![]() |
| |||||||
Log-Analyse und Auswertung: Trojaner eBay&email Hack vom PC entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
| | #1 |
![]() ![]() | Trojaner eBay&email Hack vom PC entfernen Hallo an alle! ich wurde vor ein paar Wochen Opfer eines Hackangriffs auf mein ebay Kleinanzeigen und mein EMail Konto wodurch der Verkauf eines Autos auf meinen Namen durchgeführt werden sollte. Die Sache wurde glücklicherweise früh genug von eBay unterbunden. Der Virenscann mit Avira hat mir dann auch prompt den Fund eines Trojaners auf meiner Festplatte gemeldet. Die log-Datei ist leider nicht mehr bei Avira gelistet. Über Avira habe ich den Trojaner dann löschen lassen und naiver Weise gedacht die Sache wäre nun erledigt. Der PC (/Surface Pro 3) läuft auch ohne Probleme. In den letzten Tag sind mir jetzt aber doch ein paar Ungereimtheiten aufgefallen: mein E-Mail Konto zeigt mir fehlgeschlagene Logins an welche nicht von mir kommen und das lrz Netnetzwerk in der Uni sperrt mir ab und dann den Zugang wegen "exzessiver Überschreitung der erlaubten Packetrate" bei normaler Internetnutzung. Daher der Vermutung, dass der Trojaner u.U. noch aktiv ist. Im Anhang die geforderten Logfiles. GMER spuckt leider gleich beim Starten die Fehlermeldung "C:\Windows\[...]: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird." und hängt sich beim Bestätigen auf. Die angegeben Anweisungen wurden befolgt. Vielen Dank schon einmal für die Hilfe! Additional.txt musste ich leider aus Rücksicht auf die maximale Zeichenlänge herausnehmen. Reiche ich im nächsten Beitrag nach! defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:15 on 03/12/2015 (Lorenz)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:01-12-2015
durchgeführt von Lorenz (Administrator) auf LOLLOSURFACE (03-12-2015 09:22:49)
Gestartet von C:\Users\Lorenz\Downloads
Geladene Profile: Lorenz (Verfügbare Profile: Lorenz)
Platform: Windows 10 Pro Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(1&1 Mail & Media GmbH) C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Akamai Technologies, Inc.) C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
(Dropbox, Inc.) C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.23.23.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe
() C:\Program Files\WindowsApps\Microsoft.CommsPhone_1.10.23004.0_x64__8wekyb3d8bbwe\CallsApp.exe
() C:\Program Files\WindowsApps\Microsoft.ConnectivityStore_1.1511.2.0_x64__8wekyb3d8bbwe\ConnectivityStore.Windows.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
() C:\Users\Lorenz\Downloads\Gmer-19357.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM-x32\...\Run: [doubleTwist] => C:\Program Files (x86)\doubleTwist\doubleTwist.Light.exe
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-16] (Apple Inc.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-11-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [708496 2015-09-23] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [794112 2015-10-29] (1&1 Mail & Media GmbH)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Spotify Web Helper] => C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-02-08] (Spotify Ltd)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [61200 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Dropbox Update] => C:\Users\Lorenz\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\WINDOWS\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-10-20]
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-12-02]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{4af4bd94-f876-4a1e-aafd-4c94f42317df}: [NameServer] 10.156.33.53,129.187.5.1
Tcpip\..\Interfaces\{524448cb-31f1-4839-9c46-203aa2eaab44}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKU\S-1-5-21-2261460588-3622448717-587553582-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1414232571&from=exp&uid=ST3500320AS_6QM0WA8AXXXX6QM0WA8A
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-11-13] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-13] (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-10-15] (DVDVideoSoft Ltd.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-13] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2015-01-28] (DVDVideoSoft Ltd.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default
FF Homepage: hxxp://go.web.de/tb/mff_startpage
FF Session Restore: -> ist aktiviert.
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-11] ()
FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-13] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-13] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-11] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-10-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\avira-safesearch.xml [2015-02-26]
FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\google-images.xml [2014-10-14]
FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\google-maps.xml [2014-10-14]
FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\youtube.xml [2015-10-28]
FF Extension: WOT - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-11-28]
FF Extension: Avira Browser Safety - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\abs@avira.com [2015-10-23] [ist nicht signiert]
FF Extension: Cliqz - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\cliqz@cliqz.com.xpi [2015-11-09] [ist nicht signiert]
FF Extension: YouTube to MP3 Free Converter - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\extension@321youtube.com.xpi [2015-05-29]
FF Extension: MEGA - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\firefox@mega.co.nz.xpi [2015-11-10] [ist nicht signiert]
FF Extension: WEB.DE MailCheck - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\mailcheck@web.de [2015-11-09]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-28] [ist nicht signiert]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-09-30]
FF Extension: Adblock Plus - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-26]
FF HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\extensions\cliqz@cliqz.com => nicht gefunden
Chrome:
=======
CHR Profile: C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10]
CHR Extension: (Google Docs) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-10]
CHR Extension: (Google Drive) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-22]
CHR Extension: (Google-Suche) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Google Tabellen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10]
CHR Extension: (Avira Browserschutz) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-10-22]
CHR Extension: (Google Docs Offline) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Google Mail) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-16]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [948392 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1418560 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [250136 2015-11-03] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2797752 2015-10-13] (Microsoft Corporation)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3755976 2015-07-01] (devolo AG)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [Datei ist nicht signiert]
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [135880 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [146696 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [73032 2015-12-01] (Avira Operations GmbH & Co. KG)
S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
S3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-07] (Intel Corporation)
S3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-07] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-09-30] (Intel Corporation)
R3 mrvlpcie8897; C:\Windows\System32\drivers\mrvlpcie8897.sys [1037824 2015-10-30] (Marvell Semiconductors Inc.)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2015-07-01] (CACE Technologies)
S3 SCL01164; C:\Windows\system32\DRIVERS\SCL01164.sys [72320 2010-05-07] (SCM Microsystems Inc.)
R3 SurfaceAccessoryDevice; C:\Windows\System32\drivers\SurfaceAccessoryDevice.sys [51856 2014-05-30] (Microsoft Corporation)
R3 SurfaceCapacitiveHomeButton; C:\Windows\System32\drivers\SurfaceCapacitiveHomeButton.sys [44152 2014-11-27] (Microsoft Corporation)
R3 SurfaceDisplayCalibration; C:\Windows\System32\drivers\SurfaceDisplayCalibration.sys [41616 2014-05-02] (Microsoft Corporation)
R3 SurfaceIntegrationDriver; C:\Windows\System32\drivers\SurfaceIntegrationDriver.sys [63000 2015-09-30] (Microsoft Corporation)
R0 SurfacePciController; C:\Windows\System32\drivers\SurfacePciController.sys [35440 2014-10-08] (Microsoft Corporation)
R3 SurfacePenDriver; C:\Windows\System32\drivers\SurfacePenDriver.sys [76424 2015-03-31] (Microsoft Corporation)
S3 SurfaceTypeCover; C:\Windows\System32\drivers\SurfaceTypeCover.sys [67592 2015-10-27] (Microsoft Corporation)
S3 SurfaceTypeCoverV3Integration; C:\Windows\System32\drivers\SurfaceTypeCoverV3Integration.sys [52760 2015-10-27] (Microsoft Corporation)
R3 TrueColor; C:\Windows\system32\DRIVERS\TrueColor.sys [35952 2014-07-07] ()
R3 vpnva; C:\Windows\System32\drivers\vpnva64-6.sys [52592 2015-09-23] (Cisco Systems, Inc.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 uxliykoc; C:\Users\Lorenz\AppData\Local\Temp\uxliykoc.sys [56496 2015-12-03] (GMER) [Datei ist nicht signiert]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-03 09:22 - 2015-12-03 09:23 - 00026884 _____ C:\Users\Lorenz\Downloads\FRST.txt
2015-12-03 09:22 - 2015-12-03 09:22 - 00000000 ____D C:\FRST
2015-12-03 09:17 - 2015-12-03 09:19 - 02350080 _____ (Farbar) C:\Users\Lorenz\Downloads\FRST64.exe
2015-12-03 09:15 - 2015-12-03 09:15 - 00000000 _____ C:\Users\Lorenz\defogger_reenable
2015-12-03 09:14 - 2015-12-03 09:21 - 00380416 _____ C:\Users\Lorenz\Downloads\Gmer-19357.exe
2015-12-03 09:14 - 2015-12-03 09:15 - 00050477 _____ C:\Users\Lorenz\Downloads\Defogger.exe
2015-12-02 11:41 - 2015-12-02 11:41 - 00000000 ___HD C:\OneDriveTemp
2015-12-02 11:41 - 2015-12-02 11:41 - 00000000 ____D C:\Users\Lorenz\AppData\Local\ActiveSync
2015-12-02 11:33 - 2015-12-02 11:33 - 00000020 ___SH C:\Users\Lorenz\ntuser.ini
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Vorlagen
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Startmenü
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Videos
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Videos
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2015-12-02 11:30 - 2015-12-02 11:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-12-02 11:26 - 2015-12-02 11:26 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-12-02 11:21 - 2015-12-02 11:27 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-12-02 11:20 - 2015-12-03 09:15 - 00000000 ____D C:\Users\Lorenz
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Vorlagen
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Startmenü
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Netzwerkumgebung
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Lokale Einstellungen
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Eigene Dateien
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Druckumgebung
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Videos
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Musik
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Bilder
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Local\Verlauf
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Local\Anwendungsdaten
2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Anwendungsdaten
2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_SensorsHid_02_15_00.Wdf
2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TrueColor_01011.Wdf
2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SurfacePenDriver_01011.Wdf
2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____D C:\WINDOWS\SysWOW64\TrueColor5.2
2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____D C:\WINDOWS\system32\TrueColor5.2
2015-12-02 11:19 - 2015-10-30 08:17 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-12-02 11:19 - 2015-09-06 12:12 - 00099856 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____D C:\WINDOWS\Firmware
2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____D C:\Program Files\Intel
2015-12-02 11:17 - 2015-12-03 08:39 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-12-02 11:17 - 2015-12-02 12:00 - 00000000 ___DC C:\WINDOWS\Panther
2015-12-02 11:17 - 2015-12-02 11:39 - 00442840 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-02 11:15 - 2015-12-02 11:15 - 24603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 22572632 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 22394880 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 21125408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 19339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 16984064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 13376512 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 13017088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 12120064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 07476576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 03670832 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 03592704 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 02918808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2015-12-02 11:15 - 2015-12-02 11:15 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2015-12-02 11:15 - 2015-12-02 11:15 - 02587136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02544264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02064384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 02001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01998848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01707008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01212416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00969728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00911648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00809312 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00791552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00698208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00675064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00586208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00586080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00578912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00540752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00523616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2015-12-02 11:15 - 2015-12-02 11:15 - 00516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00511320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00454056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00408128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00405048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2015-12-02 11:15 - 2015-12-02 11:15 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00366224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-AppModelExecEvents.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00116728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 00110032 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00088392 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.proxy.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00035680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2015-12-02 11:15 - 2015-12-02 11:15 - 00035656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00032040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.proxy.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe
2015-12-02 11:15 - 2015-12-02 11:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-12-02 11:15 - 2015-12-02 11:15 - 00000000 ____D C:\Windows.old
2015-12-02 11:13 - 2015-12-02 11:13 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files\MSBuild
2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-12-02 11:11 - 2015-10-23 17:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-12-02 11:11 - 2015-10-23 17:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-12-02 11:11 - 2015-10-23 17:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-12-02 11:11 - 2015-10-23 17:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-12-02 11:11 - 2015-10-23 17:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-12-02 11:11 - 2015-10-23 17:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-11-27 22:15 - 2015-12-01 14:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-11-27 21:54 - 2015-11-27 21:54 - 05359935 _____ C:\Users\Lorenz\Downloads\kinox_app_1.0.5.apk
2015-11-23 17:35 - 2015-11-23 17:35 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Avira
2015-11-23 16:34 - 2015-12-01 14:13 - 00146696 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-11-23 16:34 - 2015-12-01 14:13 - 00135880 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-11-23 16:34 - 2015-12-01 14:13 - 00073032 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2015-11-23 16:34 - 2015-12-01 14:13 - 00035488 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2015-11-23 16:32 - 2015-11-23 16:32 - 04584344 _____ (Avira Operations GmbH & Co. KG) C:\Users\Lorenz\Downloads\avira_de_av_5655784164__ws.exe
2015-11-23 16:31 - 2015-07-05 11:08 - 00300704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-11-23 16:28 - 2015-11-23 16:29 - 00000000 ____D C:\escw_103_sa
2015-11-23 16:17 - 2015-11-23 16:18 - 152989672 _____ C:\Users\Lorenz\Downloads\escw_103_sa_sfx.exe
2015-11-20 08:13 - 2015-11-20 10:36 - 00000000 ____D C:\Users\Lorenz\AppData\Local\ABBF10EB-058A-4174-AE2A-78C7323AAD12.aplzod
2015-11-19 11:50 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-14 23:13 - 2015-11-28 18:39 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Foxit Reader
2015-11-13 13:19 - 2015-11-13 13:19 - 00000000 ____D C:\Users\Lorenz\.tooling
2015-11-13 13:12 - 2015-11-30 13:19 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Eclipse
2015-11-13 13:10 - 2015-11-13 13:10 - 00001126 _____ C:\Users\Lorenz\Desktop\Eclipse Java Mars.lnk
2015-11-13 13:10 - 2015-11-13 13:10 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eclipse
2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\eclipse
2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Sun
2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\AppData\LocalLow\Sun
2015-11-13 13:02 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-13 13:02 - 2015-11-30 13:19 - 00000000 ____D C:\Users\Lorenz\.p2
2015-11-13 13:02 - 2015-11-13 13:02 - 00110176 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2015-11-13 13:01 - 2015-11-13 13:04 - 00000000 ____D C:\ProgramData\Oracle
2015-11-13 13:01 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\.oracle_jre_usage
2015-11-13 13:01 - 2015-11-13 13:01 - 46355176 _____ C:\Users\Lorenz\Downloads\eclipse-inst-win64.exe
2015-11-13 12:58 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-11-13 12:58 - 2015-11-13 13:01 - 00000000 ____D C:\Program Files\Java
2015-11-13 12:57 - 2015-11-13 12:57 - 00000000 ____D C:\Users\Lorenz\AppData\LocalLow\Oracle
2015-11-13 12:55 - 2015-11-13 12:57 - 195629144 _____ (Oracle Corporation) C:\Users\Lorenz\Downloads\jdk-8u65-windows-x64.exe
2015-11-12 16:17 - 2015-12-02 11:27 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-11-11 12:44 - 2015-11-23 19:57 - 631695404 _____ C:\WINDOWS\MEMORY.DMP
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-03 09:22 - 2015-10-30 07:28 - 00000000 ____D C:\Windows
2015-12-03 09:10 - 2015-06-17 07:00 - 00001254 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001UA.job
2015-12-03 08:50 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-03 08:50 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-12-03 08:49 - 2014-10-16 15:30 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-12-03 08:48 - 2015-10-30 19:35 - 00776766 _____ C:\WINDOWS\system32\perfh007.dat
2015-12-03 08:48 - 2015-10-30 19:35 - 00155544 _____ C:\WINDOWS\system32\perfc007.dat
2015-12-03 08:48 - 2015-10-30 08:21 - 00000000 ____D C:\WINDOWS\INF
2015-12-03 08:48 - 2015-08-03 23:45 - 01799166 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-03 08:42 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\appcompat
2015-12-03 08:39 - 2014-10-14 19:24 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CA419BB4-6605-47F9-9529-DB8D2C018ECF}
2015-12-02 22:28 - 2015-01-22 15:44 - 00001144 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-02 16:30 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-12-02 15:11 - 2015-06-17 07:00 - 00001202 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001Core.job
2015-12-02 13:25 - 2015-01-22 15:44 - 00001140 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-02 13:20 - 2015-01-22 15:44 - 00004202 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-02 13:20 - 2015-01-22 15:44 - 00003970 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-02 11:46 - 2014-10-14 19:17 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Packages
2015-12-02 11:41 - 2015-08-04 08:20 - 00002407 _____ C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-12-02 11:41 - 2014-10-15 21:30 - 00000000 ___RD C:\Users\Lorenz\Dropbox
2015-12-02 11:41 - 2014-10-15 21:28 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Dropbox
2015-12-02 11:41 - 2014-10-14 19:20 - 00000000 __RDO C:\Users\Lorenz\OneDrive
2015-12-02 11:40 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2015-12-02 11:39 - 2015-08-01 11:37 - 00000000 ___RD C:\Users\Lorenz\iCloudDrive
2015-12-02 11:34 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\PrintDialog
2015-12-02 11:34 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\MiracastView
2015-12-02 11:33 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-12-02 11:33 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files\Windows NT
2015-12-02 11:33 - 2014-08-06 14:02 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-12-02 11:32 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\rescache
2015-12-02 11:32 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\Registration
2015-12-02 11:32 - 2015-08-01 23:13 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2015-12-02 11:32 - 2015-08-01 23:13 - 00020958 _____ C:\WINDOWS\diagerr.xml
2015-12-02 11:31 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-12-02 11:30 - 2015-10-30 08:24 - 00000000 __RSD C:\WINDOWS\Media
2015-12-02 11:30 - 2015-10-30 08:24 - 00000000 __RHD C:\Users\Public\Libraries
2015-12-02 11:30 - 2015-08-03 23:43 - 00023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-12-02 11:30 - 2015-07-22 13:00 - 00002954 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-12-02 11:30 - 2015-06-17 07:00 - 00003868 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001UA
2015-12-02 11:30 - 2015-06-17 07:00 - 00003596 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001Core
2015-12-02 11:30 - 2014-10-16 15:30 - 00003098 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-12-02 11:30 - 2014-10-14 19:24 - 00002878 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2261460588-3622448717-587553582-1001
2015-12-02 11:27 - 2015-10-30 08:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-12-02 11:27 - 2015-10-30 07:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-12-02 11:27 - 2015-10-30 07:28 - 00008192 ___SH C:\WINDOWS\system32\config\ELAM
2015-12-02 11:27 - 2015-10-29 08:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-02 11:27 - 2015-10-25 12:15 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-12-02 11:27 - 2015-10-25 12:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk Inventor 2014
2015-12-02 11:27 - 2015-10-25 12:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DWG TrueView 2014
2015-12-02 11:27 - 2015-10-25 12:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-12-02 11:27 - 2015-10-20 09:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6
2015-12-02 11:27 - 2015-08-04 09:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-12-02 11:27 - 2015-07-10 10:05 - 00000000 ____D C:\Users\Default.migrated
2015-12-02 11:27 - 2015-07-08 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-12-02 11:27 - 2015-07-04 08:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\devolo
2015-12-02 11:27 - 2015-04-14 20:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RStudio
2015-12-02 11:27 - 2015-04-14 17:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
2015-12-02 11:27 - 2015-03-24 17:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2015-12-02 11:27 - 2015-01-22 15:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-02 11:27 - 2014-11-20 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2015-12-02 11:27 - 2014-11-20 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2015-12-02 11:27 - 2014-11-15 21:19 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-02 11:27 - 2014-11-15 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-02 11:27 - 2014-11-13 19:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP630 series
2015-12-02 11:27 - 2014-11-06 20:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-12-02 11:27 - 2014-10-22 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
2015-12-02 11:27 - 2014-10-16 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MatheGrafix
2015-12-02 11:27 - 2014-10-15 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ___SD C:\WINDOWS\Downloaded Program Files
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\spool
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\InputMethod
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\ProgramData\USOPrivate
2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-12-02 11:23 - 2015-10-22 19:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco
2015-12-02 11:23 - 2015-05-26 14:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Texmaker
2015-12-02 11:23 - 2014-11-15 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC
2015-12-02 11:23 - 2014-11-13 19:56 - 00000000 ___HD C:\WINDOWS\system32\CanonIJ Uninstaller Information
2015-12-02 11:23 - 2014-10-30 21:22 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2015-12-02 11:23 - 2014-10-30 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SCM Microsystems
2015-12-02 11:23 - 2014-10-20 17:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-12-02 11:20 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-12-02 11:17 - 2015-10-30 19:58 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2015-12-02 11:17 - 2015-10-30 08:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-12-02 11:15 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-12-02 11:15 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-12-02 11:15 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\Provisioning
2015-12-02 11:15 - 2015-10-30 08:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-02 11:15 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2015-12-02 11:15 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\system32\Dism
2015-12-02 11:11 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2015-12-02 11:11 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\MUI
2015-12-02 10:57 - 2015-10-30 20:28 - 00000000 ___HD C:\$WINDOWS.~BT
2015-12-01 14:15 - 2014-10-14 20:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-27 16:13 - 2015-11-02 15:55 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Foxit Software
2015-11-26 10:27 - 2015-10-22 21:57 - 00000000 ____D C:\Users\Lorenz\Documents\inventor
2015-11-26 08:05 - 2014-10-14 23:54 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-11-26 08:02 - 2015-07-22 13:00 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-23 16:34 - 2014-10-15 21:19 - 00000000 ____D C:\ProgramData\Avira
2015-11-23 16:34 - 2014-10-15 21:19 - 00000000 ____D C:\Program Files (x86)\Avira
2015-11-23 16:32 - 2014-05-08 23:25 - 00000000 ____D C:\ProgramData\Package Cache
2015-11-22 10:18 - 2014-10-17 08:38 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-22 10:15 - 2014-10-17 08:38 - 145617392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-20 10:39 - 2015-07-06 08:40 - 00000000 ____D C:\Users\Lorenz\Documents\Outlook-Dateien
2015-11-19 11:50 - 2015-04-14 12:15 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Apple Inc
2015-11-19 11:49 - 2014-10-25 18:09 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-11-13 18:30 - 2015-10-23 08:54 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-11-13 13:17 - 2015-07-16 10:33 - 00000000 ____D C:\Users\Lorenz\.eclipse
2015-11-11 20:55 - 2015-01-22 15:44 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-11 08:08 - 2014-12-03 19:22 - 00000000 ____D C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021}
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-10-09 18:04 - 2015-10-09 18:04 - 0000833 _____ () C:\Users\Lorenz\AppData\Local\recently-used.xbel
2015-12-02 11:18 - 2015-12-02 11:18 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\Lorenz\AppData\Local\Temp\avgnt.exe
C:\Users\Lorenz\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpesyusy.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-12-02 11:17
==================== Ende von FRST.txt ============================
|
| Themen zu Trojaner eBay&email Hack vom PC entfernen |
| akamai, antivirus, avira, bonjour, canon, converter, desktop, dnsapi.dll, downloader, e-mail, ebay, email, entfernen, festplatte, firefox, flash player, google, helper, homepage, hängt, mp3, onedrive, scan, software, starten, svchost.exe, trojaner, windows, windows 10 pro, windowsapps |