| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Sobald ich Browser öffne und ich klicke öffnen sich Werbe SeitenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.06.2016, 19:51
| #1 |
| |  Sobald ich Browser öffne und ich klicke öffnen sich Werbe Seiten Hallo liebe Community, ich benutze mehrere Browser wie Opera, Mozilla Firefox aber ich habe festgestellt das egal bei welchem Browser, ist bei allem das gleiche Problem und zwar ich öffne z.B. Opera und gehe auf einer ganz normalen Seite und sobald ich mehrmals klicke öffnen sich neue Tabs oder neue Fenster und die führen mich zu Gewinnspielen z.B. zu einem Windows Gewinnspiel wo man iPhone 6S, PlayStation 4 oder Samsung Galaxy S6 gewinnen kann. Wo ich natürlich nichts gemacht habe oder ich gebe da auch nichts ein. Was meint ihr wie sich dies beheben lässt? weil das ist sehr nervig! Ich habe Avast Internet Security installiert und der findet nichts. Ich hoffe ihr könnt mir helfen. Ich habe mal ein Screenshot gemacht FRST: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:10-06-2016
durchgeführt von VieTru (Administrator) auf VIETZTRUMME (11-06-2016 21:00:31)
Gestartet von C:\Users\VieTru\AppData\Local\Temp\scoped_dir6276_571
Geladene Profile: VieTru & UpdatusUser (Verfügbare Profile: VieTru & UpdatusUser & Gaby & Maxi & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
( ) C:\Windows\System32\lxdncoms.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Akamai Technologies, Inc.) C:\Users\VieTru\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\VieTru\AppData\Local\Akamai\netsession_win.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\38.0.2220.29\opera.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11855976 2011-05-18] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2787264 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-23] (AVAST Software)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [883352 2015-12-14] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [gmsd_de_005010201] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-04-30] (Valve Corporation)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [MyComGames] => C:\Users\VieTru\AppData\Local\MyComGames\MyComGames.exe [4776304 2016-02-05] (MY.COM B.V.)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [Spotify] => C:\Users\VieTru\AppData\Roaming\Spotify\Spotify.exe [6855280 2016-04-16] (Spotify Ltd)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [Akamai NetSession Interface] => C:\Users\VieTru\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [Spotify Web Helper] => C:\Users\VieTru\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1525360 2016-04-16] (Spotify Ltd)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8813784 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\RunOnce: [Uninstall C:\Users\VieTru\AppData\Local\Microsoft\OneDrive\17.3.6302.0225_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\VieTru\AppData\Local\Microsoft\OneDrive\17.3.6302.0225_1\amd64"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [31744 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-10-30] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => Keine Datei
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => Keine Datei
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => Keine Datei
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-02-06] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => Keine Datei
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => Keine Datei
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => Keine Datei
Startup: C:\Users\Gaby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FacebookGamesNotifier.exe.lnk [2016-05-23]
ShortcutTarget: FacebookGamesNotifier.exe.lnk -> C:\Users\VieTru\AppData\Local\Facebook\Games\FacebookGamesNotifier.exe (Keine Datei)
Startup: C:\Users\VieTru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nettalk.lnk [2016-04-30]
ShortcutTarget: Nettalk.lnk -> C:\Program Files (x86)\Nettalk6\Nettalk.exe (Nicolas Kruse)
GroupPolicy: Beschränkung - Chrome <======= ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
AutoConfigURL: [S-1-5-21-1002986252-3489396405-3818812170-1000] => hxxp://unstopp.me/wpad.dat?43db5b7aabca08535f1a37b8cf373abf3973379
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{63bb2da8-95ba-4904-81fa-723aa74a1b03}: [DhcpNameServer] 192.168.0.1
ManualProxies: 0hxxp://unstopp.me/wpad.dat?43db5b7aabca08535f1a37b8cf373abf3973379
Internet Explorer:
==================
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> {01FF7EA4-FAE9-4A54-A0EB-2AC5FE0D568C} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> {A399F91B-0578-4A6D-A436-0E95AA59329E} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> {B3C0985D-591E-4E53-9D4B-383BA45405C5} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
SearchScopes: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> {C5A8B6B2-9506-4EB0-8598-22F2DC7EF121} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> {E85BB2BD-5962-4CED-BE64-7446A57BED95} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_77\bin\ssv.dll [2016-04-12] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-02-06] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-12] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-12] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-06] (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-12] (Oracle Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000 -> hxxp://go.web.de/tb/ie_startpage
FireFox:
========
FF ProfilePath: C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: hxxp://google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-13] ()
FF Plugin: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-12] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-06-08] (Unity Technologies ApS)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-13] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-12] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-06-03] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-06-03] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1002986252-3489396405-3818812170-1000: @my.com/Games -> C:\Users\VieTru\AppData\Local\MyComGames\NPMyComDetector.dll [2016-02-04] (MY.COM B.V.)
FF Plugin HKU\S-1-5-21-1002986252-3489396405-3818812170-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\VieTru\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-17] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default\user.js [2016-01-09]
FF SearchPlugin: C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default\searchplugins\yoursearching.xml [2016-01-09]
FF Extension: Webtrust Checker - C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default\Extensions\{1082eb84-f0f2-11e5-8e18-9bb85ab7992e}.xpi [2016-04-29]
FF Extension: ChatZilla - C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2016-04-20]
FF Extension: New Tab by Yahoo - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\jid1-G80Ec8LLEbK5fQ@jetpack.xpi [2016-01-07]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-06]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-02-06]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\VieTru\AppData\Roaming\Mozilla\Firefox\Profiles\g40ohhdf.default\extensions\deskCutv2@gmail.com => nicht gefunden
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter2\FirefoxAddOns\netsight@nielsen.xpi => nicht gefunden
Chrome:
=======
CHR Profile: C:\Users\VieTru\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2016-02-06]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-06]
CHR HKLM-x32\...\Chrome\Extension: [kpdmjodecdegfglgaapafjleomjjlpnh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [npdicihegicnhaangkdmcgbjceoemeoo] - hxxps://clients2.google.com/service/update2/crx
Opera:
=======
OPR Session Restore: -> ist aktiviert.
OPR Extension: (YouTube Unblocker) - C:\Users\VieTru\AppData\Roaming\Opera Software\Opera Stable\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2015-07-18]
OPR Extension: (Adblock Plus) - C:\Users\VieTru\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2016-06-02]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-06] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [119128 2016-02-06] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [5570120 2016-02-06] (Avast Software)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [432792 2015-12-14] (BlueStack Systems, Inc.)
S3 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [412312 2015-12-14] (BlueStack Systems, Inc.)
S3 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [854680 2015-12-14] (BlueStack Systems, Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163200 2016-01-12] (NVIDIA Corporation)
R2 lxdn_device; C:\WINDOWS\system32\lxdncoms.exe [1039872 2015-09-15] ( )
S3 npggsvc; C:\WINDOWS\SysWOW64\GameMon.des [3527432 2015-08-25] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-01-12] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6308288 2016-01-12] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [4812736 2016-01-12] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AsrDrv101; C:\WINDOWS\SysWOW64\Drivers\AsrDrv101.sys [22280 2015-12-26] (ASRock Incorporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-06] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-02-06] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-03-09] (AVAST Software)
R1 aswNetSec; C:\Windows\system32\drivers\aswNetSec.sys [552880 2016-02-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-06] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-03-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-23] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-10] (AVAST Software)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146016 2015-12-14] (BlueStack Systems)
S3 FairplayKD; C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [70928 2016-06-11] (Multi Theft Auto)
S3 ggsomc; C:\Windows\System32\drivers\ggsomc.sys [30424 2015-08-23] (Sony Mobile Communications)
R0 ngvss; C:\Windows\System32\Drivers\ngvss.sys [154024 2016-02-06] (AVAST Software)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-01-12] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [310904 2016-02-06] (Avast Software)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [35880 2016-01-01] (Wellbia.com Co., Ltd.)
S3 AppObserver; \??\C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter2\appobserver64.sys [X]
U3 idsvc; kein ImagePath
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-11 21:00 - 2016-06-11 21:00 - 02385408 _____ (Farbar) C:\Users\VieTru\Desktop\FRST64.exe
2016-06-11 21:00 - 2016-06-11 21:00 - 00000000 ____D C:\FRST
2016-06-11 20:59 - 2016-06-11 20:59 - 01735680 _____ (Farbar) C:\Users\VieTru\Desktop\FRST.exe
2016-06-11 20:51 - 2016-06-11 20:51 - 03677248 _____ C:\Users\VieTru\Desktop\AdwCleaner_5.119.exe
2016-06-11 20:21 - 2016-06-11 20:21 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-06-11 20:21 - 2016-06-03 05:28 - 00111552 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2016-06-11 20:21 - 2016-05-04 04:23 - 00129824 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2016-06-11 20:21 - 2016-05-04 04:22 - 00130848 _____ C:\WINDOWS\system32\vulkan-1.dll
2016-06-11 20:21 - 2016-05-04 04:22 - 00045344 _____ C:\WINDOWS\system32\vulkaninfo.exe
2016-06-11 20:21 - 2016-05-04 04:22 - 00040224 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2016-06-11 20:20 - 2016-06-03 09:22 - 00213952 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2016-06-11 20:20 - 2016-06-03 05:59 - 00534072 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2016-06-11 20:20 - 2016-06-03 05:59 - 00081856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 39977920 _____ C:\WINDOWS\system32\nvcompiler.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 35115968 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 31641656 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 25404864 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 21812056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 21355464 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 18151128 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 17746664 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 17729184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 17432544 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 10643240 _____ C:\WINDOWS\system32\nvptxJitCompiler.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 08733792 _____ C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 02844608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 02470336 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 01920960 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436839.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 01581624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 01571776 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436839.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00983488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00910392 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00787384 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00769984 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00707520 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00669952 _____ C:\WINDOWS\system32\nvfatbinaryLoader.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00632848 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00565208 _____ C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00549240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00452616 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00425016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00385592 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00379808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00379448 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00348216 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00316632 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00177952 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00155768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00153232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00131584 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00046024 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
2016-06-11 20:18 - 2016-06-03 09:22 - 00000594 _____ C:\WINDOWS\SysWOW64\nv-vk32.json
2016-06-11 20:18 - 2016-06-03 09:22 - 00000594 _____ C:\WINDOWS\system32\nv-vk64.json
2016-06-11 20:09 - 2016-06-11 20:21 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2016-06-11 20:09 - 2016-01-12 06:40 - 00112032 _____ C:\WINDOWS\system32\NvRtmpStreamer64.dll
2016-06-11 20:09 - 2015-12-18 08:10 - 00099472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2016-06-11 20:09 - 2015-12-18 08:10 - 00090768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2016-06-11 19:52 - 2016-06-11 19:52 - 00000000 ____D C:\ProgramData\USOShared
2016-06-11 19:52 - 2016-06-11 19:52 - 00000000 ____D C:\ProgramData\USOPrivate
2016-06-11 11:22 - 2016-06-11 11:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cultures [GOG.com]
2016-06-11 09:22 - 2016-06-11 09:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cultures 2 [GOG.com]
2016-06-11 09:21 - 2016-06-11 11:22 - 00000000 ____D C:\GOG Games
2016-06-09 11:41 - 2016-06-09 11:41 - 00199635 _____ C:\Users\Gaby\Downloads\Dokument.pdf
2016-06-09 11:24 - 2016-06-09 11:24 - 00214632 _____ C:\Users\Gaby\Documents\LidlBestellung09062016.pdf
2016-06-08 22:37 - 2016-06-08 22:37 - 00008793 _____ C:\Users\Gaby\Downloads\anzeigen.pdf
2016-05-28 10:42 - 2016-06-01 08:55 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Notepad++
2016-05-28 08:23 - 2016-05-28 10:51 - 00001087 _____ C:\Users\Public\Desktop\Common.lnk
2016-05-28 08:18 - 2016-05-28 10:51 - 00000000 ____D C:\Program Files (x86)\Yu-Gi-Oh! Power Chaos common
2016-05-28 08:03 - 2016-05-28 08:03 - 00000000 ____D C:\Users\VieTru\Downloads\Yu-Gi-Oh! Power of Chaos Common
2016-05-28 08:01 - 2011-11-29 23:33 - 00000000 ____D C:\Users\VieTru\Downloads\Yu-Gi-Oh! Power of Chaos LEGEND REBORN
2016-05-26 09:10 - 2016-05-26 09:10 - 00212608 _____ C:\Users\Gaby\Downloads\BewerbungsbogenPostBriefBremen.pdf
2016-05-26 09:10 - 2016-05-26 09:10 - 00023459 _____ C:\Users\Gaby\Downloads\Bewerberbogen Bremerhaven.ods
2016-05-26 08:49 - 2016-05-26 08:49 - 00212608 ____T C:\Users\Gaby\Documents\BewerbungsbogenPostBriefBremen.pdf
2016-05-26 08:38 - 2016-05-26 08:38 - 00015952 _____ C:\Users\Gaby\Downloads\Bewerberbogen Bremerhaven.xlsx
2016-05-23 21:58 - 2016-05-23 21:58 - 00000000 ____D C:\Users\Gaby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
2016-05-21 16:15 - 2016-05-21 16:15 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-05-21 13:54 - 2015-10-17 23:12 - 00000000 ____D C:\Users\VieTru\Desktop\Yu-Gi-Oh! Legacy of the Duelist
2016-05-17 00:22 - 2016-05-17 00:22 - 00002233 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2016-05-13 20:53 - 2016-05-13 20:53 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Game Matter
2016-05-13 20:53 - 2016-05-13 20:53 - 00000000 ____D C:\Users\VieTru\AppData\Local\Game Matter
2016-05-13 20:53 - 2016-05-13 20:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Duel Revolution
2016-05-13 20:53 - 2016-05-13 20:53 - 00000000 ____D C:\Program Files (x86)\Duel Revolution
2016-05-12 19:54 - 2016-05-12 19:54 - 09907020 _____ C:\Users\Gaby\Downloads\gutznsus2008-00.pdf
2016-05-12 19:22 - 2016-05-23 21:58 - 00001249 _____ C:\Users\Gaby\Desktop\Facebook Games Arcade (BETA).lnk
2016-05-12 19:22 - 2016-05-12 19:22 - 00000000 ____D C:\Users\Gaby\AppData\Local\FacebookGames
2016-05-12 19:22 - 2016-05-12 19:22 - 00000000 ____D C:\Users\Gaby\AppData\Local\Facebook
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-11 20:45 - 2015-08-21 00:13 - 00001142 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-11 20:36 - 2015-08-09 03:19 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-06-11 20:31 - 2015-07-17 20:57 - 00001115 _____ C:\Users\Public\Desktop\Opera.lnk
2016-06-11 20:27 - 2015-08-21 00:13 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-11 20:25 - 2015-07-18 11:58 - 00000946 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-06-11 20:24 - 2016-04-13 08:03 - 00000000 ____D C:\Users\VieTru
2016-06-11 20:23 - 2016-04-13 08:00 - 00000000 ____D C:\ProgramData\NVIDIA
2016-06-11 20:23 - 2016-02-13 19:26 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-06-11 20:23 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-06-11 20:23 - 2015-07-17 21:09 - 00000000 ____D C:\Program Files\WinRAR
2016-06-11 20:21 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-06-11 20:21 - 2015-07-17 20:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-06-11 20:20 - 2016-04-13 07:59 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-06-11 20:09 - 2016-04-13 08:00 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-06-11 20:09 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-06-11 20:09 - 2015-07-17 23:13 - 00001454 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2016-06-11 20:09 - 2015-07-17 23:12 - 00000000 ____D C:\Users\VieTru\AppData\Local\NVIDIA
2016-06-11 20:07 - 2015-07-17 21:09 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-06-11 20:07 - 2015-07-17 21:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-06-11 20:00 - 2015-07-17 21:09 - 00001143 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-06-11 19:42 - 2015-11-07 19:14 - 00000000 ____D C:\Users\VieTru\Desktop\Musik
2016-06-11 19:37 - 2016-04-13 08:03 - 00000000 ____D C:\Users\Gaby
2016-06-11 19:31 - 2016-02-07 02:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RBTeam
2016-06-11 19:29 - 2015-10-23 01:08 - 00000000 ____D C:\Users\VieTru\AppData\Local\Glyph
2016-06-11 19:29 - 2015-10-23 01:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glyph
2016-06-11 19:18 - 2015-08-04 14:52 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D78635EC-7877-40C4-89B9-7563979F2C86}
2016-06-11 19:15 - 2016-04-30 13:34 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Nettalk
2016-06-11 19:15 - 2015-07-30 03:32 - 00000000 ____D C:\Users\VieTru\Desktop\Games
2016-06-11 19:13 - 2015-07-17 20:58 - 00000000 ____D C:\Program Files (x86)\Google
2016-06-11 19:07 - 2015-10-10 01:35 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Webzen
2016-06-10 21:56 - 2015-09-18 23:27 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\Spotify
2016-06-10 21:55 - 2015-09-18 23:28 - 00000000 ____D C:\Users\VieTru\AppData\Local\Spotify
2016-06-10 16:23 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-06-09 21:24 - 2016-01-22 16:49 - 00004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{8974A241-CE3D-4FF1-8459-CD3CFB670EC2}
2016-06-09 13:42 - 2015-07-17 20:57 - 00003984 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1437159452
2016-06-09 13:42 - 2015-07-17 20:57 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-06-09 13:42 - 2015-07-17 20:56 - 00000000 ____D C:\Program Files (x86)\Opera
2016-06-07 11:16 - 2015-07-17 21:26 - 00004280 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-06-05 03:41 - 2015-08-06 14:40 - 00021288 _____ (RW-Everything) C:\WINDOWS\SysWOW64\Drivers\AxtuDrv.sys
2016-06-05 03:18 - 2016-04-13 08:03 - 00000000 ____D C:\Users\UpdatusUser
2016-06-04 22:59 - 2015-07-18 12:01 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-06-04 15:36 - 2015-07-18 00:24 - 00000000 ____D C:\Users\VieTru\AppData\Roaming\vlc
2016-06-04 10:39 - 2016-04-12 23:51 - 00000443 _____ C:\Users\VieTru\Desktop\Neues Textdokument (4).txt
2016-06-04 02:51 - 2015-11-22 01:14 - 13553096 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2016-06-03 09:22 - 2015-11-22 01:14 - 20375488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2016-06-03 09:22 - 2015-11-22 01:14 - 14462536 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2016-06-03 09:22 - 2015-11-22 01:14 - 00141256 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys
2016-06-03 09:22 - 2015-11-22 01:14 - 00040084 _____ C:\WINDOWS\system32\nvinfo.pb
2016-06-03 09:22 - 2015-11-22 01:13 - 03811256 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2016-06-03 09:22 - 2015-11-22 01:13 - 03371624 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2016-06-03 05:59 - 2016-04-13 08:00 - 06452948 _____ C:\WINDOWS\system32\nvcoproc.bin
2016-06-03 05:59 - 2016-04-13 08:00 - 06364216 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2016-06-03 05:59 - 2016-04-13 08:00 - 02455608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2016-06-03 05:59 - 2016-04-13 08:00 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2016-06-03 05:59 - 2016-04-13 08:00 - 01352760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2016-06-03 05:59 - 2016-04-13 08:00 - 00392128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2016-06-03 05:59 - 2016-04-13 08:00 - 00069568 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2016-06-01 08:55 - 2015-07-18 16:25 - 00000000 ____D C:\Program Files (x86)\Steam
2016-05-19 23:50 - 2016-04-13 08:03 - 02086232 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-19 23:50 - 2016-02-13 18:59 - 00888028 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-19 23:50 - 2016-02-13 18:59 - 00197112 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-18 18:33 - 2015-07-29 15:21 - 00002390 _____ C:\Users\VieTru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-05-18 18:33 - 2015-07-29 15:21 - 00000000 ___RD C:\Users\VieTru\OneDrive
2016-05-18 09:14 - 2015-07-29 15:57 - 00002384 _____ C:\Users\Gaby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-05-18 09:14 - 2015-07-29 15:57 - 00000000 ___RD C:\Users\Gaby\OneDrive
2016-05-16 11:47 - 2015-12-20 05:36 - 00000000 ____D C:\Program Files\Yu-Gi-Oh! The Dawn of a New Era
2016-05-15 20:40 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\rescache
2016-05-14 14:49 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-13 16:13 - 2016-02-13 19:32 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-05-13 07:00 - 2016-02-13 19:13 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-13 07:00 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-05-13 07:00 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-13 07:00 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\Provisioning
2016-05-13 07:00 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-05-13 06:59 - 2015-10-30 09:24 - 00015703 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2016-05-13 03:36 - 2015-07-18 11:58 - 00004014 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-05-13 02:36 - 2015-08-09 03:19 - 00003870 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-12 10:50 - 2015-07-18 12:01 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-07-28 23:46 - 2015-07-28 23:46 - 0000058 _____ () C:\Users\VieTru\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2016-03-12 17:31 - 2016-03-12 17:31 - 0002703 _____ () C:\Users\VieTru\AppData\Local\recently-used.xbel
2015-07-17 20:33 - 2015-07-17 20:33 - 0000003 _____ () C:\Users\VieTru\AppData\Local\user_data.ini
Einige Dateien in TEMP:
====================
C:\Users\VieTru\AppData\Local\Temp\jre-8u91-windows-au.exe
C:\Users\VieTru\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\VieTru\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\VieTru\AppData\Local\Temp\nvStInst.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-06-01 23:20
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:10-06-2016
durchgeführt von VieTru (2016-06-11 21:01:29)
Gestartet von C:\Users\VieTru\AppData\Local\Temp\scoped_dir6276_571
Windows 10 Pro Version 1511 (X64) (2016-04-13 06:37:31)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1002986252-3489396405-3818812170-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1002986252-3489396405-3818812170-503 - Limited - Disabled)
Gaby (S-1-5-21-1002986252-3489396405-3818812170-1002 - Administrator - Enabled) => C:\Users\Gaby
Gast (S-1-5-21-1002986252-3489396405-3818812170-501 - Limited - Disabled)
Maxi (S-1-5-21-1002986252-3489396405-3818812170-1003 - Administrator - Enabled) => C:\Users\Maxi
UpdatusUser (S-1-5-21-1002986252-3489396405-3818812170-1001 - Limited - Enabled) => C:\Users\UpdatusUser
VieTru (S-1-5-21-1002986252-3489396405-3818812170-1000 - Administrator - Enabled) => C:\Users\VieTru
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
(Street-Boy) All Cards Unlocker (HKLM-x32\...\(Street-Boy) All Cards Unlocker) (Version: 2.0 - )
µTorrent (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\uTorrent) (Version: 3.4.5.41372 - BitTorrent Inc.)
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20045 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Flash Player 21 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)
Aeria Ignite (HKLM-x32\...\Aeria Ignite 1.13.3296) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (HKLM-x32\...\Aeria Ignite) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Alliance of Valiant Arms DE (HKLM-x32\...\Alliance of Valiant Arms DE) (Version: - )
ASRock App Charger v1.0.5 (HKLM\...\ASRock App Charger_is1) (Version: - ASRock Inc.)
ASRock eXtreme Tuner v0.1.122 (HKLM-x32\...\ASRock eXtreme Tuner_is1) (Version: - )
ASRock InstantBoot v1.29 (HKLM-x32\...\ASRock InstantBoot_is1) (Version: - )
ATI Catalyst Install Manager (HKLM\...\{2770B8D8-701A-1D22-635F-8711DFC06B92}) (Version: 3.0.762.0 - ATI Technologies, Inc.)
Avast Internet Security (HKLM-x32\...\Avast) (Version: 11.1.2253 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\{EFA0FC40-7D96-4515-9715-7C0C5D872326}) (Version: 2.0.2.5623 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.16 - Piriform)
Clicker Heroes (HKLM-x32\...\Steam App 363970) (Version: - Playsaurus)
Combat Arms EU (HKLM-x32\...\Combat Arms EU) (Version: - )
Cossacks: Back to War (HKLM-x32\...\Steam App 4850) (Version: - GSC Game World)
Counter-Strike 2D 0.1.2.7 (HKLM-x32\...\{849F6C2A-3F9C-4731-B659-8C606B706CF0}_is1) (Version: - Unreal Software)
Crossfire Europe Version 1.0 (HKLM-x32\...\{557293B8-1840-44F4-BBEC-0F26A8399075}_is1) (Version: 1.0 - Smilegate Europe Pte Ltd.)
Cultures (HKLM-x32\...\1207663793_is1) (Version: 2.1.0.12 - GOG.com)
Cultures 2 (HKLM-x32\...\1207663813_is1) (Version: 2.1.0.11 - GOG.com)
Devilian Beta-EU (HKLM-x32\...\Glyph Devilian Beta-EU) (Version: - Trion Worlds, Inc.)
Duel Revolution version 1.0 (HKLM-x32\...\{9394B52D-0F3E-4C9A-8400-DB37A8D7241F}_is1) (Version: 1.0 - Game Matter)
Etron USB3.0 Host Controller (x32 Version: 0.104 - Etron Technology) Hidden
Facebook Games Arcade 0.5.0.0 (HKLM-x32\...\{E2C95431-0B24-41D0-A16F-30DE5A463B40}) (Version: 0.5.0.0 - Facebook)
Ghost in the Shell Stand Alone Complex First Assault Online (HKLM-x32\...\Steam App 369200) (Version: - Neople)
GIMP 2.8.16 (HKLM\...\GIMP-2_is1) (Version: 2.8.16 - The GIMP Team)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
Headshot INFIPLAY (remove only) (HKLM-x32\...\HEADSHOT) (Version: 1.1.0.0 - INFIPLAY)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Java 8 Update 77 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Java 8 Update 77 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Marvel Heroes 2015 (HKLM-x32\...\Steam App 226320) (Version: - Gazillion Entertainment)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{887868A2-D6DE-3255-AA92-AA0B5A59B874}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mouse Editor (HKLM-x32\...\InstallShield_{72376EB6-0189-45B3-A4F6-823F549697C3}) (Version: 12.02.0004 - Ihr Firmenname)
MOUSE Editor (x32 Version: 12.02.0004 - Ihr Firmenname) Hidden
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
MTA:SA v1.5.0 (HKLM-x32\...\MTA:SA 1.5) (Version: v1.5.0 - Multi Theft Auto)
My.com Game Center (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\MyComGames) (Version: 3.138 - My.com B.V.)
Nettalk 6.7 (HKLM-x32\...\Nettalk_is1) (Version: - Nicolas Kruse)
NVIDIA 3D Vision Controller-Treiber 364.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 364.44 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 368.39 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 368.39 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.9.1.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.9.1.22 - NVIDIA Corporation)
NVIDIA Grafiktreiber 368.39 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 368.39 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.14 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.14 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Opera Stable 38.0.2220.29 (HKLM-x32\...\Opera 38.0.2220.29) (Version: 38.0.2220.29 - Opera Software)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version: - Grinding Gear Games)
PDoD Uninstallation (HKLM-x32\...\{B5A4D5A1-7646-4EA9-9D30-3368A736A791}_is1) (Version: 0.5.6b - SickMafia)
Pokémon World Online Uninstaller (HKLM-x32\...\{6B67E1A1-1D62-4BDC-8C60-07FDF25CA975}_is1) (Version: 1.97 - CodeCore Entertainment & the PWO Team)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.44.421.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6378 - Realtek Semiconductor Corp.)
Risen (HKLM-x32\...\Steam App 40300) (Version: - Piranha Bytes)
Royal Quest (HKLM-x32\...\Steam App 295550) (Version: - Katauri)
SafeZone Stable 1.48.2066.98 (x32 Version: 1.48.2066.98 - Avast Software) Hidden
SHIELD Streaming (Version: 4.1.0260 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.9.1.22 - NVIDIA Corporation) Hidden
skyforge_mycom (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\skyforge_mycom) (Version: 1.26 - My.com B.V.)
Soccer Manager 2015 (HKLM-x32\...\Steam App 356370) (Version: - Soccer Manager Ltd)
Sony PC Companion 2.10.275 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.275 - Sony)
Spotify (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\Spotify) (Version: 1.0.27.75.gdc223232 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Incredible Adventures of Van Helsing (HKLM-x32\...\Steam App 215530) (Version: - NeocoreGames)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version: - Runic Games)
Unity Web Player (HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\UnityWebPlayer) (Version: 5.3.1f1 - Unity Technologies ApS)
Unity Web Player (x64) (All users) (HKLM\...\UnityWebPlayer) (Version: 4.6.6f2 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.11.1 (HKLM\...\VulkanRT1.0.11.1) (Version: 1.0.11.1 - LunarG, Inc.)
Warcraft III (HKLM-x32\...\Warcraft III) (Version: - Blizzard Entertainment)
WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH)
YGOPro DevPro Launcher (HKLM-x32\...\{8D09DD74-E630-4629-80DC-7FB13AE58F3F}) (Version: 2.0.10 - DevPro, LLC)
Yu-Gi-Oh! The Dawn of a New Era Version 5.0.8.3403 (HKLM-x32\...\{1F276EF8-ACD8-4805-845C-BA1FC14DCB3B}_is1) (Version: 5.0.8.3403 - Kaiba Corporation)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\VieTru\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileCoAuth.exe (Microsoft Corporation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {00DD7C25-CE12-4CDD-9699-581988EF381C} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-13] (Adobe Systems Incorporated)
Task: {0158117E-242D-4C5D-8EFC-871171D2EBF7} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {025E14A5-1BB2-4C4A-9D28-82EAFE86C793} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {042F9AB7-C1AF-4E96-AFFC-2203D0353701} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_21_0_0_242_pepper.exe [2016-05-13] (Adobe Systems Incorporated)
Task: {0895E954-7D5D-40D3-BF02-F8DCEB6A8796} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {168F8DF3-B1BF-44E9-A26F-A210A0CC3228} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {1D6E08C4-DEEB-47CB-A7C3-7447D6B86421} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {3248BF4F-D2BE-49E3-BBD5-B02FE80BAC4D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {33BA90F7-C93E-4626-9C13-6D8F1D7714AA} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-05-11] (Microsoft Corporation)
Task: {3572E9DC-201B-4DE7-9537-B98BEE227A8F} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-03-20] (Oracle Corporation)
Task: {37F212CF-2842-4E70-A763-C05D99458843} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {3D59CA0A-4B10-4068-BF22-91C1AD6273D6} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {3F6FC81E-90BA-469D-B830-6E467ED6DCBA} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {4128BABB-A225-4567-9924-74387DEB3103} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {41571DB1-6A59-4E91-AC3D-EDEB112727A5} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {43E4BA81-69B0-49E0-ADAF-489AE818666E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4FB09BAE-32BA-4F1A-900C-6ECC307C4AAA} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {502935A6-4A73-4B65-BDF8-62B42A09631F} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {57968080-82C8-46AC-AB51-027F54485215} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {5C91BB97-6DD7-439E-B913-C9D94A2D6B84} - System32\Tasks\SafeZone scheduled Autoupdate 1454793812 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-03-30] (Avast Software)
Task: {679E7135-462F-480D-9FE4-12E49AEDAF91} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {6CEE3DE7-37C8-4BF7-8093-151FD756CCCD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {7622A283-C923-4EB5-96BF-274292ACF736} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {777C280B-48E1-4E70-9447-9FA583A0CF18} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-21] (Google Inc.)
Task: {79F7F780-D968-4035-A654-0EF1AF749583} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7EAF45B8-10CC-4E86-8680-A145694E3365} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {8048CBC2-BD1D-488B-9FA3-101D87335301} - System32\Tasks\crash_service => C:\Users\VieTru\AppData\Local\BoBrowser\Application\crash_service.exe <==== ACHTUNG
Task: {81E045F4-FFF8-42C3-A6FF-E928D9A4A509} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {855556D9-F783-4793-8399-5A730D6530CC} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-06] (AVAST Software)
Task: {8B012A18-DB48-44C9-8829-0AA94167860F} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {8D1D1684-2BCA-4861-B7E1-3630178520EE} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {96AB51C2-5D4A-43F5-B69E-24128A7B04DC} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {98865D4B-CAFD-4B80-9B95-E63BA53E637E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {9F941FB5-BAA6-41D3-B704-8379E8EEA7EF} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {AF3B1B4C-8282-463B-B60C-389AFF1EC340} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {BC671B65-D94A-48D3-95F3-4750668002F4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {BD08B9EE-DD17-44B9-A7A5-167D34709F17} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-03-11] (Piriform Ltd)
Task: {C5D4FCFB-A38C-4845-B53E-CE15890AF0AA} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {C720F816-1BEA-4FA9-9A0C-12DF9F25A483} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {D8770124-4B20-4FA0-A07A-5F3B2D02A322} - System32\Tasks\Run_Bobby_Browser => C:\Users\VieTru\AppData\Local\BoBrowser\Application\bobrowser.exe <==== ACHTUNG
Task: {D916F7BB-D13D-4DFE-8617-F38784191B54} - System32\Tasks\PostPoneInstall => C:\Users\VieTru\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe <==== ACHTUNG
Task: {DAD0A8DE-8ADA-41DA-90DE-72C5C4347C98} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {DFD91D3C-48AB-42D3-835E-6F5658E20C8E} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {E648996A-46AA-404B-B40C-69F48A38EC24} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {E9C97283-D8F5-49F4-97F3-78FDC0EA9F2D} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {EA18D6A4-42BF-487C-8F91-F4B7D340D346} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {EFF482C8-52E2-41F3-9B6B-F38FF105D5E0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-21] (Google Inc.)
Task: {EFF56696-2C58-426D-AF19-B26189100E86} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {F31DEDE1-DD57-4BCD-B6F9-0F1B8CD5CE46} - System32\Tasks\Opera scheduled Autoupdate 1437159452 => C:\Program Files (x86)\Opera\launcher.exe [2016-06-07] (Opera Software)
Task: {F7B14EDD-24A8-47A2-BC53-014444DB8D04} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_21_0_0_242_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-04-13 08:00 - 2016-06-03 05:59 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-04-13 08:52 - 2016-04-13 08:52 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-13 08:52 - 2016-04-13 08:52 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-05-18 18:33 - 2016-05-18 18:33 - 00959168 _____ () C:\Users\VieTru\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll
2015-09-15 13:11 - 2015-09-15 13:11 - 00177152 _____ () C:\WINDOWS\system32\spool\PRTPROCS\x64\lxdndrpp.dll
2016-06-11 20:09 - 2016-01-12 06:43 - 00291264 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-02-13 19:02 - 2016-02-13 19:02 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-05-11 13:58 - 2016-04-23 06:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-19 17:17 - 2016-04-19 17:17 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-05-11 13:59 - 2016-04-23 06:02 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-05-11 13:58 - 2016-04-23 05:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-05-11 13:59 - 2016-04-23 05:58 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-05-11 13:59 - 2016-04-23 06:01 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-05-11 13:59 - 2016-04-23 05:58 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-02-06 23:16 - 2016-02-06 23:16 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-06 23:16 - 2016-02-06 23:16 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-06-11 12:38 - 2016-06-11 12:38 - 02932736 _____ () C:\Program Files\AVAST Software\Avast\defs\16061100\algo.dll
2016-04-14 16:17 - 2016-04-14 16:17 - 00509344 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-07-17 23:12 - 2016-01-12 06:43 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-05-18 18:33 - 2016-05-18 18:33 - 00679624 _____ () C:\Users\VieTru\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\ClientTelemetry.dll
2016-02-06 23:16 - 2016-02-06 23:16 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-06-09 13:42 - 2016-06-09 13:42 - 67942952 _____ () C:\Program Files (x86)\Opera\38.0.2220.29\opera.dll
2016-06-09 13:42 - 2016-06-09 13:41 - 02203176 _____ () C:\Program Files (x86)\Opera\38.0.2220.29\libglesv2.dll
2016-06-09 13:42 - 2016-06-09 13:41 - 00087080 _____ () C:\Program Files (x86)\Opera\38.0.2220.29\libegl.dll
2016-04-19 17:17 - 2016-04-19 17:17 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 17:17 - 2016-04-19 17:17 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [344]
AlternateDataStreams: C:\Users\Gaby\Desktop\azmm24.jpeg:3or4kl4x13tuuug3Byamue2s4b [83]
AlternateDataStreams: C:\Users\Gaby\Desktop\azmm24.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\aeriagames.com -> hxxps://aeriagames.com
IE trusted site: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\aeriagames.com -> hxxp://aeriagames.com
IE trusted site: HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\amazon.de -> hxxps://amazon.de
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2016-01-09 02:55 - 00000967 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img2.jpg
HKU\S-1-5-21-1002986252-3489396405-3818812170-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: OscarEditor => "C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe" Minimum
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "BlueStacks Agent"
HKLM\...\StartupApproved\Run32: => "Aeria Ignite"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\StartupFolder: => "Nettalk.lnk"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\Run: => "MyComGames"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-1002986252-3489396405-3818812170-1000\...\StartupApproved\Run: => "Spotify Web Helper"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{DA591B9E-5109-4D91-9AC2-E465D51CB1A9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Risen\bin\Risen.exe
FirewallRules: [{21A87EBB-64C9-4807-8FC5-11B90B8180FE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Risen\bin\Risen.exe
FirewallRules: [{8D19F478-E4B5-439A-B576-5DD1A2806700}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{A3B896E5-5414-4BEB-9D41-F4793A74F3E8}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{E4B56A60-3DC2-4494-8ECB-C2300BFE2D6F}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{4973D6A6-2C2E-4E45-B20C-FA29099A391A}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{CF95D106-3FC5-4A89-A2B2-0D9B6A93882D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\dmcr.exe
FirewallRules: [{2248FD25-F2DE-4224-AF08-638881F5438C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\dmcr.exe
FirewallRules: [UDP Query User{4C06F253-1F46-4F7B-9C4C-1D4CDD0901F8}C:\yu-gi-oh! the dawn of a new era\ygopro\ygopro.exe] => (Allow) C:\yu-gi-oh! the dawn of a new era\ygopro\ygopro.exe
FirewallRules: [TCP Query User{2E7E95C1-ABC2-43C9-8680-3E741C089FE9}C:\yu-gi-oh! the dawn of a new era\ygopro\ygopro.exe] => (Allow) C:\yu-gi-oh! the dawn of a new era\ygopro\ygopro.exe
FirewallRules: [UDP Query User{619F93F8-AA10-473A-8F27-07EE7B0B95E2}C:\users\vietru\desktop\games\ygopro-1.033.7-percy\ygopro_vs.exe] => (Allow) C:\users\vietru\desktop\games\ygopro-1.033.7-percy\ygopro_vs.exe
FirewallRules: [TCP Query User{9F6247EF-25B6-4285-AB1D-5A3869A29F89}C:\users\vietru\desktop\games\ygopro-1.033.7-percy\ygopro_vs.exe] => (Allow) C:\users\vietru\desktop\games\ygopro-1.033.7-percy\ygopro_vs.exe
FirewallRules: [{6C64001A-F3B2-42BE-9EA7-CF9BC20061BA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\cshlp.exe
FirewallRules: [{9614AA0A-05D4-4CFA-AAEB-F67574D42F69}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\cshlp.exe
FirewallRules: [{74C0FC25-12D9-47A2-A8EF-2DDA12B9688A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\ScenarioEditor.exe
FirewallRules: [{22348F8C-F676-4E0C-B010-13C1289DE83B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\ScenarioEditor.exe
FirewallRules: [{E6D9BFC0-254D-4EA8-9C68-FE5554FA881D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\HView.exe
FirewallRules: [{BE8D0D46-8D1C-4FA8-A03B-0A31E55C26B7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\HView.exe
FirewallRules: [{D2861380-9AF1-4B2D-9B93-FB3DA9D19D94}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\csbtw.exe
FirewallRules: [{A99169E7-5DDF-4E9D-928D-5BAB1C71A78C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cossacks Back to War\bin\csbtw.exe
FirewallRules: [{A2EC3792-F8BE-47CF-8FF3-A3A04C9CEE8B}] => (Allow) C:\Nexon\Combat Arms EU\NMService.exe
FirewallRules: [{1006994D-00CC-485A-AE6B-04C273A64EB4}] => (Allow) C:\Nexon\Combat Arms EU\NMService.exe
FirewallRules: [{C18B059E-71E0-472C-B337-8FC897D51AA2}] => (Allow) C:\Users\VieTru\AppData\Roaming\Andy\Setup.exe
FirewallRules: [{48A56934-DBE6-43DB-9259-EAF24CCE3FC2}] => (Allow) C:\Users\VieTru\AppData\Roaming\Andy\Setup.exe
FirewallRules: [UDP Query User{32420C5D-5002-4211-A0E7-4D44D1A07136}C:\aeriagames\ava\binaries\ava.exe] => (Allow) C:\aeriagames\ava\binaries\ava.exe
FirewallRules: [TCP Query User{4947D1D8-67FF-472B-8238-61C9205FB77C}C:\aeriagames\ava\binaries\ava.exe] => (Allow) C:\aeriagames\ava\binaries\ava.exe
FirewallRules: [{F75E4207-3426-45E0-8F30-F26434FE54A4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [{16BFA25F-DCBE-4B86-AC9F-C89713AFED3C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [UDP Query User{74E61766-DCE1-4A89-8682-649A13915EF4}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{8C410F38-9C7A-4AD7-BDE8-A1C23A46BFCD}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{43F6EA1C-4EEF-48F2-BB22-2726D9097906}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [{D51E4F67-1D84-4B56-8847-7339E9242F3B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [UDP Query User{E41812DC-23F8-4B27-9C62-333D37B5FBCC}C:\users\vietru\appdata\roaming\ygopro devpro launcher\devpro.dll] => (Block) C:\users\vietru\appdata\roaming\ygopro devpro launcher\devpro.dll
FirewallRules: [TCP Query User{7CC01266-66E7-483E-B07D-FCB46CF932A7}C:\users\vietru\appdata\roaming\ygopro devpro launcher\devpro.dll] => (Block) C:\users\vietru\appdata\roaming\ygopro devpro launcher\devpro.dll
FirewallRules: [UDP Query User{D1DCDB91-10B2-45A0-A5B0-834E61757FD6}C:\users\vietru\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\vietru\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{24EE4D84-FA71-4264-B868-5EB505C1D535}C:\users\vietru\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\vietru\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB6C317A-4E13-41F0-8C51-83DEE1F46216}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Incredible Adventures of Van Helsing\VanHelsing.exe
FirewallRules: [{808F695E-F013-4E24-A98E-5E5412CB2927}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Incredible Adventures of Van Helsing\VanHelsing.exe
FirewallRules: [UDP Query User{C82D3854-9DC0-442C-BEF9-0889610AE1F6}C:\program files (x86)\mta san andreas 1.5\server\mta server.exe] => (Block) C:\program files (x86)\mta san andreas 1.5\server\mta server.exe
FirewallRules: [TCP Query User{B781DF7A-293C-4948-B60C-142ABAE8D5ED}C:\program files (x86)\mta san andreas 1.5\server\mta server.exe] => (Block) C:\program files (x86)\mta san andreas 1.5\server\mta server.exe
FirewallRules: [UDP Query User{59807251-6D73-4A9F-B8DB-F515A6D29E34}C:\users\vietru\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\vietru\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{79436DC0-7EA4-4FB4-B7A9-8F9EBA72AF0D}C:\users\vietru\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\vietru\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E9062174-A5CF-4DD5-B8A8-FA85892CD6E4}C:\windows\system32\spool\drivers\x64\3\lxdnpswx.exe] => (Allow) C:\windows\system32\spool\drivers\x64\3\lxdnpswx.exe
FirewallRules: [TCP Query User{8B4A8DAD-CDD5-4802-AD70-3A16D7F14FDD}C:\windows\system32\spool\drivers\x64\3\lxdnpswx.exe] => (Allow) C:\windows\system32\spool\drivers\x64\3\lxdnpswx.exe
FirewallRules: [{C0C42FE4-4B46-40D1-97D0-3C4751D61093}] => (Allow) C:\Windows\System32\lxdncoms.exe
FirewallRules: [{A4CD7B57-B411-4856-9F26-F9811FF2070E}] => (Allow) C:\Windows\System32\lxdncoms.exe
FirewallRules: [{3F02A4D8-AB73-4A38-9AD7-BDAC2A19071E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{F6BE5D05-D4CD-4705-AE1D-EDA334F60411}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C69978DF-F00E-43DC-AC35-F2E0CF0A15C9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{68DA4C30-84FB-427F-8150-E27A91B0E3A7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{6537E9A1-BFA8-452D-991F-1FF9ED21FEC3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2015.exe
FirewallRules: [{03AA0AA1-B94C-41D4-9387-AD145870EAB1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2015.exe
FirewallRules: [{1B3DA8E1-02B8-4B1B-92D7-ED856E38EEAA}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{1DF4BD0F-5CBA-4F5D-AA7A-CDB11DCD7F88}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{9E7B6C9B-EFC5-420B-B2D0-897D1355E6E9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{F3D52660-EDB7-4CFE-8C0D-5478481491D1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{C035C95B-FE30-417C-9649-417DB853D086}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Royal Quest\rqlauncher.exe
FirewallRules: [{E50FD014-A3C3-47F4-9B49-26837FD70832}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Royal Quest\rqlauncher.exe
FirewallRules: [{7AA14D77-26B1-4694-95E6-716E0A6333F7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Royal Quest\rqmain.exe
FirewallRules: [{93BADD13-BF1B-41D3-BD91-6BD6F4F1AFDA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Royal Quest\rqmain.exe
FirewallRules: [UDP Query User{257652B4-2D1B-4949-9723-CF0395345986}C:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2.exe
FirewallRules: [TCP Query User{5DEB5925-374C-4F49-A167-0B99C2DE574F}C:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2.exe
FirewallRules: [{3FF9EE13-9BFD-4A6D-AA45-B2370927F8B8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Torchlight II\ModLauncher.exe
FirewallRules: [{E23F2209-5E01-4CD2-922D-F1F736E0549A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Torchlight II\ModLauncher.exe
FirewallRules: [{02D18151-EDA7-4261-B065-8331D19BA8BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2015\Soccer Manager 2015.exe
FirewallRules: [{13E0A2E0-B6E6-484A-940C-8CA3BF3CEE07}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2015\Soccer Manager 2015.exe
FirewallRules: [{76FD02CB-3CD9-4B71-B61D-5A5618956B73}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{75920FF0-246F-46A6-A14D-EC2F733D9CA4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [UDP Query User{126FE6AC-F642-43CC-B6DB-0CED819FD764}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{F2B9D28D-EB37-4B86-8A08-3E0D96D150F9}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{6BD60BD8-83D9-49E4-8F1A-1A8FB8A9FDDD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8819C81E-0F9F-4D0A-B0DC-AF472909830D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{ED646E1D-3539-46DE-A52C-2421755BF7DB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{169FDA2D-4AE3-4266-A276-696FB3896D4E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{45FEBA3D-8139-4686-BD11-B2AED6F3401C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{7687B3BA-CE35-4289-BBF4-05A82201DDCA}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{550D2A4B-105E-4075-9D5E-573DA6E9B2D6}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{8D1D1B8F-14C9-488B-890F-D9C3FDECB52C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F73B0C9E-EC14-4CF0-848C-49A39B050E84}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E815934E-517D-45EE-BBA2-93A62353D74D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E2EF24FF-4D91-4BB5-B418-336E906D951D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{D00602C1-7EF3-4F39-803F-24F478542A93}C:\users\vietru\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\vietru\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [UDP Query User{55E01633-BD1A-469A-80FF-DB6E0A6B8B46}C:\users\vietru\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\vietru\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [{6B3172BA-3729-4CAE-AB24-1E56242D4335}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{284FA3EC-0849-4BEC-9219-E7E6598E0717}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{36C4D438-54A0-44CE-8EE5-98AA4B331583}C:\counter-strike 2d\counterstrike2d.exe] => (Allow) C:\counter-strike 2d\counterstrike2d.exe
FirewallRules: [UDP Query User{A55C6CA3-CD2D-4A80-A874-D9B5E24E5425}C:\counter-strike 2d\counterstrike2d.exe] => (Allow) C:\counter-strike 2d\counterstrike2d.exe
FirewallRules: [{00667987-F9C0-457F-8F94-2C3CF7DE0F15}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{293163DB-769A-4CB2-885A-B110C9BF36E1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{ACB7EEF4-B3A0-47D0-A66C-5E9F9A366D83}] => (Allow) C:\Program Files (x86)\PDoD\Pokemon Online.exe
FirewallRules: [{D2CB1DE7-2482-4E3A-850E-C2A2E1622964}] => (Allow) C:\Program Files (x86)\PDoD\Pokemon Online.exe
FirewallRules: [{88A92D97-6FC0-477D-875E-C569E778CCAD}] => (Allow) C:\Program Files (x86)\PDoD\GameUpdate.exe
FirewallRules: [{8C8063AD-98FA-4CD0-A437-1A8CBF66E641}] => (Allow) C:\Program Files (x86)\PDoD\GameUpdate.exe
FirewallRules: [{E070118B-42AC-4F77-9AB4-6F149EFA4BD6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\nxsteam.exe
FirewallRules: [{8950F0ED-15E6-4C61-8574-165D950DF4CB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\nxsteam.exe
FirewallRules: [TCP Query User{EC1027BD-E987-47E2-9378-B63BC3D17FCE}C:\users\vietru\downloads\yu-gi-oh! power of chaos legend reborn\yugi reborn - normal.exe] => (Allow) C:\users\vietru\downloads\yu-gi-oh! power of chaos legend reborn\yugi reborn - normal.exe
FirewallRules: [UDP Query User{7FBC423D-8B8B-4E17-B6C1-5E98C65C52BD}C:\users\vietru\downloads\yu-gi-oh! power of chaos legend reborn\yugi reborn - normal.exe] => (Allow) C:\users\vietru\downloads\yu-gi-oh! power of chaos legend reborn\yugi reborn - normal.exe
FirewallRules: [TCP Query User{28640D10-953A-4238-A5AC-EC5F3A8938B0}C:\windows\syswow64\dpnsvr.exe] => (Allow) C:\windows\syswow64\dpnsvr.exe
FirewallRules: [UDP Query User{235141AB-581C-4070-BB92-9527A29089B4}C:\windows\syswow64\dpnsvr.exe] => (Allow) C:\windows\syswow64\dpnsvr.exe
FirewallRules: [TCP Query User{4F3E6531-D408-497E-8295-BD9332811EC6}C:\gog games\cultures\cultures.exe] => (Block) C:\gog games\cultures\cultures.exe
FirewallRules: [UDP Query User{797B06BC-94DC-4A2C-8564-7FFCE240F3F5}C:\gog games\cultures\cultures.exe] => (Block) C:\gog games\cultures\cultures.exe
==================== Wiederherstellungspunkte =========================
ACHTUNG: Systemwiederherstellung ist deaktiviert
05-06-2016 19:00:06 Windows-Sicherung
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 21 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR VietzTrumme-2.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.10:5353 19 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR VietzTrumme.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 21 4.C.C.0.3.3.0.6.1.0.7.8.E.8.5.6.2.5.B.3.8.8.C.F.6.B.8.6.0.0.D.F.ip6.arpa. PTR VietzTrumme-2.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.10:5353 19 4.C.C.0.3.3.0.6.1.0.7.8.E.8.5.6.2.5.B.3.8.8.C.F.6.B.8.6.0.0.D.F.ip6.arpa. PTR VietzTrumme.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 21 F.E.C.6.4.0.9.A.4.D.3.F.F.5.5.C.8.B.4.F.F.B.9.1.9.0.1.8.2.0.A.2.ip6.arpa. PTR VietzTrumme-2.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.10:5353 19 F.E.C.6.4.0.9.A.4.D.3.F.F.5.5.C.8.B.4.F.F.B.9.1.9.0.1.8.2.0.A.2.ip6.arpa. PTR VietzTrumme.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 21 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.2.5.B.3.8.8.C.F.6.B.8.6.0.0.D.F.ip6.arpa. PTR VietzTrumme-2.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.10:5353 19 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.2.5.B.3.8.8.C.F.6.B.8.6.0.0.D.F.ip6.arpa. PTR VietzTrumme.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 21 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.8.B.4.F.F.B.9.1.9.0.1.8.2.0.A.2.ip6.arpa. PTR VietzTrumme-2.local.
Error: (06/11/2016 08:09:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.10:5353 19 F.7.9.0.4.5.A.5.8.F.2.F.B.D.9.5.8.B.4.F.F.B.9.1.9.0.1.8.2.0.A.2.ip6.arpa. PTR VietzTrumme.local.
Systemfehler:
=============
Error: (06/11/2016 08:39:11 PM) (Source: DCOM) (EventID: 10016) (User: VIETZTRUMME)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}VIETZTRUMMEVieTruS-1-5-21-1002986252-3489396405-3818812170-1000LocalHost (unter Verwendung von LRPC)Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewyS-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795
Error: (06/11/2016 08:25:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Net.Msmq-Listeneradapter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (06/11/2016 08:25:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst NetMsmqActivator erreicht.
Error: (06/11/2016 08:25:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NetPipeActivator" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (06/11/2016 08:25:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst NetPipeActivator erreicht.
Error: (06/11/2016 08:24:17 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NetTcpActivator" ist vom Dienst "NetTcpPortSharing" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (06/11/2016 08:22:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Synchronisierungshost_d83b4ab" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/10/2016 12:39:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Synchronisierungshost_cad9f95" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/10/2016 09:52:05 AM) (Source: DCOM) (EventID: 10016) (User: VIETZTRUMME)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}VIETZTRUMMEGabyS-1-5-21-1002986252-3489396405-3818812170-1002LocalHost (unter Verwendung von LRPC)Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewyS-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795
Error: (06/10/2016 12:42:32 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Synchronisierungshost_6947825" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
CodeIntegrity:
===================================
Date: 2016-05-14 20:59:27.736
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-05-14 16:58:45.352
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-05-14 00:57:49.095
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-05-13 12:51:16.296
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-05-12 04:51:13.696
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-20 09:05:40.665
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-13 11:03:50.307
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-13 11:03:50.279
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-13 11:03:49.240
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-13 11:03:49.220
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: AMD Phenom(tm) II X4 965 Processor
Prozentuale Nutzung des RAM: 25%
Installierter physikalischer RAM: 8165.8 MB
Verfügbarer physikalischer RAM: 6088.9 MB
Summe virtueller Speicher: 16357.8 MB
Verfügbarer virtueller Speicher: 14062.76 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:465.22 GB) (Free:253.56 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 0F09C300)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
==================== Ende von Addition.txt ============================
Geändert von PalitX (11.06.2016 um 20:09 Uhr) |
|
12.06.2016, 05:20
| #2 |
| /// TB-Ausbilder /// Anleitungs-Guru  | Sobald ich Browser öffne und ich klicke öffnen sich Werbe Seiten Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das... 
 Hinweis:Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean  bekommst.Los geht's: Schritt 1  
Schritt 2   Bitte starte FRST erneut, und drücke auf Untersuchen. Bitte poste mir den Inhalt des Logs.
__________________ |
|
| Themen zu Sobald ich Browser öffne und ich klicke öffnen sich Werbe Seiten |
| avast, browser, dnsapi.dll, fenster, festgestellt, firefox, gewinnen, installiert, interne, internet, iphone 6s, klicke, mozilla, natürlich, nervig, neue, nichts, npdicihegicnhaangkdmcgbjceoemeoo, opera, problem, samsung, security, seite, seiten, spiele, visual c++ 2015, welchem, windows, windowsapps, öffnen |
