Win7: Trojaner durch Link über gehakten Skype account?

Cudjo · 27.09.2015, 13:05

Hallo liebes Board

Erstmal Dank im Voraus für eure Arbeit! Ich finde es echt super dass es so hilfsbereite Leute wie euch gibt!

Zu meiner Situation:
Vor ein paar Wochen hat scheinbar jemand meinen Skype account gehackt und an (fast) alle meine Kontakte einen (personalisierten) Link geschickt. Es wäre mir gar nicht aufgefallen, da ich Skype schon seit Monaten nicht mehr verwendet habe, aber zum Glück hat es mir einer meiner Kontakte gleich auf anderen Wegen mitgeteilt, sodass ich das Skype-passwort ändern konnte und alle Kontakte benachrichtigen dass der Link nicht von mir kommt.
Leider habe ich dann in einem Moment völliger geistiger Umnachtung den unglaublich peinlichen Fehler begangen selbst auf einen dieser Links zu klicken. Relativ kurz danach hat mein Laptop auf einmal nur noch sehr langsam reagiert. Der Taskmanager hat angezeigt das ein svchost die CPU stark ausgelastet hat. Durch „Prozess beenden“ wurde es zwar insofern besser, als wieder alles schnell reagiert hat, aber dafür haben Windows-Grundfunktionen nicht mehr normal funktioniert.
Da mir das natürlich mit diesem Timing sehr ungeheuer war, habe ich eine Systemwiederherstellung auf einen Wiederherstellungspunkt von ca eine Woche vorher gemacht und einen kompletten Systemscan mit Panda Cloud Antivirus durchlaufen lassen. Keine Funde. Danach ging der Spuk noch etwas weiter, aber es sind auch ständig irgendwelche Windows und Nvidia Updates gelaufen… Als die alle fertig waren schien wieder alles ganz normal zu sein, aber natürlich bin ich jetzt ziemlich eingeschüchtert irgendwelche sensiblen Daten oder Passwörter einzugeben.

Und nun meine Bitte an euch liebes Board: Könnt ihr mir helfen herauszufinden ob das einfach nur blödes Timing war und der Link gar nichts böses angerichtet hat, oder ob ich den PC komplett neu aufsetzten muss?
Ich sollte vielleicht dazu sagen dass diese Mühle schon einige Jährchen auf dem Buckel hat, und schon so einiges erlebt hat. Das heißt einerseits wäre sicher eh nicht verkehrt ihn mal neu auf zu setzten, andererseits sind so viele Tools und Daten darauf das es echt viel Arbeit wäre und ich nicht sicher bin ob sich dieser Aufwand noch lohnen würde… Außerdem ist leider auch das DVD Laufwerk kaputt, sodass ich gar nicht so recht weis wie ich überhaupt sicher Windows neu installieren kann. Vermutlich muss ich dann auf einem anderen Rechner irgendwie einen bootfähigen USB-Stick erstellen auf dem die Windows-Installationsdateien liegen, oder? Also ich hoffe ihr versteht, dass ich mir das gerne ersparen würde ;-)

Was ich bisher gemacht habe an Vorarbeit (in dieser Reihenfolge da ich leider erst in einem Thread der mir sehr allgemein erschien gelandet bin bevor ich beschlossen habe selbst zu einen anzulegen und die eigentlich „ToDo-List“ entdeckt habe):
1. Malwarebytes Anti-Malware
2. OTL
3. Defogger
4. FRST
5. GMER

Log-Files s.u. in selber Reihenfolge.

In der Anleitung zum posten steht man soll die logs nicht gleich als neuen Beitrag dazu posten, da ihr sonst davon ausgeht das das Problem schon bearbeitet wird. Deshalb habe ich mal intuitiv ein paar als "Code" eingebunden, und den Rest als RAR angehängt. Ich hoffe das passt auch (anstatt zip)!?

Vielen Dank für eure Hilfe, und hoffentlich bis bald,
Cudjo

FRST Logfile:

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:23-09-2015
durchgeführt von Kuyumo (Administrator) auf KUYUMO-PC (26-09-2015 23:42:16)
Gestartet von C:\Users\Kuyumo\Desktop\Trojaner suche
Geladene Profile: Kuyumo (Verfügbare Profile: Kuyumo)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Foxit Software Inc.) C:\Program Files\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe
(Absolute Software Corp.) C:\Windows\System32\rpcnet.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.28.15\GoogleCrashHandler.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [497024 2009-07-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-24] (NVIDIA Corporation)
HKLM\...\Run: [PSUAMain] => C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe [40184 2015-02-27] (Panda Security, S.L.)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\...\Run: [Dropbox Update] => C:\Users\Kuyumo\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Copy] => C:\Users\Kuyumo\AppData\Roaming\Copy\CopyAgent.exe [13400208 2015-04-11] (Barracuda Networks, Inc.)
HKU\S-1-5-18\...\RunOnce: [panda4_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda4_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda4_0dn_XP] => reg.exe delete "HKCU\Software\panda4_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda4_1dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda4_1dn" /f
HKU\S-1-5-18\...\RunOnce: [panda4_1dn_XP] => reg.exe delete "HKCU\Software\panda4_1dn" /f
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [1aCopyShExtError] -> {83BEA36E-7680-4598-A4DF-994426F6E78D} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [2aCopyShExtSynced] -> {845B7388-6F85-4F32-9FD5-F02DC7882B89} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [3aCopyShExtSyncing] -> {F6378A7A-F753-449B-AE1B-997A96132E61} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [4aCopyShExtSyncingProg1] -> {3A511828-777D-46F8-82F4-5B530C1B3D9E} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [5aCopyShExtSyncingProg2] -> {C8C88204-5B14-40EC-BA72-8AEBC762047E} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [6aCopyShExtSyncingProg3] -> {ACFF45C3-3EEB-4351-86C2-6696BA264239} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [7aCopyShExtSyncingProg4] -> {29AF997F-488B-46F0-AE78-7146F1B89CC3} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [8aCopyShExtSyncingProg5] -> {03F9AD29-1C78-4B66-8890-B177B5430C53} => C:\Users\Kuyumo\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-04-03] (Barracuda Networks, Inc.)
GroupPolicyScripts: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Winsock: Catalog9 01 C:\Windows\system32\RSLSP.dll [380928 2012-09-22] (Ratajik Software)
Winsock: Catalog9 02 C:\Windows\system32\RSLSP.dll [380928 2012-09-22] (Ratajik Software)
Winsock: Catalog9 03 C:\Windows\system32\RSLSP.dll [380928 2012-09-22] (Ratajik Software)
Winsock: Catalog9 04 C:\Windows\system32\RSLSP.dll [380928 2012-09-22] (Ratajik Software)
Winsock: Catalog9 15 C:\Windows\system32\RSLSP.dll [380928 2012-09-22] (Ratajik Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{157083F9-E1BC-43FB-9031-4D9F7C095960}: [DhcpNameServer] 10.204.57.104 10.205.41.16
Tcpip\..\Interfaces\{D06B54E8-0068-4988-97D0-1FFDB3AC2F07}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F2FE0A98-C1E7-4857-99A5-1D9E871E5B89}: [DhcpNameServer] 10.204.57.104 10.205.41.16
Tcpip\..\Interfaces\{F97E0CC5-690B-4B30-961A-9D3D96B3FBAC}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: HKU\S-1-5-21-3683629333-2777190142-3868084316-1000 - (Kein Name) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} -  Keine Datei
SearchScopes: HKU\S-1-5-21-3683629333-2777190142-3868084316-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 
SearchScopes: HKU\S-1-5-21-3683629333-2777190142-3868084316-1000 -> {58ADF134-0921-45D6-927B-2B7BE8E16062} URL = hxxp://www.ecosia.org/search.php?q={searchTerms}&service=
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-12-12] (DivX, LLC)
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-10] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-10] (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default
FF NewTab: www.google.com
FF DefaultSearchUrl: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-22] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2011-02-02] (Adobe Systems, Inc.)
FF Plugin: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll [Keine Datei]
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-12-13] (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-10] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)
FF Plugin: PDF Architect 2 -> C:\Program Files\PDF Architect 2\np-previewer.dll [2014-06-26] (pdfforge GmbH)
FF Plugin HKU\S-1-5-21-3683629333-2777190142-3868084316-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Kuyumo\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll Keine Datei
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\searchplugins\ecosia.xml [2014-01-13]
FF Extension: Xmarks - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\foxmarks@kei.com [2015-06-01]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\adblockpopups@jessehakanen.net.xpi [2011-11-01]
FF Extension: Hide My Ass! Web Proxy - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\extension@hidemyass.com.xpi [2014-08-12]
FF Extension: stealthy - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\stealthyextension@gmail.com.xpi [2012-02-11]
FF Extension: NoScript - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-11-23]
FF Extension: Mozilla Archive Format - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{7f57cf46-4467-4c2d-adfa-0cba7c507e54}.xpi [2014-08-07]
FF Extension: Video DownloadHelper - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-14]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2014-11-19]
FF Extension: Adblock Plus - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-09-19]
FF Extension: QuickWiki - C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\Extensions\{EE223D7A-F30F-11DD-8F0A-D2AD55D89593}.xpi [2011-09-14]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-09-13]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &video& - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-22]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://aartemis.com/?type=hp&ts=1388738059&from=cor&uid=3219913727_1789_6009F25C","hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\45.0.2454.99\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\45.0.2454.99\ppGoogleNaClPluginChrome.dll => Keine Datei
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\45.0.2454.99\pdf.dll => Keine Datei
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll => Keine Datei
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll => Keine Datei
CHR Plugin: (Google Talk Plugin) - C:\Users\Kuyumo\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll => Keine Datei
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Kuyumo\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll => Keine Datei
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\Kuyumo\AppData\Roaming\Mozilla\plugins\npo1d.dll => Keine Datei
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll => Keine Datei
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll => Keine Datei
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll => Keine Datei
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll => Keine Datei
CHR Profile: C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Xmarks Bookmark Sync) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2012-07-15]
CHR Extension: (Google Docs) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Hide My Ass! Web Proxy) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmgnmcnlncejehjlnhaglpnoolgbflbd [2013-04-21]
CHR Extension: (Google-Suche) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (Google Kalender) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2015-08-16]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (AdBlock) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-04-21]
CHR Extension: (Google Notizen – Notizen & Listen) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2015-08-16]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (SoundCloud Downloader Free) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\libedajeiljdoodmokbppgapcfbignci [2015-06-06]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-03-15]
CHR Extension: (Google Zeichnungen) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkaakpdehdafacodkgkpghoibnmamcme [2015-08-16]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-04-21]
CHR Extension: (TabCloud) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\npecfdijgoblfcgagoijgmgejmcpnhof [2013-04-21]
CHR Extension: (Google Mail) - C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
CHR HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [84536 2009-06-15] (ASUS)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [Datei ist nicht signiert]
S4 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-09-27] (Cisco Systems, Inc.)
S4 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [Datei ist nicht signiert]
R2 FoxitCloudUpdateService; C:\Program Files\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244392 2015-07-16] (Foxit Software Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [919184 2015-06-24] (NVIDIA Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe [142584 2015-02-27] (Panda Security, S.L.)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1868432 2015-06-24] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20694160 2015-06-24] (NVIDIA Corporation)
R2 PandaAgent; C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
S4 PDF Architect 2; C:\Program Files\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
S4 PDF Architect 2 Creator; C:\Program Files\PDF Architect 2\creator-ws.exe [738856 2014-06-26] (pdfforge GmbH)
S4 pdfforge CrashHandler; C:\Program Files\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
R2 PSUAService; C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe [38136 2015-02-27] (Panda Security, S.L.)
R2 rpcnet; C:\Windows\system32\rpcnet.exe [78032 2015-04-18] (Absolute Software Corp.)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S4 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
S4 UPnPService; C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [544768 2006-12-14] (Magix AG) [Datei ist nicht signiert]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ACEDRV09; C:\Windows\system32\drivers\ACEDRV09.sys [110304 2014-05-31] (Protect Software GmbH)
S3 AmUStor; C:\Windows\System32\drivers\AmUStor.SYS [27136 2010-12-27] (Alcor Micro, Corp.)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
S3 AXIOM; C:\Windows\System32\DRIVERS\MAudioAxiom.sys [115336 2010-02-19] (M-Audio)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2010-09-27] (Cisco Systems, Inc.) [Datei ist nicht signiert]
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-11-08] (DT Soft Ltd)
R3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [87040 2009-07-29] (ELAN Microelectronic Corp.)
S3 ffusb2audio; C:\Windows\System32\DRIVERS\ffusb2audio.sys [48472 2012-01-05] (Focusrite Audio Engineering Limited.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2008-12-30] (Huawei Technologies Co., Ltd.)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [14392 2010-12-27] (ASUS)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [86800 2015-02-09] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [202128 2015-02-09] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [109584 2015-02-09] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [126480 2015-02-09] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [41744 2014-12-31] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [99856 2015-02-09] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [61712 2015-02-09] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [120592 2015-02-09] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [281232 2015-02-09] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [205456 2015-02-09] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [108432 2015-02-09] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [239888 2015-02-09] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [94864 2015-02-09] (Panda Security, S.L.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18576 2015-06-24] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [41648 2015-05-19] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [140048 2015-02-25] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [105232 2015-02-25] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [168208 2015-02-25] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [113936 2015-02-25] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [124688 2015-02-25] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [100624 2015-02-25] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [15688 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [10320 2013-09-30] ()
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1766592 2010-12-27] ()
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [44544 2012-09-28] (Apple, Inc.) [Datei ist nicht signiert]
S3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
S3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbw.sys [34280 2011-05-10] (Yamaha Corporation)
S3 L6UX2; System32\Drivers\L6UX2.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-26 23:41 - 2015-09-26 23:42 - 00000000 ____D C:\FRST
2015-09-26 23:38 - 2015-09-26 23:38 - 00000000 _____ C:\Users\Kuyumo\defogger_reenable
2015-09-26 20:08 - 2015-09-26 23:42 - 00000000 ____D C:\Users\Kuyumo\Desktop\Trojaner suche
2015-09-25 12:05 - 2015-09-25 12:06 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-25 12:05 - 2015-09-25 12:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-09-25 12:05 - 2015-09-25 12:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-25 12:05 - 2015-09-25 12:05 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware 
2015-09-25 12:05 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-25 12:05 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-25 12:05 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-22 20:14 - 2015-09-22 21:14 - 18819272 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2015-09-21 20:30 - 2015-01-29 19:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2015-09-13 13:17 - 2015-09-13 13:17 - 00000000 ____D C:\Program Files\AGEIA Technologies
2015-09-13 13:12 - 2015-08-18 10:47 - 24200312 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 15294072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 11272048 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 11209376 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 10704560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-09-13 13:12 - 2015-08-18 10:47 - 03987576 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 01059504 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234181.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 00912688 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234181.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 00907440 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 00869040 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC.dll
2015-09-13 13:12 - 2015-08-18 10:47 - 00021015 _____ C:\Windows\system32\nvinfo.pb
2015-09-13 11:49 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-13 11:49 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-13 11:49 - 2015-08-15 07:53 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-13 11:49 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-13 11:49 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-13 11:49 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-13 11:49 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-13 11:49 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-13 11:49 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-13 11:49 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-13 11:49 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-13 11:49 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-13 11:49 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-13 11:49 - 2015-08-15 07:29 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-13 11:49 - 2015-08-15 07:24 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-13 11:49 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-13 11:49 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-13 11:49 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-13 11:49 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-13 11:49 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-13 11:49 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-13 11:49 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-13 11:49 - 2015-08-15 07:02 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-13 11:49 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-13 11:49 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-13 11:49 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-13 11:49 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-13 11:49 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-13 11:48 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-13 11:48 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-13 11:48 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-13 11:48 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-13 11:48 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-13 11:48 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-09-13 11:48 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-13 11:48 - 2015-07-22 19:57 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-13 11:48 - 2015-07-22 19:57 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-13 11:48 - 2015-07-22 19:54 - 01308160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00937984 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-13 11:48 - 2015-07-22 19:53 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-13 11:48 - 2015-07-22 19:52 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-13 11:48 - 2015-07-22 19:52 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-13 11:48 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-13 11:48 - 2015-07-22 19:52 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-13 11:48 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-13 11:48 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-13 11:48 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-13 11:48 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-13 11:48 - 2015-07-22 18:38 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-13 11:48 - 2015-07-22 18:34 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-13 11:48 - 2015-07-22 18:34 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-13 11:48 - 2015-07-22 18:33 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-13 11:48 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-13 11:48 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-13 11:48 - 2015-06-25 11:48 - 00105408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-13 11:48 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-13 11:48 - 2015-06-25 11:44 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-13 11:47 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-13 11:47 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-13 11:47 - 2015-09-02 04:48 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-13 11:47 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-13 11:47 - 2015-09-02 03:36 - 02384896 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-13 11:47 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-13 11:47 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-13 11:47 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-13 11:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-13 11:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 02953728 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-13 11:47 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-13 11:47 - 2015-08-26 19:55 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-13 11:47 - 2015-08-26 19:55 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-13 11:47 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-13 11:47 - 2015-08-26 19:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-13 11:47 - 2015-08-05 19:41 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-13 11:47 - 2015-08-04 19:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-13 11:47 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-13 11:47 - 2015-08-04 19:47 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-13 11:47 - 2015-08-04 19:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-13 11:47 - 2015-08-04 19:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-13 11:47 - 2015-08-04 18:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-13 11:44 - 2015-09-15 19:48 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-09-13 11:43 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-13 11:27 - 2015-05-11 13:56 - 02508432 _____ (Sysinternals - www.sysinternals.com) C:\Users\Kuyumo\Desktop\procexp.exe
2015-09-04 18:29 - 2015-09-04 18:29 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-26 23:38 - 2010-12-27 18:32 - 00000000 ____D C:\Users\Kuyumo
2015-09-26 23:14 - 2014-11-19 03:15 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-26 22:58 - 2015-06-17 21:47 - 00001228 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3683629333-2777190142-3868084316-1000UA.job
2015-09-26 22:50 - 2014-10-13 16:27 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-26 22:48 - 2010-12-27 20:02 - 00000000 ____D C:\Users\Kuyumo\AppData\Local\Google
2015-09-26 22:21 - 2010-12-27 18:12 - 01671035 _____ C:\Windows\WindowsUpdate.log
2015-09-26 21:58 - 2015-06-17 21:47 - 00001176 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3683629333-2777190142-3868084316-1000Core.job
2015-09-26 21:25 - 2009-07-14 06:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-26 21:25 - 2009-07-14 06:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-26 21:10 - 2010-12-27 18:09 - 00017408 _____ C:\Windows\system32\rpcnetp.exe
2015-09-26 20:09 - 2010-12-27 20:09 - 00000000 ___RD C:\Users\Kuyumo\Desktop\Download
2015-09-26 15:00 - 2015-03-14 19:40 - 00000000 ___RD C:\Users\Kuyumo\Google Drive
2015-09-26 14:59 - 2015-04-03 01:06 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\Copy
2015-09-26 14:59 - 2014-10-13 16:27 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-26 14:59 - 2014-01-03 22:50 - 00089560 _____ C:\Windows\setupact.log
2015-09-26 14:59 - 2010-12-27 18:36 - 00078032 ____N (Absolute Software Corp.) C:\Windows\system32\rpcnet.dll
2015-09-26 14:58 - 2010-12-27 18:39 - 00188956 _____ C:\Windows\PFRO.log
2015-09-26 14:58 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-26 00:38 - 2012-10-06 19:28 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\AIMP3
2015-09-25 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-09-25 12:53 - 2015-07-12 19:39 - 00001092 _____ C:\Users\Kuyumo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wunderlist.lnk
2015-09-25 12:53 - 2015-06-28 00:38 - 00002184 _____ C:\Users\Kuyumo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-09-25 12:53 - 2015-02-07 21:17 - 00001075 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
2015-09-25 12:53 - 2014-11-19 01:29 - 00000981 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-09-25 12:53 - 2014-05-24 09:13 - 00001051 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2015-09-25 12:53 - 2014-04-26 18:59 - 00001320 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-09-25 12:53 - 2014-04-26 18:59 - 00001251 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-09-25 12:53 - 2014-01-03 10:35 - 00001951 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
2015-09-25 12:53 - 2014-01-03 10:35 - 00001895 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
2015-09-25 12:53 - 2014-01-03 10:35 - 00001874 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
2015-09-25 12:53 - 2012-11-24 17:56 - 00001798 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
2015-09-25 12:53 - 2012-04-06 16:09 - 00001013 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape.lnk
2015-09-25 12:53 - 2012-04-05 17:34 - 00001967 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-09-25 12:53 - 2011-10-17 12:59 - 00001849 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-09-25 12:53 - 2011-06-15 12:28 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-09-25 12:53 - 2010-12-30 20:31 - 00000953 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pidgin.lnk
2015-09-25 12:53 - 2010-12-27 18:13 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-09-25 12:53 - 2009-07-14 06:46 - 00001491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-09-25 12:53 - 2009-07-14 06:46 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2015-09-25 12:53 - 2009-07-14 06:42 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2015-09-25 12:53 - 2009-07-14 06:42 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2015-09-25 12:53 - 2009-07-14 06:37 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2015-09-25 12:52 - 2015-07-18 15:37 - 00001059 _____ C:\Users\Kuyumo\Desktop\Will And The People - Friends - Verknüpfung.lnk
2015-09-25 12:52 - 2015-07-13 09:07 - 00001172 _____ C:\Users\Kuyumo\Desktop\OneDrive.lnk
2015-09-25 12:52 - 2015-06-21 23:25 - 00001232 _____ C:\Users\Kuyumo\Desktop\Kaufen, Produkte - Verknüpfung.lnk
2015-09-25 12:52 - 2015-04-22 21:51 - 00001759 _____ C:\Users\Kuyumo\Desktop\2015_Frühling - Verknüpfung.lnk
2015-09-25 12:52 - 2015-04-07 19:12 - 00000697 _____ C:\Users\Kuyumo\Desktop\Barracuda Copy.lnk
2015-09-25 12:52 - 2015-04-03 13:47 - 00001386 _____ C:\Users\Kuyumo\Desktop\temp.rtf - Verknüpfung.lnk
2015-09-25 12:52 - 2015-04-03 04:59 - 00001462 _____ C:\Users\Kuyumo\Desktop\Serienstatus.txt - Verknüpfung.lnk
2015-09-25 12:52 - 2015-03-14 19:40 - 00001707 _____ C:\Users\Kuyumo\Desktop\Google Drive.lnk
2015-09-25 12:52 - 2014-03-22 13:21 - 00001009 _____ C:\Users\Kuyumo\Desktop\Dropbox.lnk
2015-09-25 11:26 - 2010-12-27 18:21 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-24 12:14 - 2015-04-18 10:19 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\vlc
2015-09-22 21:14 - 2012-04-03 12:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-09-22 21:14 - 2011-09-17 18:08 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-09-21 20:29 - 2010-12-27 18:10 - 00017408 _____ C:\Windows\system32\rpcnetp.dll
2015-09-15 22:15 - 2015-04-22 20:27 - 00000000 ____D C:\Windows\rescache
2015-09-15 19:48 - 2012-05-04 07:52 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-13 13:17 - 2011-11-04 01:07 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-09-13 13:16 - 2012-09-25 18:02 - 00000000 ____D C:\ProgramData\NVIDIA
2015-09-13 12:30 - 2009-07-14 06:33 - 00553768 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-13 12:27 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2015-09-13 10:40 - 2012-06-17 22:19 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\Dropbox
2015-09-12 13:40 - 2011-01-13 11:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-12 09:09 - 2011-05-13 20:08 - 00000000 ____D C:\Windows\pss
2015-09-12 09:06 - 2011-11-25 13:20 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\PhotoScape
2015-09-12 09:06 - 2011-10-27 17:01 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-09-11 19:44 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-11 19:31 - 2015-04-04 12:38 - 00000000 ___SD C:\Windows\system32\GWX
2015-09-11 19:31 - 2014-11-11 12:01 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-09-11 19:31 - 2014-11-07 05:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Cloud Antivirus
2015-09-11 19:31 - 2012-12-22 16:05 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\MediaMonkey
2015-09-11 19:31 - 2010-12-30 20:47 - 00000000 ___RD C:\Program Files\Skype
2015-09-11 19:31 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp
2015-09-11 19:31 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2015-09-11 19:30 - 2010-12-30 20:47 - 00000000 ____D C:\Users\Kuyumo\AppData\Roaming\Skype
2015-09-11 19:30 - 2010-12-30 20:47 - 00000000 ____D C:\ProgramData\Skype
2015-09-11 19:03 - 2013-07-29 12:57 - 00000000 ____D C:\Windows\system32\MRT
2015-09-06 15:58 - 2012-06-17 22:24 - 00000000 ___RD C:\Users\Kuyumo\Dropbox
2015-09-06 15:55 - 2015-06-28 00:37 - 00000000 ____D C:\Users\Kuyumo\OneDrive
2015-09-06 01:15 - 2015-07-12 19:39 - 00000000 ____D C:\Users\Kuyumo\AppData\Local\Wunderlist

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2012-11-01 19:50 - 2012-10-31 07:50 - 0000044 ____H () C:\Program Files\04aeb981.tmp
2012-12-24 18:17 - 2012-12-24 18:17 - 0038437 _____ () C:\Users\Kuyumo\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-10-22 18:21 - 2012-12-05 12:38 - 0000028 _____ () C:\Users\Kuyumo\AppData\Roaming\PhonerLitesettings.ini
2011-01-15 21:06 - 2012-06-21 12:41 - 0000600 _____ () C:\Users\Kuyumo\AppData\Roaming\winscp.rnd
2012-01-22 15:28 - 2015-04-27 21:55 - 0005632 _____ () C:\Users\Kuyumo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-03-29 02:05 - 2015-03-29 02:05 - 0036301 _____ () C:\Users\Kuyumo\AppData\Local\recently-used.xbel
2011-06-14 18:57 - 2014-02-09 02:06 - 0007602 _____ () C:\Users\Kuyumo\AppData\Local\resmon.resmoncfg
2014-11-06 22:08 - 2014-11-06 22:08 - 0000000 _____ () C:\Users\Kuyumo\AppData\Local\{A93FD393-7598-4AE6-B457-BB627964D6E9}
2012-12-09 02:29 - 2012-12-09 02:29 - 0000000 _____ () C:\ProgramData\0x0304A000.sfl
2014-04-06 13:49 - 2014-04-06 13:49 - 0000057 _____ () C:\ProgramData\Ament.ini
2010-12-30 20:48 - 2010-12-30 20:48 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Einige Dateien in TEMP:
====================
C:\Users\Kuyumo\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7jw2oy.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-23 14:02

==================== Ende vom FRST.txt ============================

--- --- ---

[/CODE]

Code:

ATTFilter

GMER Logfile:

	Code: 

 ATTFilter

  
	GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-09-27 13:13:37
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000092 Hitachi_ rev.FBEO 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Kuyumo\AppData\Local\Temp\axdiipog.sys


---- Kernel code sections - GMER 2.1 ----

.text    ntkrnlpa.exe!ZwReplaceKey + 1525                                                                  8464AB55 1 Byte  [06]
.text    ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                            84684BB2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text    C:\Windows\system32\drivers\ACEDRV09.sys                                                          section is writeable [0xA5625000, 0x3326E, 0xE8000020]
.pklstb  C:\Windows\system32\drivers\ACEDRV09.sys                                                          entry point in ".pklstb" section [0xA566A000]
.relo2   C:\Windows\system32\drivers\ACEDRV09.sys                                                          unknown last section [0xA5686000, 0x8E, 0x42000040]

---- User code sections - GMER 2.1 ----

.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtCreateFile                         771E56B0 5 Bytes  JMP 615F374A C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtFlushBuffersFile                   771E5A40 5 Bytes  JMP 615F348A C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtQueryFullAttributesFile            771E60D0 5 Bytes  JMP 615F35C2 C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtReadFile                           771E63A0 5 Bytes  JMP 615F34C4 C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtReadFileScatter                    771E63B0 5 Bytes  JMP 6194CB1D C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtWriteFile                          771E6B50 5 Bytes  JMP 615F38EE C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!NtWriteFileGather                    771E6B60 5 Bytes  JMP 6194CB6D C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] ntdll.dll!LdrLoadDll                           77202576 5 Bytes  JMP 7146A161 C:\Program Files\Mozilla Firefox\mozglue.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D  76C8952E 7 Bytes  JMP 6193510F C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] kernel32.dll!QueryPerformanceCounter + 13      76C8C535 7 Bytes  JMP 61935EF6 C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] kernel32.dll!LoadAppInitDlls + 355             76C8F5F6 7 Bytes  JMP 616BDBC1 C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] USER32.dll!GetWindowInfo                       768B4B5E 5 Bytes  JMP 6242E1E3 C:\Program Files\Mozilla Firefox\xul.dll
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3576] GDI32.dll!GetViewportOrgEx + 26C               771587DB 7 Bytes  JMP 61934981 C:\Program Files\Mozilla Firefox\xul.dll

---- Registry - GMER 2.1 ----

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active                
Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@B4FCF6A2       2153

---- EOF - GMER 2.1 ----
         
 --- --- ---

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlaufdatum: 25.09.2015
Suchlaufzeit: 12:07
Protokolldatei: Malewarebytes Anti-Malware Ergbisse.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.09.25.01
Rootkit-Datenbank: v2015.09.22.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Kuyumo

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 383633
Abgelaufene Zeit: 42 Min., 40 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 11
PUP.Optional.SupTab, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [c154cd67c9c296a095805896738f9967], 
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\delta-homesSoftware, , [e82d77bdb2d9181e9722cd78ba4936ca], 
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2613550, , [24f152e2bad154e290cda4dad2323bc5], 
PUP.Optional.Elex, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ifohbjbgfchkkfhphahclmkpgejiplfo, , [8491d95b2e5db581ea2e237812f2fe02], 
PUP.Optional.ExtendedProtection, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ogfjmhfnldnajmfaofeiaepghjenbgjo, , [868f2d07236868ced00dbcdfda2a669a], 
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [7b9a86aeacdfe45293fd2d09ce3550b0], 
PUP.Optional.Conduit, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}, , [1bfab4800784d16597ff3260fa0a7a86], 
PUP.Optional.SupTab, HKLM\SOFTWARE\SUPTAB, , [61b41e1603882a0c79c1942ef014926e], 
PUP.Optional.IEPluginServices, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginService, , [7f961d1799f2a393735fa300da2a8f71], 
PUP.Optional.InstallCore, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\InstallCore, , [1afbae8683088aac0e58f9acb351fe02], 
PUP.Optional.Conduit, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}, , [6da85fd5a2e9ef475b2e157da75d57a9], 

Registrierungswerte: 7
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, delta-homes, , [7b9a86aeacdfe45293fd2d09ce3550b0]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567&type=default&q={searchTerms}, , [ef2667cde4a7c86ecbc5fc3aed16f30d]
PUP.Optional.Conduit, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{afdbddaa-5d3f-42ee-b79c-185a7020515b}|URL, hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550, , [1bfab4800784d16597ff3260fa0a7a86]
PUP.Optional.QuickStart, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|quick_start@gmail.com, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\extensions\quick_start@gmail.com, , [50c5de56cfbcfd39d4495265be46c838]
PUP.Optional.SupTab, HKLM\SOFTWARE\SUPTAB|ptid, wpm0226, , [61b41e1603882a0c79c1942ef014926e]
PUP.Optional.Conduit, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{afdbddaa-5d3f-42ee-b79c-185a7020515b}|URL, hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550, , [6da85fd5a2e9ef475b2e157da75d57a9]
PUP.Optional.QuickStart, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, , [45d03ef6028995a1011a90272ada53ad]

Registrierungsdaten: 5
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567),,[d5402113e7a41026c15233448580956b]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567),,[57be94a0206bab8be62d86f163a2d927]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[92830e26c6c5bf77651eb9bda263da26]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567),,[67ae0d277417fb3b26eec1b6ae57b24e]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-3683629333-2777190142-3868084316-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=3219913727_1789_6009F25C&ts=1393423567),,[36df90a493f844f2c74d1a5d6d98ee12]

Ordner: 13
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\cachedIcons, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\facebook, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.IEPluginService, C:\ProgramData\IePluginService, , [8392e252305be551377433e942c116ea], 
PUP.Optional.IEPluginService, C:\ProgramData\IePluginService\update, , [8392e252305be551377433e942c116ea], 
PUP.Optional.SupTab, C:\Program Files\SupTab, , [dd3820149cef1026ad824ce0e02338c8], 

Dateien: 71
PUP.Optional.ExtendedProtection, C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx, , [3cd9c2726f1c43f30dcfd1caa65e738d], 
PUP.Optional.NewTab, C:\Users\Kuyumo\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx, , [cf4647ed3d4e70c6c133c8e89b69837d], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\notificationDB.sqlite, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\servicesMap.json, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\DialogsAPI.js, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\PIE.htc, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\settings.js, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\version.txt, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\AppNotification.js, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\initialNotification.html, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\main.html, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\sampleNotification.html, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\close.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\like.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next_hover.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\powered-by.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev_hover.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\settings.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Thumbs.db, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\cachedIcons\http___storage_conduit_com_50_261_CT2613550_Images_634084971246361250.png, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\facebook\menu-de-de.xml, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\facebook\settings.xml, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Chat.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\DataStructures.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\EBEncryption.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\ExternalLibraryLoader.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\HTTP.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\IO.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Log.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\MainSingleton.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\MD5.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Notifications.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\ObserversAndEvents.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Prefs.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\SearchProtector.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\SearchSuggestIO.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\String.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\TEAEncryption.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Timer.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Twitter.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\URL.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\Windows.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.7.0.6\XML.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Chat.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\DataStructures.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\EBEncryption.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\ExternalLibraryLoader.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\HTTP.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\IO.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Log.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\MainSingleton.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\MD5.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Notifications.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\ObserversAndEvents.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Prefs.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\SearchProtector.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\SearchSuggestIO.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\String.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\TEAEncryption.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Timer.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Twitter.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\URL.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\Windows.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.ConduitTB.Gen, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\conduitCommon\modules\3.8.0.8\XML.jsm, , [69ac3ff598f32a0c912135d137cc946c], 
PUP.Optional.IEPluginService, C:\ProgramData\IePluginService\update\conf, , [8392e252305be551377433e942c116ea], 
PUP.Optional.Conduit, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}");), ,[977e46eeadde6ccaa03101ae57aeb24e]
PUP.Optional.Conduit, C:\Users\Kuyumo\AppData\Roaming\Mozilla\Firefox\Profiles\jjs1avai.default\prefs.js, Gut: (), Schlecht: (user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q=");), ,[090c59db8803dc5a686db0ffac59fd03]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)

(end)

Win7: Trojaner durch Link über gehakten Skype account?

Log-Analyse und Auswertung: Win7: Trojaner durch Link über gehakten Skype account?

Win7: Trojaner durch Link über gehakten Skype account?

Ähnliche Themen: Win7: Trojaner durch Link über gehakten Skype account?