B19}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1DB6AA5F-9ACB-4455-A8AB-AE73D18EF9BB}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{0A82DD25-78F0-43FD-88C6-7A1A5A49C8FC}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{C14BB41C-10C1-446B-AC45-9A787E153FD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{592D1F47-0371-4D57-ADD1-1DB13E7D0780}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{61369C94-7DA2-4476-877D-71DF8A43DA42}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{9F423254-C6DD-4980-927B-07E9EC67A0E9}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{DEA5E925-D6E2-4EEE-B321-756B2C211C52}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AB5A67D1-D11C-4126-BBF9-9B2BAD1C9DF6}C:\users\rita\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\rita\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{34372691-03C8-4FD2-A7B7-B847426A19F7}C:\users\rita\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\rita\appdata\roaming\spotify\spotify.exe
FirewallRules: [{A91F04CC-8A0A-4FA7-BBDA-CCF188F39000}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C70B9005-DB60-4D8E-91B4-0E5F8606C022}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{54A439CD-3D8C-4CF6-8AE6-DFA721D557B5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5D0C2C1D-BF72-4B34-8DF4-46E118C80BDC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{71F92C31-5340-4280-8644-39325B2466E2}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{695164C4-8E4E-4440-936D-BE4020117183}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1090B2D3-CD99-435D-9BA6-A59C514FB304}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7C6CDE8D-1917-4DFF-B79C-A97C1C374D61}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Wiederherstellungspunkte =========================

29-12-2015 11:56:18 Windows Update
01-01-2016 13:23:54 Windows Update
06-01-2016 03:26:20 Windows Update
12-01-2016 08:42:18 Windows Update
14-01-2016 03:00:41 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/14/2016 11:43:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2016 04:29:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/13/2016 05:18:52 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Volume "PQSERVICE" wurde aufgrund eines Fehlers nicht defragmentiert: Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden. (0x8007045D)

Error: (01/12/2016 08:48:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8892

Error: (01/12/2016 08:48:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8892

Error: (01/12/2016 08:48:07 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/12/2016 08:48:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7878

Error: (01/12/2016 08:48:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7878

Error: (01/12/2016 08:48:06 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/12/2016 08:48:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6880


Systemfehler:
=============
Error: (01/15/2016 12:59:42 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WSearch erreicht.

Error: (01/15/2016 12:48:50 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.

Error: (01/15/2016 12:47:40 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WSearch erreicht.

Error: (01/15/2016 12:11:38 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WSearch erreicht.

Error: (01/14/2016 11:52:11 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Defender" wurde nicht richtig gestartet.

Error: (01/14/2016 11:49:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.

Error: (01/14/2016 11:48:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (01/14/2016 11:45:54 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (01/14/2016 11:45:16 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Sleep memory optimizer" wurde nicht richtig gestartet.

Error: (01/14/2016 11:43:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.


CodeIntegrity:
===================================
  Date: 2015-07-23 16:53:51.050
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 16:53:50.979
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:39:51.108
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:39:50.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:31:54.259
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:31:54.063
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:31:46.651
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:31:46.520
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:28:49.766
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-23 15:28:49.645
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i5-2467M CPU @ 1.60GHz
Prozentuale Nutzung des RAM: 59%
Installierter physikalischer RAM: 3946.19 MB
Verfügbarer physikalischer RAM: 1588.13 MB
Summe virtueller Speicher: 7890.59 MB
Verfügbarer virtueller Speicher: 5208.89 MB

==================== Laufwerke ================================

Drive c: (ACER) (Fixed) (Total:282.85 GB) (Free:175.03 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: C8E1B1F0)
Partition 1: (Not Active) - (Size=15.1 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=282.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 18.6 GB) (Disk ID: C8E1B1DE)
Partition 1: (Not Active) - (Size=18.6 GB) - (Type=84)

==================== Ende von Addition.txt ============================
         

Avira bitte deinstallieren. Das Teil empfehlen wir schon lange nicht mehr, aus mehreren Gründen. Wenn wir hier durch sind, kannst du ein anderes AV installieren. Gib Bescheid wenn Avira weg ist.

Hab ich gestern abend schon deinstaliert. malewarebyte ist drauf.

Dann poste bitte die Logs von malwarebytes...

War verkehrter Bericht, von 2015 irgendwann, sry

<?xml version="1.0" encoding="UTF-8"?>

-<logs>

<record toVersion="2016.1.14.1" name="Remediation Database" last_modified_tag="d6b41b00-7b63-446c-a53e-d8d9d20b35f4" fromVersion="2015.9.16.1" systemname="RITA-PC" username="SYSTEM" type="Update" source="Manual" datetime="2016-01-15T01:26:02.681491+01:00" LoggingEventType="1" severity="debug"/>

<record toVersion="2016.1.13.2" name="IP Database" last_modified_tag="0a56158e-4e4f-4ae6-8be6-d73a26bcb9ba" fromVersion="2015.9.21.2" systemname="RITA-PC" username="SYSTEM" type="Update" source="Manual" datetime="2016-01-15T01:26:02.962292+01:00" LoggingEventType="1" severity="debug"/>

<record toVersion="2016.1.9.1" name="Rootkit Database" last_modified_tag="1fc59996-71b9-4141-8c1b-1109bc2ce19f" fromVersion="2015.9.18.1" systemname="RITA-PC" username="SYSTEM" type="Update" source="Manual" datetime="2016-01-15T01:26:03.211892+01:00" LoggingEventType="1" severity="debug"/>

<record toVersion="2016.1.13.4" name="Domain Database" last_modified_tag="dafc9b64-54fa-4da7-a077-0cec4ba0855d" fromVersion="2015.9.22.3" systemname="RITA-PC" username="SYSTEM" type="Update" source="Manual" datetime="2016-01-15T01:26:03.523893+01:00" LoggingEventType="1" severity="debug"/>

<record toVersion="2016.1.14.7" name="Malware Database" last_modified_tag="36ee0f38-e8c2-4948-af81-449b646683de" fromVersion="2015.9.22.5" systemname="RITA-PC" username="SYSTEM" type="Update" source="Manual" datetime="2016-01-15T01:26:22.010925+01:00" LoggingEventType="1" severity="debug"/>

<record last_modified_tag="573dbdfa-407d-43f5-9d0c-0d4d694a3a3d" systemname="RITA-PC" username="SYSTEM" type="Scan" source="Manual" datetime="2016-01-15T02:51:32.422813+01:00" LoggingEventType="6" severity="debug" starttime="2016-01-15T02:11:05+01:00" scantype="threat" scanresult="completed" nonmalwaredetections="56" malwaredetections="0" duration="2401"/>

</logs>
         

Jetzt ist der Richige gepostet, ist aktuell.

Bitte schau richtig im Verlauf nach. Ich will Suchlaufprotokolle sehen, keine Schutzprotokolle.

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2016/01/15 02:11:05 +0100</date>

<logfile>mbam-log-2016-01-15 (02-11-00).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.2.0.1024</version>

<malware-database>v2016.01.14.07</malware-database>

<rootkit-database>v2016.01.09.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


+<system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>417479</objects>

<time>2401</time>

<processes>0</processes>

<modules>0</modules>

<keys>1</keys>

<values>4</values>

<datas>0</datas>

<folders>9</folders>

<files>42</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<key>

<path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect</path>

<vendor>PUP.Optional.WindowsMangerProtect</vendor>

<action>success</action>

<hash>a2ed5bde34651a1c598b8163887bc13f</hash>

</key>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path>

<valuename/>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata/>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path>

<valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata>썛愘ᇜ犜ጀ유䞘</valuedata>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path>

<valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata>썛愘ᇜ犜ጀ유䞘</valuedata>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path>

<valuename/>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata/>

<hash>6e214cedd9c0fb3bb07afb7fd62c9f61</hash>

</value>


-<folder>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</folder>


-<folder>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Cache</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>f29d1b1e8a0f59dd3193b0ffba47f709</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6\WebCompanionInstaller.exe</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</file>


-<file>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences\babylon.js</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7dbb40f3-8fff-4b54-bb41-36c0708e1179.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stba0d61cad-47b7-47c6-a5f7-635cd97eac5b.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb00aa3390-47f8-4c5e-8ba5-28babbcb23b0.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb0d901f11-9779-4936-8ce7-303ce362a310.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb10de11f7-1480-46d0-b630-9a96508cca96.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb19703a5b-29d3-4c70-9c0b-14352d32f908.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb1e97a1a6-2a70-4866-9c8f-30cb85cc7a43.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb20f129ad-9274-4758-bea0-fec4037e9ec3.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb377751a9-ea4d-4931-a662-50a6786cfca5.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb37e00add-e28d-4dcd-811a-68669d890bf3.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3bdc4dcb-15c4-4ac6-af6e-c7e6f2c84c9d.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3ca94911-e8c2-4e21-a67f-f6d5e13243c1.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb55b0c63f-bb8b-4b5c-a474-31c77100c8ac.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb65233b98-2e27-409a-bdc5-6cfb9cd5c221.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb714ce5eb-5cc7-4bcd-938c-1b88ff695954.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7276ad7e-b32d-4189-a1c5-caa3f6d90cf2.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7e8a7462-8094-414d-b94e-5357b03597bc.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7f9e4a21-1f09-4644-8943-468f237dbd50.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb81ba1292-1861-408a-a044-f7dbb2bcfe71.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb8892467d-aa35-451f-98f5-ef5c1ed4d44f.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb93554ccb-8e23-4179-9c1e-a6015b90f3e1.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9a237b3d-1789-4149-9b7a-8145754f0221.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9acfb910-5ac0-4dc6-ae0c-124e402755fe.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9b37ddc9-5779-40c8-9169-9079f06d4bf2.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbaf147216-93a4-42f0-9637-52f402910c0e.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb0a94833-cd21-46be-aae9-287f2d7cbbc7.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb45e1769-da93-4522-9889-c537b69f5b69.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbc4868c35-f2a5-4712-9419-aaf0195e439f.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbdf237d46-498f-462f-a763-05183175db9b.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbeefe833c-13f4-4d69-b569-bc387b832c1c.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf0b1b85e-a11c-4f33-9d19-59cee7f7f4a5.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf56ec6ed-16c8-416d-8255-e6278943deab.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbfea00b56-6339-4d52-8325-fefe8f737dbb.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\askcom.xml</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>e9a650e9782195a156a5528960a4827e</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\lhjhzhcg.default\user.js</path>

<vendor>PUM.Optional.FireFoxSearchOverride</vendor>

<action>success</action>

<hash>3857c3769009b383966da03d8e7641bf</hash>

</file>

</items>

</mbam-log>
         

Poste das doch bitte im TXT Format....XML kann doch keine Sau richtig lesen

<?xml version="1.0" encoding="UTF-16"?>
<mbam-log><header><date>2016/01/15 02:11:05 +0100</date><logfile>mbam-log-2016-01-15 (02-11-00).xml</logfile><isadmin>yes</isadmin></header><engine><version>2.2.0.1024</version><malware-database>v2016.01.14.07</malware-database><rootkit-database>v2016.01.09.01</rootkit-database><license>free</license><file-protection>disabled</file-protection><web-protection>disabled</web-protection><self-protection>disabled</self-protection></engine><system><hostname>RITA-PC</hostname><ip>192.168.179.50</ip><osversion>Windows 7 Service Pack 1</osversion><arch>x64</arch><username>Rita</username><filesys>NTFS</filesys></system><summary><type>threat</type><result>completed</result><objects>417479</objects><time>2401</time><processes>0</processes><modules>0</modules><keys>1</keys><values>4</values><datas>0</datas><folders>9</folders><files>42</files><sectors>0</sectors></summary><options><memory>enabled</memory><startup>enabled</startup><filesystem>enabled</filesystem><archives>enabled</archives><rootkits>disabled</rootkits><deeprootkit>disabled</deeprootkit><heuristics>enabled</heuristics><pup>enabled</pup><pum>enabled</pum></options><items><key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect</path><vendor>PUP.Optional.WindowsMangerProtect</vendor><action>success</action><hash>a2ed5bde34651a1c598b8163887bc13f</hash></key><value><path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path><valuename/><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata/><hash>3f501e1b6930dd599b8f3a4009f9b749</hash></value><value><path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata>썛愘ᇜ犜ጀ유䞘</valuedata><hash>3f501e1b6930dd599b8f3a4009f9b749</hash></value><value><path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata>썛愘ᇜ犜ጀ유䞘</valuedata><hash>3f501e1b6930dd599b8f3a4009f9b749</hash></value><value><path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path><valuename/><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata/><hash>6e214cedd9c0fb3bb07afb7fd62c9f61</hash></value><folder><path>C:\Users\Rita\AppData\Roaming\OpenCandy</path><vendor>PUP.Optional.OpenCandy</vendor><action>success</action><hash>216ec772990052e458221f725da557a9</hash></folder><folder><path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6</path><vendor>PUP.Optional.OpenCandy</vendor><action>success</action><hash>216ec772990052e458221f725da557a9</hash></folder><folder><path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com</path><vendor>PUP.Optional.Babylon</vendor><action>success</action><hash>602f74c51584ac8a5cba35679e6438c8</hash></folder><folder><path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults</path><vendor>PUP.Optional.Babylon</vendor><action>success</action><hash>602f74c51584ac8a5cba35679e6438c8</hash></folder><folder><path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences</path><vendor>PUP.Optional.Babylon</vendor><action>success</action><hash>602f74c51584ac8a5cba35679e6438c8</hash></folder><folder><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></folder><folder><path>C:\ProgramData\Tarma Installer</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></folder><folder><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></folder><folder><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Cache</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></folder><file><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>f29d1b1e8a0f59dd3193b0ffba47f709</hash></file><file><path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6\WebCompanionInstaller.exe</path><vendor>PUP.Optional.OpenCandy</vendor><action>success</action><hash>216ec772990052e458221f725da557a9</hash></file><file><path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences\babylon.js</path><vendor>PUP.Optional.Babylon</vendor><action>success</action><hash>602f74c51584ac8a5cba35679e6438c8</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7dbb40f3-8fff-4b54-bb41-36c0708e1179.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stba0d61cad-47b7-47c6-a5f7-635cd97eac5b.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb00aa3390-47f8-4c5e-8ba5-28babbcb23b0.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb0d901f11-9779-4936-8ce7-303ce362a310.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb10de11f7-1480-46d0-b630-9a96508cca96.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb19703a5b-29d3-4c70-9c0b-14352d32f908.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb1e97a1a6-2a70-4866-9c8f-30cb85cc7a43.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb20f129ad-9274-4758-bea0-fec4037e9ec3.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb377751a9-ea4d-4931-a662-50a6786cfca5.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb37e00add-e28d-4dcd-811a-68669d890bf3.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3bdc4dcb-15c4-4ac6-af6e-c7e6f2c84c9d.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3ca94911-e8c2-4e21-a67f-f6d5e13243c1.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb55b0c63f-bb8b-4b5c-a474-31c77100c8ac.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb65233b98-2e27-409a-bdc5-6cfb9cd5c221.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb714ce5eb-5cc7-4bcd-938c-1b88ff695954.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7276ad7e-b32d-4189-a1c5-caa3f6d90cf2.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7e8a7462-8094-414d-b94e-5357b03597bc.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7f9e4a21-1f09-4644-8943-468f237dbd50.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb81ba1292-1861-408a-a044-f7dbb2bcfe71.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb8892467d-aa35-451f-98f5-ef5c1ed4d44f.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb93554ccb-8e23-4179-9c1e-a6015b90f3e1.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9a237b3d-1789-4149-9b7a-8145754f0221.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9acfb910-5ac0-4dc6-ae0c-124e402755fe.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9b37ddc9-5779-40c8-9169-9079f06d4bf2.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbaf147216-93a4-42f0-9637-52f402910c0e.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb0a94833-cd21-46be-aae9-287f2d7cbbc7.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb45e1769-da93-4522-9889-c537b69f5b69.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbc4868c35-f2a5-4712-9419-aaf0195e439f.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbdf237d46-498f-462f-a763-05183175db9b.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbeefe833c-13f4-4d69-b569-bc387b832c1c.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf0b1b85e-a11c-4f33-9d19-59cee7f7f4a5.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf56ec6ed-16c8-416d-8255-e6278943deab.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbfea00b56-6339-4d52-8325-fefe8f737dbb.log</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>aae528114752e74f165cffc7c0428c74</hash></file><file><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></file><file><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></file><file><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></file><file><path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll</path><vendor>PUP.Optional.Yontoo</vendor><action>success</action><hash>86096ccd4653989eaf739236c141738d</hash></file><file><path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\askcom.xml</path><vendor>PUP.Optional.ASK.Gen</vendor><action>success</action><hash>e9a650e9782195a156a5528960a4827e</hash></file><file><path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\lhjhzhcg.default\user.js</path><vendor>PUM.Optional.FireFoxSearchOverride</vendor><action>success</action><hash>3857c3769009b383966da03d8e7641bf</hash></file></items></mbam-log>
         

So ist es auch nicht richtig, sry, ich versuch es wieter

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2016/01/15 02:11:05 +0100</date>

<logfile>mbam-log-2016-01-15 (02-11-00).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.2.0.1024</version>

<malware-database>v2016.01.14.07</malware-database>

<rootkit-database>v2016.01.09.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<hostname>RITA-PC</hostname>

<ip>192.168.179.50</ip>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>Rita</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>417479</objects>

<time>2401</time>

<processes>0</processes>

<modules>0</modules>

<keys>1</keys>

<values>4</values>

<datas>0</datas>

<folders>9</folders>

<files>42</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<key>

<path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect</path>

<vendor>PUP.Optional.WindowsMangerProtect</vendor>

<action>success</action>

<hash>a2ed5bde34651a1c598b8163887bc13f</hash>

</key>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path>

<valuename/>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata/>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path>

<valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata>썛愘ᇜ犜ጀ유䞘</valuedata>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path>

<valuename>{EEE6C35B-6118-11DC-9C72-001320C79847}</valuename>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata>썛愘ᇜ犜ጀ유䞘</valuedata>

<hash>3f501e1b6930dd599b8f3a4009f9b749</hash>

</value>


-<value>

<path>HKU\S-1-5-21-1742361689-1913123934-3667058463-501\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{EEE6C35B-6118-11DC-9C72-001320C79847}</path>

<valuename/>

<vendor>PUP.Optional.SweetPacks</vendor>

<action>success</action>

<valuedata/>

<hash>6e214cedd9c0fb3bb07afb7fd62c9f61</hash>

</value>


-<folder>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</folder>


-<folder>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</folder>


-<folder>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<folder>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Cache</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</folder>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>f29d1b1e8a0f59dd3193b0ffba47f709</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\OpenCandy\269FAB49ED1F4B0E8434553172BB8DC6\WebCompanionInstaller.exe</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>216ec772990052e458221f725da557a9</hash>

</file>


-<file>

<path>C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences\babylon.js</path>

<vendor>PUP.Optional.Babylon</vendor>

<action>success</action>

<hash>602f74c51584ac8a5cba35679e6438c8</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7dbb40f3-8fff-4b54-bb41-36c0708e1179.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stba0d61cad-47b7-47c6-a5f7-635cd97eac5b.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb00aa3390-47f8-4c5e-8ba5-28babbcb23b0.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb0d901f11-9779-4936-8ce7-303ce362a310.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb10de11f7-1480-46d0-b630-9a96508cca96.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb19703a5b-29d3-4c70-9c0b-14352d32f908.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb1e97a1a6-2a70-4866-9c8f-30cb85cc7a43.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb20f129ad-9274-4758-bea0-fec4037e9ec3.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb377751a9-ea4d-4931-a662-50a6786cfca5.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb37e00add-e28d-4dcd-811a-68669d890bf3.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3bdc4dcb-15c4-4ac6-af6e-c7e6f2c84c9d.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb3ca94911-e8c2-4e21-a67f-f6d5e13243c1.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb55b0c63f-bb8b-4b5c-a474-31c77100c8ac.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb65233b98-2e27-409a-bdc5-6cfb9cd5c221.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb714ce5eb-5cc7-4bcd-938c-1b88ff695954.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7276ad7e-b32d-4189-a1c5-caa3f6d90cf2.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7e8a7462-8094-414d-b94e-5357b03597bc.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb7f9e4a21-1f09-4644-8943-468f237dbd50.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb81ba1292-1861-408a-a044-f7dbb2bcfe71.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb8892467d-aa35-451f-98f5-ef5c1ed4d44f.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb93554ccb-8e23-4179-9c1e-a6015b90f3e1.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9a237b3d-1789-4149-9b7a-8145754f0221.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9acfb910-5ac0-4dc6-ae0c-124e402755fe.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stb9b37ddc9-5779-40c8-9169-9079f06d4bf2.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbaf147216-93a4-42f0-9637-52f402910c0e.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb0a94833-cd21-46be-aae9-287f2d7cbbc7.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbb45e1769-da93-4522-9889-c537b69f5b69.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbc4868c35-f2a5-4712-9419-aaf0195e439f.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbdf237d46-498f-462f-a763-05183175db9b.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbeefe833c-13f4-4d69-b569-bc387b832c1c.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf0b1b85e-a11c-4f33-9d19-59cee7f7f4a5.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbf56ec6ed-16c8-416d-8255-e6278943deab.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\Users\Gast\AppData\Local\Temp\APN-Stub\Stbfea00b56-6339-4d52-8325-fefe8f737dbb.log</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>aae528114752e74f165cffc7c0428c74</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll</path>

<vendor>PUP.Optional.Yontoo</vendor>

<action>success</action>

<hash>86096ccd4653989eaf739236c141738d</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\2eoigkly.default\searchplugins\askcom.xml</path>

<vendor>PUP.Optional.ASK.Gen</vendor>

<action>success</action>

<hash>e9a650e9782195a156a5528960a4827e</hash>

</file>


-<file>

<path>C:\Users\Rita\AppData\Roaming\Mozilla\Firefox\Profiles\lhjhzhcg.default\user.js</path>

<vendor>PUM.Optional.FireFoxSearchOverride</vendor>

<action>success</action>

<hash>3857c3769009b383966da03d8e7641bf</hash>

</file>

</items>

</mbam-log>
         

Ich hoffe, dass es das jetzt ist.

Was ist denn daran soo schwierig ein Log nach TXT zu exportieren??

Malwarebytes Anti-Malware Logfile finden - Anleitungen

Frag nicht, bitte, ich versteh echt nur Bahnhof, weil ich Fee, du PC Profi.

Ist es denn jetzt richtig, ich weiß es echt nicht!?