| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System ist von Schadsoftware befallenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.07.2016, 11:39
| #1 |
 |  System ist von Schadsoftware befallen Hallo,... in meinem System befindet sich offensichtlich Schadsoftware, da ich nichts installieren kann. Ich werde zwar zum Eingeben des Admin-Kennwortes aufgefordert, danach passiert jedoch nichts... Bin nun über mein 2. Admin-Profil (Name siehe FRST.txt: 2thDevice) angemeldet, da ich vermute, dass ich keine Kontrolle über das übliche Admin-Konto habe. Ich habe vorab schon mal einen Scann mit FRST64 durchgeführt und Euch den Log hier gepostet. (allerdings erst einmal nur FRST.txt) Addition.txt habe ich ein Stunde lang gestückelt eingefügt und nur Fehlermeldung bezüglich zu vieler Wörter bekommen. FRST.txt Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
durchgeführt von 2th Device (Administrator) auf TONI-PC (08-07-2016 10:56:50)
Gestartet von L:\T\TECHNICS PC\PC Security\Farbar Recovery Scan Tool FRST64\2016-07
Geladene Profile: 2th Device & Toni Standard (Verfügbare Profile: Toni_02 & 2th Device & Toni Standard & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMWDSrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\QVssService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe
() C:\Users\Toni Standard\AppData\Local\Amazon Music\Amazon Music Helper.exe
(QNAP Systems, Inc.) C:\Program Files (x86)\QNAP\Qsync\Qsync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files (x86)\QNAP\QGet\QGet.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\QNAP\QGet\QGetServer.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe
() C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMConfig.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMProcess.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe
(QNAP) C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\Enclosure.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
() C:\Program Files (x86)\QNAP\QGet\QGet.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files (x86)\QNAP\QGet\QGetServer.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe
() C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMConfig.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMProcess.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe
(QNAP) C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
Code:
ATTFilter ==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11776104 2011-02-11] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-09-24] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-09-24] (Adobe Systems Inc.)
HKLM-x32\...\Run: [KMConfig] => "C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe" KMConfig.exe
HKLM-x32\...\Run: [WheelMouse] => C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE [61440 2000-05-08] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2012-01-13] (Nero AG)
HKLM-x32\...\Run: [SAFE2012 HotKeys] => C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe [84480 2012-11-19] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE2012 File Redirection Starter] => C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe [17408 2012-11-19] (Steganos Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QGet] => C:\Program Files (x86)\QNAP\QGet\QGet.exe [6965968 2013-01-11] ()
HKLM-x32\...\Run: [NetworkDriveAgent] => C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe [1743592 2014-12-24] (QNAP)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-07-20] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1612934075-448063179-3665729200-1005\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\Music and more\DAEMON Tools Lite\DTLite.exe [3481408 2012-02-13] (DT Soft Ltd)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [CSmileys] => "C:\Program Files (x86)\Crawler\Smileys\CSmileysIM.exe"
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Amazon Music] => C:\Users\Toni Standard\AppData\Local\Amazon Music\Amazon Music Helper.exe [5886784 2015-04-21] ()
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Dropbox Update] => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Qsync] => C:\Program Files (x86)\QNAP\Qsync\Qsync.exe [18315472 2015-10-16] (QNAP Systems, Inc.)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\MountPoints2: {0276705e-2a81-11e2-aa71-50e5493e14f5} - J:\unlock.exe autoplay=true
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\MountPoints2: {530ae508-febe-11e2-b141-50e5493e14f5} - S:\pushinst.exe
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ QsyncEx_Icon1] -> {9EF65B94-EC0D-49F7-B46D-006B388EB03E} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon2] -> {8431CA36-5AD0-49EA-884E-B6BFE502BD90} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon3] -> {3047FAEE-0237-49BB-B4D9-26F5DE6DA2E8} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon4] -> {FACE7498-EE29-467E-AFDD-74BEB6C53239} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Action Manager 32.lnk [2012-01-18]
ShortcutTarget: Action Manager 32.lnk -> C:\Program Files (x86)\Plustek\OpticPro ST48\AM32.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QNAP QGet.lnk [2015-03-23]
ShortcutTarget: QNAP QGet.lnk -> C:\Program Files (x86)\QNAP\QGet\QGet.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2014-11-14]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Toni Standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-06-25]
ShortcutTarget: Dropbox.lnk -> C:\Users\2th Device\AppData\Roaming\Dropbox\bin\Dropbox.exe (Keine Datei)
Startup: C:\Users\Toni_02\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-08-09]
ShortcutTarget: Dropbox.lnk -> C:\Users\2th Device\AppData\Roaming\Dropbox\bin\Dropbox.exe (Keine Datei)
GroupPolicy: Beschränkung - Chrome <======= ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG
Code:
ATTFilter ==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{86EA66A2-B974-40D7-B70D-DF7EF99D26E7}: [NameServer] 192.168.2.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKU\S-1-5-21-1612934075-448063179-3665729200-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.de/?gfe_rd=cr&ei=MGZ_V7XhC-ak8wfU06OQAQ&gws_rd=ssl
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-07] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-07] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1612934075-448063179-3665729200-1007 -> Kein Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Keine Datei
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Code:
ATTFilter FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-19] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-06] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-19] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1221171.dll [2015-10-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-07-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-07-07] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2015-02-11] (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-06] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-1612934075-448063179-3665729200-1007: @phonostar.de/phonostar -> C:\Users\Toni Standard\Documents\dradio-Recorder\npphonostarDetectNP.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1612934075-448063179-3665729200-1007: @www.flatcast.com/FlatViewer 5.2 -> C:\PROGRA~2\MOZILL~1\browser\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2015-10-24] [ist nicht signiert]
Code:
ATTFilter ==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S3 BITCOMET_HELPER_SERVICE; C:\Program Files (x86)\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
R2 KMWDSERVICE; C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMWDSrv.exe [2179072 2007-05-08] (UASSOFT.COM) [Datei ist nicht signiert]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [Datei ist nicht signiert]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2015-03-19] (The OpenVPN Project)
R2 QVssService; C:\Program Files\QNAP\NetBak\QVssService.exe [2203824 2015-02-09] (QNAP Systems, Inc.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-10-28] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [307576 2015-10-28] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [671512 2014-12-22] (Wacom Technology, Corp.)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-02-27] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 HPMo4DE3; C:\Windows\System32\DRIVERS\HPMo4DE3.sys [25088 2011-03-09] (TPMX Electronics Ltd.)
S3 HPub4DE3; C:\Windows\System32\Drivers\HPub4DE3.sys [18432 2011-04-12] (TPMX Electronics Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564792 2012-02-27] (Duplex Secure Ltd.)
R3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] ()
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [8944 1999-05-05] (Microsoft Corporation) [Datei ist nicht signiert]
U3 apbwtjiq; C:\Windows\System32\Drivers\apbwtjiq.sys [0 ] (Elaborate Bytes AG) <==== ACHTUNG (Null Byte Datei/Ordner)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 QDrive; \??\C:\Users\Toni_02\AppData\Local\Temp\QDrive.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Code:
ATTFilter ==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-07-07 14:44 - 2016-07-07 14:44 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{8DE20E2C-F151-4221-9209-2194974BB57C}
2016-07-07 14:15 - 2016-07-07 14:16 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-07 14:15 - 2016-07-07 14:15 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-07-07 14:15 - 2016-07-07 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-07-07 14:15 - 2016-07-07 14:15 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-07-07 14:15 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-07 14:15 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-07 14:15 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-07 14:14 - 2016-07-07 14:14 - 22851472 _____ (Malwarebytes ) C:\Users\2th Device\Desktop\mbam-setup-2.2.1.1043.exe
2016-07-07 14:08 - 2016-07-07 14:08 - 00000000 ____D C:\Users\2th Device\AppData\Roaming\Sun
2016-07-07 14:08 - 2016-07-07 14:08 - 00000000 ____D C:\Users\2th Device\.oracle_jre_usage
2016-07-07 14:07 - 2016-07-07 14:07 - 00003138 _____ C:\Windows\System32\Tasks\{2C39E08C-1170-4C0E-A757-17404D3C8BCA}
2016-07-07 14:07 - 2016-07-07 14:07 - 00000000 ____D C:\Users\2th Device\AppData\LocalLow\Oracle
2016-07-07 14:05 - 2016-07-07 14:05 - 00002267 _____ C:\Users\2th Device\Desktop\Google Chrome.lnk
2016-07-07 14:05 - 2016-07-07 14:05 - 00001441 _____ C:\Users\2th Device\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-07-06 23:54 - 2016-07-06 23:54 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{795C3731-DB20-4D0C-B9CC-C0C9C9318D87}
2016-07-06 07:28 - 2016-07-06 07:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{CB7FB0F3-AFB9-4156-9A29-975DBD924839}
2016-07-05 12:34 - 2016-07-05 12:34 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{D5C4A623-3919-4133-870F-9F4BA4834820}
2016-07-04 21:46 - 2016-07-04 21:46 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{CBF29C22-5022-4B87-A916-C0D254DDA50D}
2016-07-04 13:56 - 2016-07-04 13:56 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\QNAP
2016-07-04 09:20 - 2016-07-04 09:20 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{81E33056-09EA-4C93-818C-52D9E97CB126}
2016-07-03 14:31 - 2016-07-03 14:31 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{1B660A59-50FE-4586-AA9A-033DA1A85E15}
2016-07-02 17:41 - 2016-07-02 17:41 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{53B1E3D4-ED61-4F27-AD18-5DA3DAE0EC87}
2016-07-01 22:08 - 2016-07-01 22:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{053136E7-1096-4ECC-B1E7-63564B02F05F}
2016-07-01 07:33 - 2016-07-01 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{6E0F578D-509B-4D95-B10B-88559378D38D}
2016-06-30 14:27 - 2016-06-30 14:27 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{A6B7AF9A-5FEB-4F1B-AFBA-063EADB897D8}
2016-06-29 23:46 - 2016-06-29 23:46 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{F22A1FE5-0CEE-40EB-93E4-181052E7EE00}
2016-06-29 07:10 - 2016-06-29 07:10 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{6FBF285A-5E78-4186-B564-DF42C9245323}
2016-06-28 15:09 - 2016-06-28 15:09 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{57BD87CB-62A1-47DF-B7C2-EB5644534C9E}
2016-06-28 00:08 - 2016-06-28 00:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{FA45537E-7435-4AAE-AA5C-6BD9B6E2C820}
2016-06-27 07:36 - 2016-06-27 07:36 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{8AB2A06B-0087-4FF7-858D-F8A7B374450D}
2016-06-26 14:16 - 2016-06-26 14:16 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{5A529D9E-E0D3-4975-994D-A891F943C4C3}
2016-06-25 01:28 - 2016-06-25 01:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-24 13:44 - 2016-06-24 13:44 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{BC909CF8-7350-4B20-B040-9BDF7D2F80DB}
2016-06-23 23:53 - 2016-06-23 23:53 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{0D1A22B6-088E-4270-B7B2-3BF6B7D30668}
2016-06-23 07:29 - 2016-06-23 07:29 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{2D98EC73-4030-4D20-82CE-8C9A8721ECC5}
2016-06-22 07:30 - 2016-06-22 07:30 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{E919B40C-379E-4418-BD5F-137AE7E52459}
Code:
ATTFilter 2016-06-21 07:33 - 2016-06-21 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{9A037496-D76E-4CBE-A92C-EB440D1F216A}
2016-06-20 08:31 - 2016-06-06 18:58 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-06-20 08:31 - 2016-06-06 18:50 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-06-20 08:31 - 2016-06-03 15:05 - 01413120 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00569856 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-06-20 08:31 - 2016-05-24 01:37 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-06-20 08:31 - 2016-05-24 00:54 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-06-20 08:31 - 2016-05-22 15:06 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-06-20 08:31 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-20 08:31 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-20 08:31 - 2016-05-21 00:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-20 08:31 - 2016-05-21 00:27 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-06-20 08:31 - 2016-05-21 00:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-20 08:31 - 2016-05-21 00:10 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-06-20 08:31 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-20 08:31 - 2016-05-21 00:09 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-20 08:31 - 2016-05-21 00:09 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-06-20 08:31 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-20 08:31 - 2016-05-21 00:08 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-06-20 08:31 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-20 08:31 - 2016-05-21 00:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-20 08:31 - 2016-05-20 23:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-06-20 08:31 - 2016-05-20 23:56 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-20 08:31 - 2016-05-20 23:56 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-20 08:31 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-20 08:31 - 2016-05-20 23:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-06-20 08:31 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-20 08:31 - 2016-05-20 23:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-20 08:31 - 2016-05-20 23:48 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-06-20 08:31 - 2016-05-20 23:45 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-20 08:31 - 2016-05-20 23:45 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-20 08:31 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-20 08:31 - 2016-05-20 23:44 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-20 08:31 - 2016-05-20 23:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-06-20 08:31 - 2016-05-20 23:41 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-20 08:31 - 2016-05-20 23:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-20 08:31 - 2016-05-20 23:33 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-20 08:31 - 2016-05-20 23:32 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-06-20 08:31 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-20 08:31 - 2016-05-20 23:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-06-20 08:31 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-20 08:31 - 2016-05-20 23:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-20 08:31 - 2016-05-20 23:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-06-20 08:31 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-20 08:31 - 2016-05-20 23:23 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-06-20 08:31 - 2016-05-20 23:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-20 08:31 - 2016-05-20 23:22 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-06-20 08:31 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-20 08:31 - 2016-05-20 23:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-06-20 08:31 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-20 08:31 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-06-20 08:31 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-20 08:31 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-06-20 08:31 - 2016-05-20 23:09 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-06-20 08:31 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-20 08:31 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-20 08:31 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-20 08:31 - 2016-05-20 23:07 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-06-20 08:31 - 2016-05-20 23:07 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-06-20 08:31 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-20 08:31 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-20 08:31 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-20 08:31 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-20 08:31 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-06-20 08:31 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-20 08:31 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-06-20 08:31 - 2016-05-18 18:10 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
Code:
ATTFilter 2016-06-20 08:31 - 2016-05-18 18:09 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-20 08:31 - 2016-05-14 00:15 - 00382184 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-06-20 08:31 - 2016-05-13 23:54 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-20 08:31 - 2016-05-13 23:50 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-06-20 08:31 - 2016-05-13 23:49 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-06-20 08:31 - 2016-05-13 23:49 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-06-20 08:31 - 2016-05-13 23:27 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-20 08:31 - 2016-05-12 19:20 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-06-20 08:31 - 2016-05-12 19:20 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-20 08:31 - 2016-05-12 19:15 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00502272 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-20 08:31 - 2016-05-12 19:14 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00591872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpprefcl.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-20 08:31 - 2016-05-12 17:06 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.exe
2016-06-20 08:31 - 2016-05-12 17:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-06-20 08:31 - 2016-05-12 17:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-06-20 08:31 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpscript.dll
2016-06-20 08:31 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-06-20 08:31 - 2016-05-12 16:57 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpscript.exe
2016-06-20 08:31 - 2016-05-12 16:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-06-20 08:31 - 2016-05-12 16:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-06-20 08:31 - 2016-05-12 15:05 - 00459640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-06-20 08:31 - 2016-05-12 15:05 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-06-20 08:31 - 2016-05-12 15:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-20 08:31 - 2016-05-11 17:11 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-20 08:31 - 2016-05-11 17:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-20 08:31 - 2016-05-11 16:58 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-20 08:31 - 2016-04-14 18:46 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-06-20 08:31 - 2016-04-14 18:42 - 03243520 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
Code:
ATTFilter 2016-06-20 08:31 - 2016-04-14 18:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-06-20 08:31 - 2016-04-14 17:19 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-06-20 08:31 - 2016-04-14 17:11 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-06-20 08:31 - 2016-04-09 08:58 - 14186496 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-06-20 08:31 - 2016-04-09 08:57 - 01867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-06-20 08:31 - 2016-04-09 08:54 - 12881408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-06-20 08:31 - 2016-04-09 08:54 - 01499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-06-20 08:31 - 2016-04-09 07:53 - 03231232 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-06-20 08:31 - 2016-04-09 07:44 - 02973184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-06-20 08:31 - 2016-03-09 21:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2016-06-20 08:31 - 2016-03-09 20:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2016-06-20 07:33 - 2016-06-20 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{F9C92C92-9591-4CBC-8D23-C2F1EE89B839}
2016-06-08 02:01 - 2016-06-08 02:02 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{9E7E2EA2-CD65-42AB-9936-443166A8592D}
Code:
ATTFilter ==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-07-08 10:56 - 2014-11-12 16:23 - 00000000 ____D C:\FRST
2016-07-08 10:43 - 2015-06-17 07:32 - 00001256 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007UA.job
2016-07-08 10:39 - 2012-09-03 07:55 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-08 10:35 - 2009-07-14 06:45 - 00031872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-08 10:35 - 2009-07-14 06:45 - 00031872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-08 10:30 - 2012-09-12 13:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\Adobe
2016-07-08 10:29 - 2012-02-02 10:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-08 10:27 - 2011-04-12 09:43 - 00699432 _____ C:\Windows\system32\perfh007.dat
2016-07-08 10:27 - 2011-04-12 09:43 - 00149572 _____ C:\Windows\system32\perfc007.dat
2016-07-08 10:27 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-08 10:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-07-08 10:20 - 2016-03-24 11:51 - 00008192 _____ C:\Windows\SysWOW64\WDPABKP.dat
2016-07-08 10:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-08 01:38 - 2012-02-02 10:37 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-07 16:43 - 2015-06-17 07:32 - 00001204 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007Core.job
2016-07-07 14:09 - 2012-06-28 12:40 - 00000000 ____D C:\Program Files (x86)\Java
2016-07-07 14:08 - 2016-03-30 13:19 - 00097344 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-07-07 14:08 - 2016-03-30 13:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-07-07 14:08 - 2012-07-28 12:34 - 00000000 ____D C:\Users\2th Device
2016-07-07 14:05 - 2012-07-28 12:34 - 00247656 _____ C:\Users\2th Device\AppData\Local\GDIPFONTCACHEV1.DAT
2016-07-07 13:43 - 2016-05-01 15:00 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\Mozilla Firefox
2016-07-07 02:39 - 2010-11-21 05:27 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-07-03 14:59 - 2011-11-24 16:49 - 00000454 _____ C:\Windows\Tasks\Intel_C_CVPR135003JA120LGN.job
2016-07-03 00:59 - 2012-09-12 19:02 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\VUPlayer
2016-06-25 01:28 - 2012-11-16 14:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Dropbox
2016-06-24 07:24 - 2012-07-03 15:09 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-24 07:24 - 2012-07-03 15:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-23 23:59 - 2012-07-03 15:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-23 17:32 - 2012-09-27 17:04 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Audacity
2016-06-23 13:08 - 2013-10-22 13:57 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\vlc
2016-06-21 08:42 - 2016-04-17 00:02 - 00000000 ____D C:\Windows\rescache
2016-06-21 07:31 - 2009-07-14 06:45 - 05836224 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-21 07:29 - 2014-12-10 15:49 - 00000000 ____D C:\Windows\system32\appraiser
2016-06-21 00:22 - 2013-08-14 12:07 - 00000000 ____D C:\Windows\system32\MRT
2016-06-21 00:17 - 2011-11-24 13:00 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-06-19 20:39 - 2012-09-03 07:55 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-19 20:39 - 2012-04-05 09:01 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-19 20:39 - 2011-11-24 13:39 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-19 19:03 - 2015-03-31 18:27 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Code:
ATTFilter ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2012-09-10 17:18 - 2012-09-10 17:19 - 0000051 _____ () C:\ProgramData\gbaxoojxsqbytto
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1612934075-448063179-3665729200-1003\$b19d41baccfed3b9c4be273e1cdb6755
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$b19d41baccfed3b9c4be273e1cdb6755
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\Public\AlexaNSISPlugin.2976.dll
Einige Dateien in TEMP:
====================
C:\Users\Toni Standard\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvcezkw.dll
C:\Users\Toni Standard\AppData\Local\Temp\i4jdel0.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u91-windows-au.exe
Code:
ATTFilter ==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-07-07 08:15
==================== Ende von FRST.txt ============================
Ich danke Euch im vorab schon mal für Eure Hilfe... Beste Grüße...Toni |
|
08.07.2016, 12:00
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | System ist von Schadsoftware befallen So ist das irgendwie zu unübersichtlich...und tw. auch unvollständig!
__________________poste bitte einmal richtig die FRST.txt und Addition.txt in einem Rutsch. Wenn zu groß probier pro Log einen Beitrag zu erstellen.
__________________ |
|
08.07.2016, 12:25
| #3 |
| | System ist von Schadsoftware befallen Hi Cosinus,...
__________________alles in einem Rutsch geht ja gar nicht. Kommt jedes Mal die Meldung "zu viele Zeichen"... Wie soll ich "pro Log" einen Beitrag erstellen..?!?!? |
|
08.07.2016, 12:42
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallen Ein Log in einem Rutsch meinte ich. Poste erstmal die FRST.txt vollständig. Dann sehen wir weiter.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.07.2016, 12:52
| #5 |
| | System ist von Schadsoftware befallen FRST.txt Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
durchgeführt von 2th Device (Administrator) auf TONI-PC (08-07-2016 10:56:50)
Gestartet von L:\T\TECHNICS PC\PC Security\Farbar Recovery Scan Tool FRST64\2016-07
Geladene Profile: 2th Device & Toni Standard (Verfügbare Profile: Toni_02 & 2th Device & Toni Standard & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMWDSrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\QVssService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe
() C:\Users\Toni Standard\AppData\Local\Amazon Music\Amazon Music Helper.exe
(QNAP Systems, Inc.) C:\Program Files (x86)\QNAP\Qsync\Qsync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files (x86)\QNAP\QGet\QGet.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Program Files (x86)\QNAP\QGet\QGetServer.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe
() C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMConfig.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMProcess.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe
(QNAP) C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\Enclosure.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
() C:\Program Files (x86)\QNAP\QGet\QGet.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files (x86)\QNAP\QGet\QGetServer.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe
() C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMConfig.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMProcess.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe
(QNAP) C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11776104 2011-02-11] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-09-24] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-09-24] (Adobe Systems Inc.)
HKLM-x32\...\Run: [KMConfig] => "C:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe" KMConfig.exe
HKLM-x32\...\Run: [WheelMouse] => C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE [61440 2000-05-08] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2012-01-13] (Nero AG)
HKLM-x32\...\Run: [SAFE2012 HotKeys] => C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe [84480 2012-11-19] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE2012 File Redirection Starter] => C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe [17408 2012-11-19] (Steganos Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QGet] => C:\Program Files (x86)\QNAP\QGet\QGet.exe [6965968 2013-01-11] ()
HKLM-x32\...\Run: [NetworkDriveAgent] => C:\Program Files (x86)\QNAP\myQNAPcloud Connect\NetworkDriveAgent.exe [1743592 2014-12-24] (QNAP)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-07-20] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1612934075-448063179-3665729200-1005\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\Music and more\DAEMON Tools Lite\DTLite.exe [3481408 2012-02-13] (DT Soft Ltd)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [CSmileys] => "C:\Program Files (x86)\Crawler\Smileys\CSmileysIM.exe"
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Amazon Music] => C:\Users\Toni Standard\AppData\Local\Amazon Music\Amazon Music Helper.exe [5886784 2015-04-21] ()
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Dropbox Update] => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Run: [Qsync] => C:\Program Files (x86)\QNAP\Qsync\Qsync.exe [18315472 2015-10-16] (QNAP Systems, Inc.)
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\MountPoints2: {0276705e-2a81-11e2-aa71-50e5493e14f5} - J:\unlock.exe autoplay=true
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\MountPoints2: {530ae508-febe-11e2-b141-50e5493e14f5} - S:\pushinst.exe
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ QsyncEx_Icon1] -> {9EF65B94-EC0D-49F7-B46D-006B388EB03E} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon2] -> {8431CA36-5AD0-49EA-884E-B6BFE502BD90} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon3] -> {3047FAEE-0237-49BB-B4D9-26F5DE6DA2E8} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon4] -> {FACE7498-EE29-467E-AFDD-74BEB6C53239} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-09-07] ()
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\2th Device\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Action Manager 32.lnk [2012-01-18]
ShortcutTarget: Action Manager 32.lnk -> C:\Program Files (x86)\Plustek\OpticPro ST48\AM32.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QNAP QGet.lnk [2015-03-23]
ShortcutTarget: QNAP QGet.lnk -> C:\Program Files (x86)\QNAP\QGet\QGet.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2014-11-14]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Toni Standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-06-25]
ShortcutTarget: Dropbox.lnk -> C:\Users\2th Device\AppData\Roaming\Dropbox\bin\Dropbox.exe (Keine Datei)
Startup: C:\Users\Toni_02\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-08-09]
ShortcutTarget: Dropbox.lnk -> C:\Users\2th Device\AppData\Roaming\Dropbox\bin\Dropbox.exe (Keine Datei)
GroupPolicy: Beschränkung - Chrome <======= ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{86EA66A2-B974-40D7-B70D-DF7EF99D26E7}: [NameServer] 192.168.2.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKU\S-1-5-21-1612934075-448063179-3665729200-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.de/?gfe_rd=cr&ei=MGZ_V7XhC-ak8wfU06OQAQ&gws_rd=ssl
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-07] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-07] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1612934075-448063179-3665729200-1007 -> Kein Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Keine Datei
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-19] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-06] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-19] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1221171.dll [2015-10-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-07-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-07-07] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2015-02-11] (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-06] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-1612934075-448063179-3665729200-1007: @phonostar.de/phonostar -> C:\Users\Toni Standard\Documents\dradio-Recorder\npphonostarDetectNP.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1612934075-448063179-3665729200-1007: @www.flatcast.com/FlatViewer 5.2 -> C:\PROGRA~2\MOZILL~1\browser\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\gmpopenh264.dll [2015-12-18] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\NpFv522.dll [2009-09-21] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\NpFv530.dll [2011-09-23] (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2015-10-24] [ist nicht signiert]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S3 BITCOMET_HELPER_SERVICE; C:\Program Files (x86)\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
R2 KMWDSERVICE; C:\Program Files (x86)\Multimedia Keyboard Driver\V5\KMWDSrv.exe [2179072 2007-05-08] (UASSOFT.COM) [Datei ist nicht signiert]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [Datei ist nicht signiert]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2015-03-19] (The OpenVPN Project)
R2 QVssService; C:\Program Files\QNAP\NetBak\QVssService.exe [2203824 2015-02-09] (QNAP Systems, Inc.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-10-28] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [307576 2015-10-28] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [671512 2014-12-22] (Wacom Technology, Corp.)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-02-27] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 HPMo4DE3; C:\Windows\System32\DRIVERS\HPMo4DE3.sys [25088 2011-03-09] (TPMX Electronics Ltd.)
S3 HPub4DE3; C:\Windows\System32\Drivers\HPub4DE3.sys [18432 2011-04-12] (TPMX Electronics Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564792 2012-02-27] (Duplex Secure Ltd.)
R3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] ()
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [8944 1999-05-05] (Microsoft Corporation) [Datei ist nicht signiert]
U3 apbwtjiq; C:\Windows\System32\Drivers\apbwtjiq.sys [0 ] (Elaborate Bytes AG) <==== ACHTUNG (Null Byte Datei/Ordner)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 QDrive; \??\C:\Users\Toni_02\AppData\Local\Temp\QDrive.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-07-07 14:44 - 2016-07-07 14:44 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{8DE20E2C-F151-4221-9209-2194974BB57C}
2016-07-07 14:15 - 2016-07-07 14:16 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-07 14:15 - 2016-07-07 14:15 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-07-07 14:15 - 2016-07-07 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-07-07 14:15 - 2016-07-07 14:15 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-07-07 14:15 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-07 14:15 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-07 14:15 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-07 14:14 - 2016-07-07 14:14 - 22851472 _____ (Malwarebytes ) C:\Users\2th Device\Desktop\mbam-setup-2.2.1.1043.exe
2016-07-07 14:08 - 2016-07-07 14:08 - 00000000 ____D C:\Users\2th Device\AppData\Roaming\Sun
2016-07-07 14:08 - 2016-07-07 14:08 - 00000000 ____D C:\Users\2th Device\.oracle_jre_usage
2016-07-07 14:07 - 2016-07-07 14:07 - 00003138 _____ C:\Windows\System32\Tasks\{2C39E08C-1170-4C0E-A757-17404D3C8BCA}
2016-07-07 14:07 - 2016-07-07 14:07 - 00000000 ____D C:\Users\2th Device\AppData\LocalLow\Oracle
2016-07-07 14:05 - 2016-07-07 14:05 - 00002267 _____ C:\Users\2th Device\Desktop\Google Chrome.lnk
2016-07-07 14:05 - 2016-07-07 14:05 - 00001441 _____ C:\Users\2th Device\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-07-06 23:54 - 2016-07-06 23:54 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{795C3731-DB20-4D0C-B9CC-C0C9C9318D87}
2016-07-06 07:28 - 2016-07-06 07:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{CB7FB0F3-AFB9-4156-9A29-975DBD924839}
2016-07-05 12:34 - 2016-07-05 12:34 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{D5C4A623-3919-4133-870F-9F4BA4834820}
2016-07-04 21:46 - 2016-07-04 21:46 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{CBF29C22-5022-4B87-A916-C0D254DDA50D}
2016-07-04 13:56 - 2016-07-04 13:56 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\QNAP
2016-07-04 09:20 - 2016-07-04 09:20 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{81E33056-09EA-4C93-818C-52D9E97CB126}
2016-07-03 14:31 - 2016-07-03 14:31 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{1B660A59-50FE-4586-AA9A-033DA1A85E15}
2016-07-02 17:41 - 2016-07-02 17:41 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{53B1E3D4-ED61-4F27-AD18-5DA3DAE0EC87}
2016-07-01 22:08 - 2016-07-01 22:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{053136E7-1096-4ECC-B1E7-63564B02F05F}
2016-07-01 07:33 - 2016-07-01 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{6E0F578D-509B-4D95-B10B-88559378D38D}
2016-06-30 14:27 - 2016-06-30 14:27 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{A6B7AF9A-5FEB-4F1B-AFBA-063EADB897D8}
2016-06-29 23:46 - 2016-06-29 23:46 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{F22A1FE5-0CEE-40EB-93E4-181052E7EE00}
2016-06-29 07:10 - 2016-06-29 07:10 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{6FBF285A-5E78-4186-B564-DF42C9245323}
2016-06-28 15:09 - 2016-06-28 15:09 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{57BD87CB-62A1-47DF-B7C2-EB5644534C9E}
2016-06-28 00:08 - 2016-06-28 00:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{FA45537E-7435-4AAE-AA5C-6BD9B6E2C820}
2016-06-27 07:36 - 2016-06-27 07:36 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{8AB2A06B-0087-4FF7-858D-F8A7B374450D}
2016-06-26 14:16 - 2016-06-26 14:16 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{5A529D9E-E0D3-4975-994D-A891F943C4C3}
2016-06-25 01:28 - 2016-06-25 01:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-24 13:44 - 2016-06-24 13:44 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{BC909CF8-7350-4B20-B040-9BDF7D2F80DB}
2016-06-23 23:53 - 2016-06-23 23:53 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{0D1A22B6-088E-4270-B7B2-3BF6B7D30668}
2016-06-23 07:29 - 2016-06-23 07:29 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{2D98EC73-4030-4D20-82CE-8C9A8721ECC5}
2016-06-22 07:30 - 2016-06-22 07:30 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{E919B40C-379E-4418-BD5F-137AE7E52459}
2016-06-21 07:33 - 2016-06-21 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{9A037496-D76E-4CBE-A92C-EB440D1F216A}
2016-06-20 08:31 - 2016-06-06 18:58 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-06-20 08:31 - 2016-06-06 18:50 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-06-20 08:31 - 2016-06-03 15:05 - 01413120 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00569856 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-06-20 08:31 - 2016-05-27 15:06 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-06-20 08:31 - 2016-05-24 01:37 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-06-20 08:31 - 2016-05-24 00:54 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-06-20 08:31 - 2016-05-22 15:06 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-06-20 08:31 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-20 08:31 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-20 08:31 - 2016-05-21 00:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-20 08:31 - 2016-05-21 00:27 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-06-20 08:31 - 2016-05-21 00:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-20 08:31 - 2016-05-21 00:10 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-06-20 08:31 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-20 08:31 - 2016-05-21 00:09 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-20 08:31 - 2016-05-21 00:09 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-06-20 08:31 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-20 08:31 - 2016-05-21 00:08 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-06-20 08:31 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-20 08:31 - 2016-05-21 00:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-20 08:31 - 2016-05-20 23:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-06-20 08:31 - 2016-05-20 23:57 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-06-20 08:31 - 2016-05-20 23:56 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-20 08:31 - 2016-05-20 23:56 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-20 08:31 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-06-20 08:31 - 2016-05-20 23:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-20 08:31 - 2016-05-20 23:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-06-20 08:31 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-20 08:31 - 2016-05-20 23:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-20 08:31 - 2016-05-20 23:48 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-06-20 08:31 - 2016-05-20 23:45 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-20 08:31 - 2016-05-20 23:45 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-20 08:31 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-20 08:31 - 2016-05-20 23:44 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-20 08:31 - 2016-05-20 23:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-06-20 08:31 - 2016-05-20 23:41 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-20 08:31 - 2016-05-20 23:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-20 08:31 - 2016-05-20 23:33 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-20 08:31 - 2016-05-20 23:32 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-06-20 08:31 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-20 08:31 - 2016-05-20 23:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-06-20 08:31 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-20 08:31 - 2016-05-20 23:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-20 08:31 - 2016-05-20 23:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-06-20 08:31 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-20 08:31 - 2016-05-20 23:23 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-06-20 08:31 - 2016-05-20 23:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-20 08:31 - 2016-05-20 23:22 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-06-20 08:31 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-20 08:31 - 2016-05-20 23:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-06-20 08:31 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-20 08:31 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-06-20 08:31 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-20 08:31 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-06-20 08:31 - 2016-05-20 23:09 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-06-20 08:31 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-20 08:31 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-20 08:31 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-20 08:31 - 2016-05-20 23:07 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-06-20 08:31 - 2016-05-20 23:07 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-06-20 08:31 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-20 08:31 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-20 08:31 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-20 08:31 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-20 08:31 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-06-20 08:31 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-20 08:31 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-06-20 08:31 - 2016-05-18 18:10 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-20 08:31 - 2016-05-18 18:09 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-20 08:31 - 2016-05-14 00:15 - 00382184 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-06-20 08:31 - 2016-05-14 00:09 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-06-20 08:31 - 2016-05-13 23:54 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-20 08:31 - 2016-05-13 23:50 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-06-20 08:31 - 2016-05-13 23:49 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-06-20 08:31 - 2016-05-13 23:49 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-06-20 08:31 - 2016-05-13 23:27 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-20 08:31 - 2016-05-12 19:20 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-06-20 08:31 - 2016-05-12 19:20 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-20 08:31 - 2016-05-12 19:15 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-06-20 08:31 - 2016-05-12 19:15 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\gpprefcl.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00502272 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-20 08:31 - 2016-05-12 19:14 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-06-20 08:31 - 2016-05-12 19:14 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00591872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpprefcl.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-06-20 08:31 - 2016-05-12 17:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-20 08:31 - 2016-05-12 17:06 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\gpscript.exe
2016-06-20 08:31 - 2016-05-12 17:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-06-20 08:31 - 2016-05-12 17:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-06-20 08:31 - 2016-05-12 16:58 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-06-20 08:31 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpscript.dll
2016-06-20 08:31 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-06-20 08:31 - 2016-05-12 16:57 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpscript.exe
2016-06-20 08:31 - 2016-05-12 16:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-06-20 08:31 - 2016-05-12 16:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-06-20 08:31 - 2016-05-12 15:05 - 00459640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-06-20 08:31 - 2016-05-12 15:05 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-06-20 08:31 - 2016-05-12 15:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-20 08:31 - 2016-05-11 19:02 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-20 08:31 - 2016-05-11 17:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-20 08:31 - 2016-05-11 17:11 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-20 08:31 - 2016-05-11 17:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-20 08:31 - 2016-05-11 16:58 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-20 08:31 - 2016-04-14 18:46 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-06-20 08:31 - 2016-04-14 18:42 - 03243520 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-06-20 08:31 - 2016-04-14 18:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-06-20 08:31 - 2016-04-14 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-06-20 08:31 - 2016-04-14 17:19 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-06-20 08:31 - 2016-04-14 17:11 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-06-20 08:31 - 2016-04-09 08:58 - 14186496 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-06-20 08:31 - 2016-04-09 08:57 - 01867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-06-20 08:31 - 2016-04-09 08:54 - 12881408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-06-20 08:31 - 2016-04-09 08:54 - 01499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-06-20 08:31 - 2016-04-09 07:53 - 03231232 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-06-20 08:31 - 2016-04-09 07:44 - 02973184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-06-20 08:31 - 2016-03-09 21:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2016-06-20 08:31 - 2016-03-09 20:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2016-06-20 07:33 - 2016-06-20 07:33 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{F9C92C92-9591-4CBC-8D23-C2F1EE89B839}
2016-06-08 02:01 - 2016-06-08 02:02 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\{9E7E2EA2-CD65-42AB-9936-443166A8592D}
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-07-08 10:56 - 2014-11-12 16:23 - 00000000 ____D C:\FRST
2016-07-08 10:43 - 2015-06-17 07:32 - 00001256 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007UA.job
2016-07-08 10:39 - 2012-09-03 07:55 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-08 10:35 - 2009-07-14 06:45 - 00031872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-08 10:35 - 2009-07-14 06:45 - 00031872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-08 10:30 - 2012-09-12 13:28 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\Adobe
2016-07-08 10:29 - 2012-02-02 10:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-08 10:27 - 2011-04-12 09:43 - 00699432 _____ C:\Windows\system32\perfh007.dat
2016-07-08 10:27 - 2011-04-12 09:43 - 00149572 _____ C:\Windows\system32\perfc007.dat
2016-07-08 10:27 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-08 10:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-07-08 10:20 - 2016-03-24 11:51 - 00008192 _____ C:\Windows\SysWOW64\WDPABKP.dat
2016-07-08 10:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-08 01:38 - 2012-02-02 10:37 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-07 16:43 - 2015-06-17 07:32 - 00001204 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007Core.job
2016-07-07 14:09 - 2012-06-28 12:40 - 00000000 ____D C:\Program Files (x86)\Java
2016-07-07 14:08 - 2016-03-30 13:19 - 00097344 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-07-07 14:08 - 2016-03-30 13:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-07-07 14:08 - 2012-07-28 12:34 - 00000000 ____D C:\Users\2th Device
2016-07-07 14:05 - 2012-07-28 12:34 - 00247656 _____ C:\Users\2th Device\AppData\Local\GDIPFONTCACHEV1.DAT
2016-07-07 13:43 - 2016-05-01 15:00 - 00000000 ____D C:\Users\Toni Standard\AppData\Local\Mozilla Firefox
2016-07-07 02:39 - 2010-11-21 05:27 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-07-03 14:59 - 2011-11-24 16:49 - 00000454 _____ C:\Windows\Tasks\Intel_C_CVPR135003JA120LGN.job
2016-07-03 00:59 - 2012-09-12 19:02 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\VUPlayer
2016-06-25 01:28 - 2012-11-16 14:08 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Dropbox
2016-06-24 07:24 - 2012-07-03 15:09 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-24 07:24 - 2012-07-03 15:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-23 23:59 - 2012-07-03 15:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-23 17:32 - 2012-09-27 17:04 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\Audacity
2016-06-23 13:08 - 2013-10-22 13:57 - 00000000 ____D C:\Users\Toni Standard\AppData\Roaming\vlc
2016-06-21 08:42 - 2016-04-17 00:02 - 00000000 ____D C:\Windows\rescache
2016-06-21 07:31 - 2009-07-14 06:45 - 05836224 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-21 07:29 - 2014-12-10 15:49 - 00000000 ____D C:\Windows\system32\appraiser
2016-06-21 00:22 - 2013-08-14 12:07 - 00000000 ____D C:\Windows\system32\MRT
2016-06-21 00:17 - 2011-11-24 13:00 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-06-19 20:39 - 2012-09-03 07:55 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-19 20:39 - 2012-04-05 09:01 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-19 20:39 - 2011-11-24 13:39 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-19 19:03 - 2015-03-31 18:27 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2012-09-10 17:18 - 2012-09-10 17:19 - 0000051 _____ () C:\ProgramData\gbaxoojxsqbytto
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1612934075-448063179-3665729200-1003\$b19d41baccfed3b9c4be273e1cdb6755
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$b19d41baccfed3b9c4be273e1cdb6755
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\Public\AlexaNSISPlugin.2976.dll
Einige Dateien in TEMP:
====================
C:\Users\Toni Standard\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvcezkw.dll
C:\Users\Toni Standard\AppData\Local\Temp\i4jdel0.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\Toni Standard\AppData\Local\Temp\jre-8u91-windows-au.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-07-07 08:15
==================== Ende von FRST.txt ============================
|
|
08.07.2016, 12:53
| #6 |
| | System ist von Schadsoftware befallen Addition.txt Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 02-07-2016
durchgeführt von 2th Device (2016-07-08 10:57:19)
Gestartet von L:\T\TECHNICS PC\PC Security\Farbar Recovery Scan Tool FRST64\2016-07
Windows 7 Professional Service Pack 1 (X64) (2011-11-24 10:16:27)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
2th Device (S-1-5-21-1612934075-448063179-3665729200-1005 - Administrator - Enabled) => C:\Users\2th Device
3th Device (S-1-5-21-1612934075-448063179-3665729200-1006 - Limited - Enabled)
Administrator (S-1-5-21-1612934075-448063179-3665729200-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-1612934075-448063179-3665729200-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1612934075-448063179-3665729200-1002 - Limited - Enabled)
Toni Standard (S-1-5-21-1612934075-448063179-3665729200-1007 - Limited - Enabled) => C:\Users\Toni Standard
Toni_02 (S-1-5-21-1612934075-448063179-3665729200-1003 - Administrator - Enabled) => C:\Users\TEMP.Toni-PC.002
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.16 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 21.0.0.176 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Creative Suite 5.5 Design Premium (HKLM-x32\...\{60E59A6C-7399-495A-B85C-C829F4E59602}) (Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 22 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.1.171 - Adobe Systems, Inc.)
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1) (Version: 2.0 Build 230 - Adobe Systems Incorporated.)
Advanced PSD Repair v1.4 (HKLM-x32\...\Advanced PSD Repair v1.4) (Version: - )
Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.3.4 - Sereby Corporation)
Amazon Music (HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Amazon Amazon Music) (Version: 3.9.3.797 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.8.9046 - )
BitComet 1.37 (HKLM-x32\...\BitComet) (Version: 1.37 - CometNetwork)
Canon iP4600 series Benutzerregistrierung (HKLM-x32\...\Canon iP4600 series Benutzerregistrierung) (Version: - )
Canon iP4600 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series) (Version: - )
Canon Utilities EOS Lens Registration Tool (HKLM-x32\...\EOS Lens Registration Tool) (Version: 1.2.10.0 - Canon Inc.)
Canon Utilities EOS Utility 2 (HKLM-x32\...\EOS Utility 2) (Version: 2.14.20.0 - Canon Inc.)
Canon Utilities EOS Web Service Registration Tool (HKLM-x32\...\EOS Web Service Registration Tool) (Version: 1.2.10.0 - Canon Inc.)
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities WFT Utility (HKLM-x32\...\WFTK) (Version: 3.5.1.1 - Canon Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
ConvertHelper 3.1.1 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version: - DownloadHelper)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.3.0297 - DT Soft Ltd)
DAPlayer 1.0.1.9 (HKLM-x32\...\DAPlayer_is1) (Version: - Digiarty Software,Inc.)
Das große DGS Wörterbuch 1.0.2.9 (HKLM-x32\...\{71FB874A-A992-4ED6-9522-6EFF78ADDDCB}_is1) (Version: - Verlag Karin Kestner)
Dropbox (HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Dropbox) (Version: 5.4.24 - Dropbox, Inc.)
DVDFab 8.2.2.6 (25/12/2012) Qt (HKLM-x32\...\DVDFab 8 Qt_is1) (Version: - Fengtao Software Inc.)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.98 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.98 - Etron Technology) Hidden
Exact Audio Copy 1.1 (HKLM-x32\...\Exact Audio Copy) (Version: 1.1 - Andre Wiethoff)
FFmpeg v0.6.2 for Audacity (HKLM-x32\...\FFmpeg for Audacity_is1) (Version: - )
File Repair (HKLM-x32\...\File Repair_is1) (Version: - File Repair)
FileZilla Client 3.11.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.11.0.2 - Tim Kosse)
FLAC 1.2.1b (remove only) (HKLM-x32\...\FLAC) (Version: 1.2.1b - Xiph.org)
Flatcast Viewer Plugin 5.3.0.784 (HKLM-x32\...\Flatcast Viewer 5.3_is1) (Version: - 1 mal 1 Software GmbH)
Free Audio Converter version 5.0.57.219 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.57.219 - DVDVideoSoft Ltd.)
Free AVI Video Converter version 5.0.17.903 (HKLM-x32\...\Free AVI Video Converter_is1) (Version: 5.0.17.903 - DVDVideoSoft Ltd.)
Free MP4 Video Converter version 5.0.61.805 (HKLM-x32\...\Free MP4 Video Converter_is1) (Version: 5.0.61.805 - DVDVideoSoft Ltd.)
Free Video Dub version (HKLM-x32\...\Free Video Dub_is1) (Version: - DVDVideoSoft Ltd.)
FVD Suite 3.0.0 (HKLM-x32\...\{80E4B2D6-BFF2-402C-96C4-3942DF24CABB}_is1) (Version: - flashvideodownloader.org)
GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)
Gimp Themes v1.0 (HKLM-x32\...\{833D97B9-AC16-45C1-AD44-0A32198956F8}) (Version: 1.0.0 - www.gimp-tutorials.net)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
HandBrake 0.9.5 (HKLM-x32\...\HandBrake) (Version: 0.9.5 - )
HashCheck Shell Extension (x86-32) (HKLM-x32\...\HashCheck Shell Extension) (Version: 2.1.11.1 - Kai Liu)
HashCheck Shell Extension (x86-64) (HKLM\...\HashCheck Shell Extension) (Version: 2.1.11.1 - Kai Liu)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.7.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Intel(R) Solid-State Drive Toolbox (HKLM-x32\...\Intel(R) Solid-State Drive Toolbox) (Version: 3.0.1.400 - Intel Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
LightScribe System Software (HKLM-x32\...\{F132000C-1CBA-458F-BF2F-FD43D59410F9}) (Version: 1.18.27.10 - LightScribe)
MakeMKV v1.7.10 (HKLM-x32\...\MakeMKV) (Version: v1.7.10 - GuinpinSoft inc)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM-x32\...\Microsoft Visual J# 2.0 Redistributable Package) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mouse Driver V1.0 (HKLM-x32\...\WheelMouse) (Version: - )
Movavi Video Suite 12 (HKLM-x32\...\Movavi Video Suite 12) (Version: 12.3.0 - Movavi)
Mozilla Firefox 38.7.0 ESR (x86 de) (HKLM-x32\...\Mozilla Firefox 38.7.0 ESR (x86 de)) (Version: 38.7.0 - Mozilla)
Mozilla Firefox 42.0 (x64 de) (HKLM\...\Mozilla Firefox 42.0 (x64 de)) (Version: 42.0 - Mozilla)
Mozilla Firefox 46.0 (x86 de) (HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\Mozilla Firefox 46.0 (x86 de)) (Version: 46.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.7.0 - Mozilla)
MPC-HC 1.7.7 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.7 - MPC-HC Team)
Multimedia Keyboard Driver (HKLM-x32\...\InstallShield_{51B46054-AE28-4BCD-8DE8-3901354F0A1C}) (Version: 2.0 - Ihr Firmenname)
Multimedia Keyboard Driver (x32 Version: 2.0 - Ihr Firmenname) Hidden
Nero 11 (HKLM-x32\...\{FC18AB8F-9BA3-423B-91F2-622990F57978}) (Version: 11.2.01000 - Nero AG)
Nero 11 Platinum (HKLM-x32\...\{DC99552E-8149-4EBB-8812-6069956056AA}) (Version: 11.2.01800 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)
Nero Info (HKLM-x32\...\{F030BFE8-8476-4C08-A553-233DE80A2BE1}) (Version: 16.0.1009 - Nero AG)
Nero Prerequisite Installer 1.0 (HKLM-x32\...\{E4B86819-E9B8-4089-963B-DF5E70E7A05E}) (Version: 11.0.13100 - Nero AG)
OpenOffice 4.1.2 (HKLM-x32\...\{F5CAB1AF-7B1A-4CEC-B829-A3F699473AE1}) (Version: 4.12.9782 - Apache Software Foundation)
OpenVPN 2.3.6-I603 (HKLM\...\OpenVPN) (Version: 2.3.6-I603 - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Plustek OpticPro ST48 (HKLM-x32\...\{5265664F-6128-405C-9225-9782A85954FD}) (Version: V4.2.0 - )
Port Forward Network Utilities 2.0.1 (HKLM-x32\...\Port Forward Network Utilities) (Version: 2.0.1 - Portforward.com)
QNAP Finder (HKLM-x32\...\QNAP_FINDER) (Version: 3.6.5.1030 - QNAP Systems, Inc.)
QNAP myQNAPcloud Connect (HKLM-x32\...\myQNAPcloud Connect) (Version: 1.2.0.1224 - QNAP Systems, Inc.)
QNAP NetBak Replicator (HKLM-x32\...\NetBak) (Version: 4.5.0.0209 - QNAP Systems, Inc.)
QNAP QGet (HKLM-x32\...\QGet) (Version: 3.1.0.1311 - QNAP Systems, Inc.)
QNAP Qsync Client (HKLM-x32\...\Qsync) (Version: 2.2.0.1016 - QNAP Systems, Inc.)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.38.113.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6307 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roadkil's Unstoppable Copier Version 5.2 (HKLM-x32\...\{A306FD29-7D3A-4287-91AC-9A0180931395}_is1) (Version: - Roadkil.Net)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SpywareBlaster 5.4 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.4.0 - BrightFort LLC)
Static Windows Live Mail Backup 2.9 (HKLM-x32\...\Static Windows Live Mail Backup_is1) (Version: - StaticBackup Inc.)
Steganos Safe 2012 (HKLM-x32\...\{FADC3DC0-BCD9-4F6A-BB9D-360D695C5791}) (Version: 13.0.5 - Steganos Software GmbH)
SUPER © v2012.build.53 (Sep 13, 2012) Version v2012.build.53 (HKLM-x32\...\{8F311E72-C27F-4DF0-8254-B739A1831668}_is1) (Version: v2012.build.53 - eRightSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TAP-Windows 9.21.1 (HKLM\...\TAP-Windows) (Version: 9.21.1 - )
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.2 - VideoLAN)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.2 - VideoLAN)
Voice Manager (HKLM-x32\...\Voice Manager) (Version: - )
VUPlayer (HKLM-x32\...\VUPlayer) (Version: - )
Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.4.0.0 - Azureus Software, Inc.)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.11w3 - Wacom Technology Corp.)
WD Quick View (HKLM-x32\...\{4D0776BB-71B7-49A2-A439-24791A4620E1}) (Version: 2.4.14.13 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{37BF2365-3EC7-45E4-9D88-61489F932A0B}) (Version: 2.4.14.13 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM-x32\...\{e72369b3-306a-4d10-a766-3433a65e8dc2}) (Version: 2.4.14.13 - Western Digital Technologies, Inc.)
WD Software Upgrader (HKLM-x32\...\{57C4F272-9839-45C6-8B83-92EC89C7EE40}) (Version: 1.6.4.7 - Western Digital Technologies, Inc.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0 - Nero AG) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
WinRAR (HKLM-x32\...\WinRAR archiver) (Version: - )
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WinZip 18.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E3}) (Version: 18.5.11111 - WinZip Computing, S.L. )
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1612934075-448063179-3665729200-1007_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {01C98F86-D024-40F7-9286-17A2360D045D} - System32\Tasks\{2C39E08C-1170-4C0E-A757-17404D3C8BCA} => pcalua.exe -a "L:\T\Technics WWW\Java\jxpiinstall.exe" -d "L:\T\Technics WWW\Java"
Task: {07298B62-AB63-4D16-8593-20F459E1144F} - System32\Tasks\Toni Standard NBAgent 6 0 => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [2012-01-13] (Nero AG)
Task: {10082E4E-D1B8-4DDB-9609-26A6252A0E30} - System32\Tasks\AdobeAAMUpdater-1.0-Toni-PC-Toni_02 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05] (Adobe Systems Incorporated)
Task: {1690685D-71E6-4CB7-90CB-0F3AD122048C} - System32\Tasks\Intel_C_CVPR135003JA120LGN => C:\Program Files (x86)\Intel\Intel(R) Solid-State Drive Toolbox\Intel SSD Toolbox.exe [2011-10-28] (Intel)
Task: {2427FB15-D042-454D-8CE5-6881FE079A05} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-19] (Adobe Systems Incorporated)
Task: {2B9204A4-BAED-4B35-820A-FF57880B4D22} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007Core => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {31E3062F-0187-4B62-B34A-DA952DC139F6} - System32\Tasks\AdobeAAMUpdater-1.0-Toni-PC-Toni Standard => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05] (Adobe Systems Incorporated)
Task: {3A3EA6FE-CA28-48AB-BC05-6E67E50408C2} - System32\Tasks\2012-09-19 Extern Backup2 => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBCore.exe [2012-01-13] (Nero AG)
Task: {4F0BF786-9CAD-47A1-B546-BBF3E0227627} - System32\Tasks\{73545F23-3EAC-4748-A58F-2AF22C39E125} => pcalua.exe -a E:\INSTALL.EXE -d E:\
Task: {53FDD868-CC81-435C-845D-04FDB30781AB} - System32\Tasks\AdobeAAMUpdater-1.0-Toni-PC-Toni => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05] (Adobe Systems Incorporated)
Task: {61606953-602C-474D-B8CC-15A4431B29E4} - System32\Tasks\{D04F5992-B833-4BAC-9E1E-B4D881ADF222} => pcalua.exe -a E:\SETUP.exe -d E:\
Task: {7ACB2E6A-6F46-4C07-963F-304DB0307226} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {7EA40B15-06DC-45B8-AD05-CC3568C24EC6} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2015-05-06] (Nero AG)
Task: {80AFBF9D-4E99-431D-8677-BC33207EA6AB} - System32\Tasks\NetBakAutoStartup => C:\Program Files\QNAP\NetBak\Enclosure.exe [2015-02-09] (QNAP Systems, Inc.)
Task: {8838669A-0AC3-401A-B28F-DDBEB7E5299F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {8851877E-752D-409B-B188-95D2967021A2} - System32\Tasks\NetBak-Toni-PC-Toni_02-AutoStartup => C:\Program Files\QNAP\NetBak\NetBak.exe [2015-02-09] (QNAP Systems, Inc.)
Task: {8D50128D-B595-4945-8AE7-3FB96AAD7A1F} - System32\Tasks\2012-09-19 Extern Backup => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBCore.exe [2012-01-13] (Nero AG)
Task: {8F8FC22D-739B-4B14-8C01-66BB17F268D3} - System32\Tasks\{75FB89FB-5D8B-4201-9F37-A8945920CCD1} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {94E39960-F808-4329-A393-9E322FE0619C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {958E2056-0C9C-4423-9025-88C618BEDFED} - System32\Tasks\{B77E2BD4-1B02-4080-ADF0-996B86FB43DF} => pcalua.exe -a C:\Users\Toni_02\Downloads\vuplayersetup.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {A644D94F-6CE7-46A2-B5B5-28033052EDC8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007UA => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-17] (Dropbox, Inc.)
Task: {C229828B-6446-4067-9289-C786CF1A615F} - System32\Tasks\AdobeAAMUpdater-1.0-Toni-PC-Toni_03 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05] (Adobe Systems Incorporated)
Task: {D433ECA2-37BB-4838-9FA3-6D8A74389FEE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {F077922A-4E02-4845-A4B9-32C32C3F8333} - System32\Tasks\{2FC39C26-B62D-4E74-A531-6D15230C83FE} => pcalua.exe -a "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe"
Task: {F1C09582-9BF9-463B-A91B-0C7A578759FB} - System32\Tasks\{68988D08-5095-4269-8E84-3CC18DAD1C99} => pcalua.exe -a "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe"
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007Core.job => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612934075-448063179-3665729200-1007UA.job => C:\Users\Toni Standard\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Intel_C_CVPR135003JA120LGN.job => C:\Program Files (x86)\Intel\Intel(R) Solid-State Drive Toolbox\Intel SSD Toolbox.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-09-07 08:24 - 2015-09-07 08:24 - 00339152 _____ () C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll
2015-06-02 17:20 - 2015-06-02 17:20 - 00043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-11-24 12:23 - 2011-04-10 04:40 - 00094208 ____N () C:\Windows\System32\IccLibDll_x64.dll
2015-04-22 12:18 - 2015-04-21 01:37 - 05886784 _____ () C:\Users\Toni Standard\AppData\Local\Amazon Music\Amazon Music Helper.exe
2015-03-23 13:02 - 2013-01-11 10:50 - 06965968 ____N () C:\Program Files (x86)\QNAP\QGet\QGet.exe
2015-03-23 13:02 - 2013-01-11 10:50 - 03322576 ____N () C:\Program Files (x86)\QNAP\QGet\QGetServer.exe
2000-05-08 03:54 - 2000-05-08 03:54 - 00061440 ____N () C:\Program Files (x86)\Mouse Driver\4DMAIN.EXE
2015-02-22 02:47 - 2014-12-22 22:42 - 01356568 ____N () C:\Program Files\Tablet\Wacom\libxml2.dll
2000-05-17 03:35 - 2000-05-17 03:35 - 00069632 ____N () C:\Windows\system\4DHOOK32.dll
2013-01-16 12:58 - 2013-01-16 12:58 - 02408448 ____N () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2013-01-16 12:58 - 2013-01-16 12:58 - 08626176 ____N () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2013-01-16 12:58 - 2013-01-16 12:58 - 00212992 ____N () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2015-10-15 04:36 - 2015-10-15 04:36 - 00116224 _____ () C:\Program Files (x86)\QNAP\Qsync\RdiffDll.dll
2015-10-15 08:14 - 2015-10-15 08:14 - 00163840 _____ () C:\Program Files (x86)\QNAP\Qsync\IOTCAPIs.dll
2015-10-15 08:14 - 2015-10-15 08:14 - 00086016 _____ () C:\Program Files (x86)\QNAP\Qsync\P2PTunnelAPIs.dll
2015-10-15 08:14 - 2015-10-15 08:14 - 00094208 _____ () C:\Program Files (x86)\QNAP\Qsync\RDTAPIs.dll
2015-03-23 13:02 - 2013-01-11 10:51 - 00838864 ____N () C:\Program Files (x86)\QNAP\QGet\Lang\0x0407.dll
2015-12-13 02:12 - 2016-05-25 19:03 - 00034768 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2016-06-25 01:28 - 2016-05-25 19:03 - 00134088 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2016-06-25 01:28 - 2016-05-25 19:04 - 00019408 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2016-06-25 01:28 - 2016-05-25 19:03 - 00116688 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-13 02:12 - 2016-05-25 19:03 - 00093640 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-13 02:12 - 2016-05-25 19:03 - 00018376 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-13 02:12 - 2016-06-13 22:13 - 00019760 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00105928 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32api.pyd
2016-06-25 01:28 - 2016-05-25 19:03 - 00392144 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-13 02:12 - 2016-06-13 22:13 - 00381752 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-13 02:12 - 2016-05-25 19:03 - 00692688 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00020816 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-13 02:12 - 2016-05-25 19:04 - 00123856 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 01682760 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00020808 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-13 02:12 - 2016-06-13 22:13 - 00021840 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00052024 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00038696 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\fastpath.pyd
2016-06-25 01:28 - 2016-05-25 19:05 - 00020936 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00024528 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00114640 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00124880 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32file.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00021832 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00024016 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00175560 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00030160 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00043472 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00048592 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32service.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00023872 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winffi.kernel32._winffi_kernel32.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00026456 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00057808 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00024016 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32profile.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00246592 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00028616 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32ts.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00020800 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00019776 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00020800 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
2015-12-13 02:12 - 2016-05-25 19:03 - 00134608 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2016-06-25 01:28 - 2016-05-25 19:04 - 00240584 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00020280 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-13 02:12 - 2016-06-13 22:13 - 00023376 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00350152 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2016-02-19 18:25 - 2016-06-13 22:13 - 00022352 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00024392 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2016-06-25 01:28 - 2016-05-25 19:05 - 00036296 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\librsync.dll
2016-06-25 01:28 - 2016-06-13 22:13 - 00084280 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2016-06-25 01:28 - 2016-06-13 22:13 - 01826096 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-13 02:12 - 2016-05-25 19:04 - 00083912 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\sip.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 03928880 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 01971504 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00531248 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00132912 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00223544 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00207672 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-13 02:12 - 2016-05-25 19:05 - 00060880 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\win32print.pyd
2015-12-13 02:12 - 2016-06-13 22:13 - 00024904 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00546096 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2016-06-25 01:28 - 2016-06-13 22:13 - 00357680 _____ () C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-09-24 17:41 - 2015-09-24 17:41 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2007-08-05 22:31 - 2007-08-05 22:31 - 00114688 ____N () C:\Program Files (x86)\Multimedia Keyboard Driver\V5\keydll.dll
2007-08-05 23:53 - 2007-08-05 23:53 - 00053248 ____N () C:\Program Files (x86)\Multimedia Keyboard Driver\V5\MouseHook.dll
2016-05-12 07:54 - 2016-05-12 07:54 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f91bd970f20123a46b575cf6e92bc441\IsdiInterop.ni.dll
2011-11-24 12:24 - 2011-04-30 01:28 - 00059904 ____N () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-09-24 17:41 - 2015-09-24 17:41 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 ____N () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-09-24 17:41 - 2015-09-24 17:41 - 00105984 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_de\PDFMaker\PDFMOfficeAddin.DEU
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720 [126]
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [134]
AlternateDataStreams: C:\ProgramData\TEMP:7D2C66B1 [290]
AlternateDataStreams: C:\ProgramData\TEMP:E36A723B [268]
AlternateDataStreams: C:\Users\Toni Standard\Cookies:6MopXCGd0f7LxfgxjAfo8Tx [2016]
AlternateDataStreams: C:\Users\Toni Standard\AppData\Local\Temporary Internet Files:LROZLtS1iMUXCUZZLmOpBycZdrhJ8 [2268]
AlternateDataStreams: C:\Users\Toni_02\Cookies:6MopXCGd0f7LxfgxjAfo8Tx [2402]
AlternateDataStreams: C:\Users\Toni_02\AppData\Local\Temporary Internet Files:LROZLtS1iMUXCUZZLmOpBycZdrhJ8 [2508]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1612934075-448063179-3665729200-1007\...\1-2005-search.com -> www.1-2005-search.com
Da befinden sich 12682 mehr Seiten.
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1612934075-448063179-3665729200-1005\Control Panel\Desktop\\Wallpaper -> C:\Users\2th Device\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Control Panel\Desktop\\Wallpaper -> C:\Users\Toni Standard\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\Services: MozillaMaintenance => 3
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{A3DFB7AF-FE19-4002-BC8A-39FB635FA875}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{8D3996A3-0611-45B1-BA42-681D4077BB0F}] => (Allow) LPort=2869
FirewallRules: [{CD037E8D-BD92-433F-81F2-B26B8E269456}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{EB7C9F00-E05A-4D72-BC94-674E1696DC77}C:\program files (x86)\vuplayer\vuplayer.exe] => (Allow) C:\program files (x86)\vuplayer\vuplayer.exe
FirewallRules: [UDP Query User{A392DC25-B0E5-4576-B257-5F2146DA880B}C:\program files (x86)\vuplayer\vuplayer.exe] => (Allow) C:\program files (x86)\vuplayer\vuplayer.exe
FirewallRules: [TCP Query User{CF4B4175-6D82-438A-9DDB-D7A09D53569F}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{A965CDFB-70EC-448A-B43C-7E4A10781115}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{398542C0-1FE3-4A35-8F93-5A54930C9D81}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [UDP Query User{DAB4E852-AE09-472E-B2C7-D356201B02D6}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [{0DC8834D-1E19-4A76-8460-5B3537E58AE6}] => (Allow) C:\Users\Toni_03\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{855F5580-3B2D-4DA0-9B59-EA2F88EDF4C6}] => (Allow) C:\Users\Toni_03\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{3ACFC13D-335D-4EC4-8597-8D0A05C2FD28}C:\users\toni_03\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni_03\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{2274656A-C5BB-4E1E-B4F8-2434BEE942E3}C:\users\toni_03\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni_03\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{4FEDBA98-F4E3-4D05-AD83-CDE8B3B05273}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Allow) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{7301FE40-78B4-4929-8AAD-6D22142D1E37}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Allow) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [{27A5C301-AC44-4B8D-AB06-5718E39EE59E}] => (Allow) LPort=40123
FirewallRules: [{CF134C29-503A-4D38-9A18-8136DAFFFBCC}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [TCP Query User{8869CE9D-08E5-4D29-8322-FDBC928DDD60}C:\program files (x86)\torrentsearch\easydownload.exe] => (Allow) C:\program files (x86)\torrentsearch\easydownload.exe
FirewallRules: [UDP Query User{8C133232-9AB2-4A21-A53E-48694EC91B8F}C:\program files (x86)\torrentsearch\easydownload.exe] => (Allow) C:\program files (x86)\torrentsearch\easydownload.exe
FirewallRules: [{60EA5F2A-4A35-4699-BB04-0EC3CDF8A56B}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{DF9217F9-C4DE-4AB3-A62D-A60CD41A7123}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{F4B5BD74-A977-416D-8977-E450681837F9}] => (Allow) %ProgramFiles% (x86)\Vuze\Azureus.exe
FirewallRules: [{4CF6613D-DD5F-46D5-962A-90338288A46B}] => (Allow) %ProgramFiles% (x86)\Vuze\Azureus.exe
FirewallRules: [{403C8F64-67E4-4DEE-956B-4730FAFC423E}] => (Allow) %ProgramFiles% (x86)\Vuze\Azureus.exe
FirewallRules: [TCP Query User{D342A856-6460-4A14-804A-161DEE595E51}C:\program files (x86)\intellidownload\tdl\easydownload.exe] => (Allow) C:\program files (x86)\intellidownload\tdl\easydownload.exe
FirewallRules: [UDP Query User{16058709-0BDB-4111-9351-07D087D86053}C:\program files (x86)\intellidownload\tdl\easydownload.exe] => (Allow) C:\program files (x86)\intellidownload\tdl\easydownload.exe
FirewallRules: [{95690094-99A2-4D38-B0C1-0705F0B88AEA}] => (Allow) C:\Program Files (x86)\YourFileDownloader\Downloader.exe
FirewallRules: [{085829DD-371A-4B14-9D26-A966CC3FE87B}] => (Allow) C:\Program Files (x86)\YourFileDownloader\Downloader.exe
FirewallRules: [{415EDE79-DE90-4691-A043-09716017C177}] => (Allow) C:\Program Files (x86)\YourFileDownloader\YourFile.exe
FirewallRules: [{76B07D3C-501A-4CEB-A15F-2CC24316991E}] => (Allow) C:\Program Files (x86)\YourFileDownloader\YourFile.exe
FirewallRules: [TCP Query User{68B82C00-96E1-4FC4-BB39-3462F1F5A316}C:\program files (x86)\fvd suite\fvd downloader\fvd downloader.exe] => (Allow) C:\program files (x86)\fvd suite\fvd downloader\fvd downloader.exe
FirewallRules: [UDP Query User{C887554C-45F2-4A51-AB2C-68E0C01D64B0}C:\program files (x86)\fvd suite\fvd downloader\fvd downloader.exe] => (Allow) C:\program files (x86)\fvd suite\fvd downloader\fvd downloader.exe
FirewallRules: [{D470F009-C904-4E36-B4F3-733DC3B14E2C}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{B7767F35-BE51-4A52-90DA-A27776C4CF49}] => (Allow) C:\Users\Toni_02\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{55EF5654-DD31-45DD-B88B-86B66EEA115D}] => (Allow) C:\Users\Toni_02\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{7D66AE16-A8A5-416E-A8B4-CE2D720140CC}C:\users\toni_02\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni_02\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B7EA63DF-C5B3-41D1-BDD6-DF1026576ACE}C:\users\toni_02\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni_02\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{1C8C0FA2-9A03-44FE-9BBB-DC38E7D38585}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Allow) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe
FirewallRules: [UDP Query User{78936C4D-A093-4309-AAEB-92FC2B302666}C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe] => (Allow) C:\program files (x86)\nero\nero 11\nero backitup\backitup.exe
FirewallRules: [TCP Query User{5D81395B-FAB1-45E0-BF0B-846ED3A0B2FC}C:\users\toni standard\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\toni standard\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8A7EC45F-98C1-4317-A401-066E6EB45B17}C:\users\toni standard\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\toni standard\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{472ECC8A-64F6-4575-83B3-DA6C89F822ED}C:\users\toni standard\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni standard\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{148D1946-7054-4D33-A74D-961BC2994636}C:\users\toni standard\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\toni standard\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{F6720C6D-E116-4A22-9D57-19B33158BC9D}] => (Allow) C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{80AF6E72-4F9C-4B95-BC02-1673C29EBD64}] => (Allow) C:\Users\Toni Standard\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{89BB69A7-57B2-4477-84CE-7DC5ADF45991}] => (Allow) C:\ProgramData\eSafe\eGdpSvc.exe
FirewallRules: [TCP Query User{06879EC3-26AD-4509-99B6-3686A97DD45F}C:\program files (x86)\spybot - search & destroy 2\sdupdate.exe] => (Allow) C:\program files (x86)\spybot - search & destroy 2\sdupdate.exe
FirewallRules: [UDP Query User{F43EBE19-0995-4C04-88A3-89514CC1C7EA}C:\program files (x86)\spybot - search & destroy 2\sdupdate.exe] => (Allow) C:\program files (x86)\spybot - search & destroy 2\sdupdate.exe
FirewallRules: [TCP Query User{46688E46-03D8-4DD3-A08F-FF541E66B17C}C:\program files\vuze\azureus.exe] => (Allow) C:\program files\vuze\azureus.exe
FirewallRules: [UDP Query User{1487A235-D201-4504-8288-CAEC2470F585}C:\program files\vuze\azureus.exe] => (Allow) C:\program files\vuze\azureus.exe
FirewallRules: [{51B1D878-991C-47E6-B536-A7EE3C56E9B8}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{14C5AB5F-A5D0-4CD6-9B2F-AC9BE1614632}] => (Allow) C:\program files\vuze\azureus.exe
FirewallRules: [{DF061301-2289-4BDA-BE51-F166300CAFBB}] => (Allow) C:\program files\vuze\azureus.exe
FirewallRules: [{45DC609B-7C89-4208-8BFF-3B93468991A8}] => (Allow) C:\program files\vuze\azureus.exe
FirewallRules: [{C76B5429-7183-4BDD-9AFD-8467234FF922}] => (Allow) C:\Users\Toni Standard\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{25F2463B-28AF-410D-9C6B-B9D42E1C52BC}] => (Allow) C:\Users\Toni Standard\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{7CEA5279-2439-4B00-A727-BF6AFDA63CBD}] => (Allow) C:\Program Files (x86)\BitComet\BitComet.exe
FirewallRules: [{6E28F33C-4689-4CD4-895F-E062A60D515D}] => (Allow) C:\Program Files (x86)\BitComet\BitComet.exe
FirewallRules: [{E2022FB7-A9E3-4029-8D39-43D69FC0E7D8}] => (Allow) C:\Program Files\Vuze\Azureus.exe
FirewallRules: [{BF3F1F77-6F39-4E13-BA4C-F6CEF3875C44}] => (Allow) C:\Program Files\Vuze\Azureus.exe
FirewallRules: [{7C5E9D88-DF5B-4ABB-B05D-ECC6E8AA0412}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D5853748-A05A-4427-9574-E423C73A3793}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C01CD932-A4DD-4AB8-A572-753A2AB4929E}] => (Allow) C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [TCP Query User{7D49C5E0-11C3-4A93-803C-BEB8E3F9C9CA}C:\program files (x86)\qnap\finder\finder.exe] => (Allow) C:\program files (x86)\qnap\finder\finder.exe
FirewallRules: [UDP Query User{CA71BEC0-5682-45BC-AE3D-7F07CA8C123F}C:\program files (x86)\qnap\finder\finder.exe] => (Allow) C:\program files (x86)\qnap\finder\finder.exe
FirewallRules: [TCP Query User{E9CB761E-1338-43DF-AF0C-C0C2C28672AD}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [UDP Query User{2611048A-39C5-4246-85F2-0666A76D6C31}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [TCP Query User{46C73F00-7ACF-4594-ADCC-F1A33402DE1A}C:\program files (x86)\qnap\qget\qget.exe] => (Allow) C:\program files (x86)\qnap\qget\qget.exe
FirewallRules: [UDP Query User{B827547C-17EA-4C1F-A630-BF5EE18E5719}C:\program files (x86)\qnap\qget\qget.exe] => (Allow) C:\program files (x86)\qnap\qget\qget.exe
FirewallRules: [TCP Query User{BE922C66-E168-4B9E-B595-76AF6A9BDEB9}C:\program files\qnap\netbak\netbak.exe] => (Allow) C:\program files\qnap\netbak\netbak.exe
FirewallRules: [UDP Query User{7D0A9026-44C3-4E40-B489-D4067CA27DEB}C:\program files\qnap\netbak\netbak.exe] => (Allow) C:\program files\qnap\netbak\netbak.exe
FirewallRules: [{F2D6387F-0963-4682-8A66-1B1601FAEDC0}] => (Allow) C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{F8547364-0E4B-4376-B9CD-19101C95F3D1}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{3D8D1AFA-66C8-4ECC-A01D-A893E205B627}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{86D38771-3BD7-4D44-BC32-83B1D22B8AF7}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{2A9742F3-DEDA-42B0-9696-27F71502FD76}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{1DAC1DFA-FF34-4BA6-9793-C91BA1B8DBBB}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{13F99D4E-CD97-48ED-893E-7C64ABAC1E83}C:\program files (x86)\qnap\qsync\qsync.exe] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [UDP Query User{28E8E919-D687-44C5-BD13-6A9FB70ADA07}C:\program files (x86)\qnap\qsync\qsync.exe] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [{42399847-18D3-4F60-B0EC-B6C4279E9746}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Wiederherstellungspunkte =========================
01-07-2016 15:26:47 Windows Update
02-07-2016 02:24:51 Microsoft Antimalware Checkpoint
03-07-2016 19:00:18 Windows-Sicherung
05-07-2016 23:18:57 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (07/08/2016 10:28:34 AM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Error: (07/08/2016 10:22:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2016 10:21:44 AM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Error: (07/07/2016 02:06:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm rstrui.exe, Version 6.1.7601.23418 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 27fc
Startzeit: 01d1d847f44f935b
Endzeit: 0
Anwendungspfad: C:\Windows\system32\rstrui.exe
Berichts-ID:
Error: (07/07/2016 02:05:43 PM) (Source: System Restore) (EventID: 8205) (User: )
Description: Die Systemwiederherstellung wurde nicht abgeschlossen, da nicht genügend freier Speicherplatz auf dem Volume (Windows-Sicherung) verfügbar war.
Error: (07/07/2016 02:04:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1500) (User: Toni-PC)
Description: Sie konnten nicht angemeldet werden, da das lokal gespeicherte Profil nicht geladen werden konnte. Überprüfen Sie, ob eine Netzwerkverbindung besteht und das Netzwerk ordnungsgemäß funktioniert.
Details - Zugriff verweigert
Error: (07/07/2016 02:01:16 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Error: (07/07/2016 02:00:17 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Error: (07/07/2016 01:59:50 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Error: (07/07/2016 01:59:14 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: Toni-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet.
Details - Zugriff verweigert
Systemfehler:
=============
Error: (07/08/2016 10:35:35 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.
Error: (07/08/2016 10:30:02 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (07/07/2016 02:39:40 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (07/07/2016 02:06:14 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004
Error: (07/07/2016 02:06:14 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004
Error: (07/07/2016 02:05:55 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom3 ist für den Zugriff noch nicht bereit.
Error: (07/07/2016 02:05:55 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom3 ist für den Zugriff noch nicht bereit.
Error: (07/07/2016 02:05:55 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom3 ist für den Zugriff noch nicht bereit.
Error: (07/07/2016 02:05:55 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom3 ist für den Zugriff noch nicht bereit.
Error: (07/07/2016 02:05:55 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom3 ist für den Zugriff noch nicht bereit.
CodeIntegrity:
===================================
Date: 2012-02-15 11:02:27.805
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\afd.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-02-15 11:02:27.790
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\afd.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 23%
Installierter physikalischer RAM: 16301.11 MB
Verfügbarer physikalischer RAM: 12439.77 MB
Summe virtueller Speicher: 32600.4 MB
Verfügbarer virtueller Speicher: 28708.47 MB
==================== Laufwerke ================================
Drive c: (System und Programme) (Fixed) (Total:102.54 GB) (Free:3.44 GB) NTFS
Drive d: (Daten) (Fixed) (Total:1863.01 GB) (Free:1412.46 GB) NTFS
Drive h: (A&Y Friends Licence) (Fixed) (Total:1863.01 GB) (Free:52.65 GB) NTFS
Drive l: (Videos Music Technic) (Fixed) (Total:1397.26 GB) (Free:147.07 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 967D29B5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=102.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 5608085C)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (Size: 1863 GB) (Disk ID: 0974760D)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (Size: 1397.3 GB) (Disk ID: 1243B5ED)
Partition 1: (Not Active) - (Size=1397.3 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
|
|
08.07.2016, 13:45
| #7 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2016, 13:47
| #8 |
| | System ist von Schadsoftware befallen Ich bin selbständig, ist aber ein privater Home-PC. Also nicht von irgendwelchen Namen oder Bezeichnungen irritieren lassen. Ist alles in Ordnung so,...privat! |
|
08.07.2016, 14:10
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallen Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2016, 17:58
| #10 |
| | System ist von Schadsoftware befallen mbar scan log Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.07.08.06
rootkit: v2016.05.27.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18349
2th Device :: TONI-PC [administrator]
08.07.2016 16:41:31
mbar-log-2016-07-08 (16-41-31).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 716286
Time elapsed: 18 minute(s), 29 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 6
C:\$Recycle.Bin\S-1-5-18\$b19d41baccfed3b9c4be273e1cdb6755\U (Trojan.Siredef.C) -> Delete on reboot. [7a1ceb36e3b7af87420e54adbc446c94]
C:\$Recycle.Bin\S-1-5-21-1612934075-448063179-3665729200-1003\$b19d41baccfed3b9c4be273e1cdb6755\U (Trojan.Siredef.C) -> Delete on reboot. [a9ed2bf65f3bb87e74dca55c867af709]
C:\$Recycle.Bin\S-1-5-18\$b19d41baccfed3b9c4be273e1cdb6755\L (Trojan.Siredef.C) -> Delete on reboot. [9ff71a07bfdb47ef4f031ae79868619f]
C:\$Recycle.Bin\S-1-5-21-1612934075-448063179-3665729200-1003\$b19d41baccfed3b9c4be273e1cdb6755\L (Trojan.Siredef.C) -> Delete on reboot. [9afc2ff22d6d1d19c989ad54ea16b848]
C:\$Recycle.Bin\S-1-5-18\$b19d41baccfed3b9c4be273e1cdb6755 (Trojan.Siredef.C) -> Delete on reboot. [375fdc45138759dd460dbb46f10f08f8]
C:\$Recycle.Bin\S-1-5-21-1612934075-448063179-3665729200-1003\$b19d41baccfed3b9c4be273e1cdb6755 (Trojan.Siredef.C) -> Delete on reboot. [6531849d495142f495be7988c13f06fa]
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
08.07.2016, 22:16
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallen Du sollst was machen, wenn MBAR fündig wurde?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.07.2016, 10:52
| #12 |
| | System ist von Schadsoftware befallen ...was machen?!?!? Ich habe das gemacht, was Du mir geschrieben hast: << Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop. Starte bitte die mbar.exe. Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen. Klicke auf den CleanUp Button und erlaube den Neustart. Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig. Nach dem Neustart starte die mbar.exe erneut. Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess. Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier. Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers >> Nach dem 2. Start der exe wurde nichts mehr gefunden, also bliebe es bei dem Posten der einen Log... Ich habe alles so gemacht, wie beschrieben. Was soll ich denn Deiner Meinung nach tun??? Ich glaube, einen Fehler gemacht zu haben, als ich mein Problem beschrieben habe. Ich habe auf meinem Rechner 4 Profile eingerichtet, da ich schon schlechte Erfahrungen mit Malware gemacht habe. Sollte ein Profil verseucht sein, kann ich es im Notfall löschen. Dies aber nur im Notfall, da ich es bis jetzt nicht hinbekommen habe, im Notfall die Eigenschaften eines Profils in ein neues zu übernehmen. Ich glaube das geht nicht... Meine Profile: Toni (Admin) 2th Device (Admin) Standard User (eingeschränkt) Toni Standard (eingeschränkt) Ich arbeite standardmäßig mit "Toni Standard" + Firefox und Win LiveMail (Win7). Dieses Konto ist wohl verseucht. Ich bin nicht allein an diesem Rechner. Meine Lebensgefährtin ist ebenfalls oft online mit dem PC und diesem Konto. Ich kann seit ca. 2 Wochen nichts mehr installieren und keine exe öffnen. Es kommt die Fehlermeldung "...*.exe konnte nicht gefunden werden. Stellen Sie sicher, dass Sie den Namen richtig eingegeben haben und wiederholen Sie den Vorgang." Dies passiert auch, wenn ich eine exe vom Stick oder z.B. beim Onlinescannen öffnen will... Ich kann also nichts mehr als Admin ausführen auf diesem Konto... Ich habe gestern noch versucht auf diesem Profil die mbar.exe zu öffnen,...mit dem gleichen Resultat. Also sollten wir mit diesem Konto arbeiten. Denn ich möchte es ungern löschen, da ich alle Einstellungen, Favoriten, Verknüpfungen etc. etc. neu einrichten müsste... Ich möchte einen Weg finden, mich dauerhaft gegen solche Bedrohungen erwehren zu können. Nun, ich habe den Log gepostet. 6 Bedrohungen wurden gefunden und entfernt. Dies jedoch auf dem Profil "2th Device (Admin)". Wie aber bekomme ich den ganzen PC sauber mit allen Profilen??? Ich bin jetzt gleich beruflich unterwegs und bin gegen 19 Uhr wieder online. Morgen dasselbe. Wir werden also über einen längeren Zeitraum kommunizieren... Wie soll es weitergehen..? |
|
09.07.2016, 17:28
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallen MBAR wurde fündig. Und in der Anleitung steht das: Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess. Zitat:
...auch wenn du schreibst dass du angeblich ni mehr ausführen kannst machen wir so erstmal weiter:Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.07.2016, 21:30
| #14 |
| | System ist von Schadsoftware befallen AdwCleaner[C1].txt Code:
ATTFilter # AdwCleaner v5.102 - Bericht erstellt am 15/03/2016 um 12:23:41
# Aktualisiert am 13/03/2016 von Xplode
# Datenbank : 2016-03-14.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Toni_02 - TONI-PC
# Gestartet von : L:\T\TECHNICS PC\PC Security\AdwCleaner\adwcleaner_5.102.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
***** [ Dateien ] *****
***** [ DLLs ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{915BB7D5-082E-3B91-B1E0-45B5FDE01F24}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
[-] Schlüssel Gelöscht : HKCU\Software\Appscion
[-] Schlüssel Gelöscht : HKCU\Software\DownLite
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\IBUpdaterService
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\BetterDeals-11
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1612934075-448063179-3665729200-1003\Software\BabylonToolbar
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1612934075-448063179-3665729200-1003\Software\SweetIM
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1003\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\BetterDeals-11
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\Conduit
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\CToolbar
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\Softonic
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\System Speedup
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\AppDataLow\Software\Conduit
[-] Schlüssel Gelöscht : HKU\S-1-5-21-1612934075-448063179-3665729200-1007\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\BetterDeals-11
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
[-] Wert Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2A89BDC5-10F4-4B57-8486-64A6B90B3B4D}]
[-] Wert Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{A00D6024-1C77-4ABD-82A7-82778B98585A}]
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\file-repair.sd.softonic.de
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\softonic.de
***** [ Internetbrowser ] *****
*************************
:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
*************************
C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [3508 Bytes] - [15/03/2016 12:23:41]
C:\Program Files (x86)\AdwCleaner\AdwCleaner[S1].txt - [3894 Bytes] - [15/03/2016 12:21:36]
########## EOF - C:\Program Files (x86)\AdwCleaner\AdwCleaner[C1].txt - [3694 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 7 Professional x64
Ran by 2th Device (Administrator) on 09.07.2016 at 22:10:49,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 15
Successfully deleted: C:\Users\2th Device\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\17G4578Z (Temporary Internet Files Folder)
Successfully deleted: C:\Users\2th Device\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B5ZW6QL2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\2th Device\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZAV421P (Temporary Internet Files Folder)
Successfully deleted: C:\Users\2th Device\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XDHFC3H9 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\system32\REN8130.tmp (File)
Successfully deleted: C:\Windows\system32\RENE0E.tmp (File)
Successfully deleted: C:\Windows\system32\RENE283.tmp (File)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\17G4578Z (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B5ZW6QL2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZAV421P (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XDHFC3H9 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\SysWOW64\REN69AA.tmp (File)
Successfully deleted: C:\Windows\SysWOW64\RENAFE8.tmp (File)
Successfully deleted: C:\Windows\SysWOW64\RENBA97.tmp (File)
Successfully deleted: C:\Windows\SysWOW64\RENF5F4.tmp (File)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.07.2016 at 22:11:58,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
11.07.2016, 08:50
| #15 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System ist von Schadsoftware befallenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu System ist von Schadsoftware befallen |
| administrator, adobe, adobe flash player, canon, defender, desktop, dnsapi.dll, explorer, fehlermeldung, firefox, flash player, google, log, malware, microsoft, mozilla, pdf, prozesse, realtek, registry, scan, schadsoftware_ups_link_trojaner, security, services.exe, svchost.exe, system, temp, windows, winlogon.exe |
Linear-Darstellung
