Win7: Emailanhang geöffnet - Antivir Alarm: TR/Crypt.XPACK.Gen4

12.12.2015 00:33 [Planer] Auftrag gestartet
      Auftrag "Automatisches Update Free"
      wurde erfolgreich gestartet.

12.12.2015 00:30 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\****\AppData\Local\Temp\125104.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen4 (Cloud)' 
      [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5e80fda0.qua' 
      verschoben!

12.12.2015 00:30 [System-Scanner] Suche
      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
      Anzahl Dateien:	888
      Anzahl Verzeichnisse:	0
      Anzahl Malware:	1
      Anzahl Warnungen:	0

12.12.2015 00:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\****\AppData\Local\Temp\125104.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen4 (Cloud)' 
      [TR/Crypt.XPACK.Gen4] gefunden.
      Ausgeführte Aktion: Zugriff verweigern
         

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:12-12-2015
durchgeführt von **** (Administrator) auf PC**** (12-12-2015 14:13:26)
Gestartet von C:\Users\****\Desktop
Geladene Profile: **** &  (Verfügbare Profile: ****)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
( ) C:\Program Files\Autodesk\Inventor 2013\Moldflow\bin\mitsijm.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1424896 2011-10-23] (IDT, Inc.)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4859592 2015-11-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\...\MountPoints2: {812851b0-e5e5-11e1-bcc7-80c16eed82d8} - G:\LaunchU3.exe -a
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\...\MountPoints2: {f1582011-9ceb-11e5-a1e3-80c16eed82d8} - G:\startme.exe
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {812851b0-e5e5-11e1-bcc7-80c16eed82d8} - G:\LaunchU3.exe -a
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {f1582011-9ceb-11e5-a1e3-80c16eed82d8} - G:\startme.exe
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll [2012-02-07] (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{D321F810-E538-462A-886F-625BD4CA29E7}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {37B249E7-83C0-40D6-A5CC-180519CC846A} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {37B249E7-83C0-40D6-A5CC-180519CC846A} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1995632801-4156762099-2201499591-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2012-08-16] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-12-02] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-02] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-12-02] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-02] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1995632801-4156762099-2201499591-1000 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ad9t3kb0.default-1386566844496
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-09] ()
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-02] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-09] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1218158.dll [2015-04-17] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-02] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1995632801-4156762099-2201499591-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-09-18] ()
FF Plugin HKU\S-1-5-21-1995632801-4156762099-2201499591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-09-18] ()
FF Extension: Greasemonkey - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ad9t3kb0.default-1386566844496\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2015-11-22]
FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ad9t3kb0.default-1386566844496\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-11-23]
FF Extension: Downloads Window - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ad9t3kb0.default-1386566844496\Extensions\{a7213cf2-fa1e-4373-88ff-255d0abd3020}.xpi [2015-09-16]
FF Extension: Adblock Plus - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ad9t3kb0.default-1386566844496\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-26]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [948392 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1212048 2015-08-26] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
R2 HPSLPSVC; C:\Users\****\AppData\Local\Temp\7zS3986\hpslpsvc64.dll [1039360 2012-08-23] (Hewlett-Packard Co.) [Datei ist nicht signiert]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 mitsijm2013; C:\Program Files\Autodesk\Inventor 2013\Moldflow\bin\mitsijm.exe [339776 2012-01-31] ( )
S3 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S3 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S3 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5613328 2015-07-29] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162072 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [140448 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [75472 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R2 NPF; C:\windows\system32\drivers\npf.sys [35344 2015-12-02] (CACE Technologies, Inc.)
S4 NVHDA; system32\drivers\nvhda64v.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-12-12 14:13 - 2015-12-12 14:14 - 00017704 _____ C:\Users\****\Desktop\FRST.txt
2015-12-12 14:13 - 2015-12-12 14:13 - 00000000 ____D C:\FRST
2015-12-12 14:11 - 2015-12-12 14:11 - 00002390 _____ C:\Users\****\Desktop\avira.txt
2015-12-12 14:07 - 2015-12-12 14:07 - 02369536 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2015-12-12 01:05 - 2015-12-12 12:42 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-12 01:05 - 2015-12-12 01:05 - 00001068 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-12-12 01:05 - 2015-12-12 01:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-12-12 01:05 - 2015-12-12 01:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-12 01:05 - 2015-12-12 01:05 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-12-12 01:05 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2015-12-12 01:05 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-12-12 01:05 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2015-12-11 23:13 - 2015-12-12 03:32 - 00000000 ____D C:\Users\****\Desktop\Kollegah-Zuhaeltertape - Volume_4
2015-12-06 15:21 - 2015-12-06 15:21 - 00004230 _____ C:\windows\System32\Tasks\AMD Updater
2015-12-06 15:15 - 2015-12-06 15:15 - 00000000 ____D C:\Users\****\AppData\Roaming\library_dir
2015-12-06 15:15 - 2015-12-06 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2015-12-06 15:14 - 2015-12-06 15:24 - 00000000 ____D C:\Users\****\AppData\Roaming\Raptr
2015-12-06 15:14 - 2015-12-06 15:15 - 00000000 ____D C:\Program Files (x86)\Raptr
2015-12-06 15:14 - 2015-12-06 15:14 - 00000000 ____D C:\Users\****\AppData\Local\AMD
2015-12-06 15:14 - 2015-12-06 15:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2015-12-06 15:13 - 2015-12-06 15:13 - 00000000 ____D C:\Program Files (x86)\AMD
2015-12-06 15:06 - 2015-12-06 15:14 - 00000000 ____D C:\Program Files\AMD
2015-12-06 15:04 - 2015-12-06 15:04 - 04947168 _____ (Advanced Micro Devices, Inc.) C:\Users\****\Desktop\autodetectutility.exe
2015-12-05 16:17 - 2015-12-05 16:17 - 19917892 _____ C:\Users\****\bedienungsanleitung_telefonanlage_digitalisierungsbox_premium.pdf
2015-12-03 01:30 - 2015-12-03 01:30 - 00000000 ____D C:\Users\****\Documents\Square Enix
2015-12-03 01:30 - 2015-12-03 01:30 - 00000000 ____D C:\Users\****\AppData\Local\CrashRpt
2015-12-02 01:35 - 2015-12-02 01:37 - 576022554 _____ C:\Users\****\Desktop\The.Waking.Ded.S06E08.Ger.Dub.WHRiP.XviD-FIJ.avi
2015-12-02 01:01 - 2015-12-02 01:01 - 00000000 ____D C:\Users\****\AppData\Local\LogView Studio
2015-12-02 01:00 - 2015-12-02 01:00 - 00000000 ____D C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LogView Studio
2015-12-02 01:00 - 2015-12-02 01:00 - 00000000 ____D C:\Program Files (x86)\LogView Studio
2015-12-02 00:13 - 2015-12-02 00:14 - 00000000 ____D C:\Users\****\AppData\Local\NETGEARGenie
2015-12-02 00:13 - 2015-12-02 00:13 - 00369168 _____ (CACE Technologies, Inc.) C:\windows\system32\wpcap.dll
2015-12-02 00:13 - 2015-12-02 00:13 - 00281104 _____ (CACE Technologies, Inc.) C:\windows\SysWOW64\wpcap.dll
2015-12-02 00:13 - 2015-12-02 00:13 - 00106000 _____ (CACE Technologies, Inc.) C:\windows\system32\packet.dll
2015-12-02 00:13 - 2015-12-02 00:13 - 00096784 _____ (CACE Technologies, Inc.) C:\windows\SysWOW64\packet.dll
2015-12-02 00:13 - 2015-12-02 00:13 - 00035344 _____ (CACE Technologies, Inc.) C:\windows\system32\Drivers\npf.sys
2015-11-28 18:57 - 2015-11-13 22:16 - 1506175152 _____ C:\Users\****\Desktop\Knock.Out.UNCUT.avi
2015-11-27 17:42 - 2015-11-27 17:42 - 00123056 _____ C:\Users\****\Desktop\spirit-fw-1.3.2.4df
2015-11-18 14:18 - 2015-11-18 14:23 - 00000000 ____D C:\ProgramData\Easybits Magic Desktop for HP
2015-11-18 09:20 - 2015-11-18 09:20 - 00141792 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\amdhcp64.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00128384 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\amdhcp32.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00120656 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiu9p64.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00118608 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdave64.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00110344 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdave32.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atimpc64.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdpcom64.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atimpc32.dll
2015-11-18 09:20 - 2015-11-18 09:20 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdpcom32.dll
2015-11-18 09:19 - 2015-11-18 09:19 - 10815664 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd64.dll
2015-11-18 09:19 - 2015-11-18 09:19 - 09017808 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd6a.dll
2015-11-18 09:17 - 2015-11-18 09:17 - 00296648 _____ (Advanced Micro Devices) C:\windows\system32\Drivers\amdacpksd.sys
2015-11-18 09:13 - 2015-11-18 09:13 - 23960064 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmdag.sys
2015-11-18 09:08 - 2015-11-18 09:08 - 49984000 _____ (Advanced Micro Devices Inc.) C:\windows\system32\amdocl64.dll
2015-11-18 09:08 - 2015-11-18 09:08 - 00235008 _____ C:\windows\system32\clinfo.exe
2015-11-18 09:02 - 2015-11-18 09:02 - 41510912 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\amdocl.dll
2015-11-18 08:58 - 2015-11-18 08:58 - 00065024 _____ (Khronos Group) C:\windows\system32\OpenCL.dll
2015-11-18 08:57 - 2015-11-18 08:57 - 00059392 _____ (Khronos Group) C:\windows\SysWOW64\OpenCL.dll
2015-11-18 08:50 - 2015-11-18 08:50 - 27596288 _____ (Advanced Micro Devices Inc.) C:\windows\system32\amdocl12cl64.dll
2015-11-18 08:49 - 2015-11-18 08:49 - 22348288 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\amdocl12cl.dll
2015-11-18 06:50 - 2015-11-18 06:50 - 00677888 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\amdlvr64.dll
2015-11-18 06:48 - 2015-11-18 06:48 - 00562688 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\amdlvr32.dll
2015-11-18 06:46 - 2015-11-18 06:46 - 06643200 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdmantle64.dll
2015-11-18 06:46 - 2015-11-18 06:46 - 00127488 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\mantle64.dll
2015-11-18 06:46 - 2015-11-18 06:46 - 00113664 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\mantle32.dll
2015-11-18 06:14 - 2015-11-18 06:14 - 05223936 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdmantle32.dll
2015-11-18 05:48 - 2015-11-18 05:48 - 00096256 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\mantleaxl64.dll
2015-11-18 05:48 - 2015-11-18 05:48 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\mantleaxl32.dll
2015-11-18 05:08 - 2015-11-18 05:08 - 00683960 _____ C:\windows\SysWOW64\atiapfxx.blb
2015-11-18 05:08 - 2015-11-18 05:08 - 00683960 _____ C:\windows\system32\atiapfxx.blb
2015-11-18 05:05 - 2015-11-18 05:05 - 31376896 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atio6axx.dll
2015-11-18 04:43 - 2015-11-18 04:43 - 15711744 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticaldd64.dll
2015-11-18 04:43 - 2015-11-18 04:43 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiapfxx.exe
2015-11-18 04:43 - 2015-11-18 04:43 - 00062464 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalrt64.dll
2015-11-18 04:43 - 2015-11-18 04:43 - 00055808 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalcl64.dll
2015-11-18 04:43 - 2015-11-18 04:43 - 00052224 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalrt.dll
2015-11-18 04:43 - 2015-11-18 04:43 - 00049152 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalcl.dll
2015-11-18 04:40 - 2015-11-18 04:40 - 25840128 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atioglxx.dll
2015-11-18 04:40 - 2015-11-18 04:40 - 14302208 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticaldd.dll
2015-11-18 04:40 - 2015-11-18 04:40 - 00865280 _____ (AMD) C:\windows\system32\coinst_15.30.dll
2015-11-18 04:32 - 2015-11-18 04:32 - 00050688 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdmmcl6.dll
2015-11-18 04:32 - 2015-11-18 04:32 - 00039424 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdmmcl.dll
2015-11-18 04:27 - 2015-11-18 04:27 - 03437632 _____ C:\windows\system32\atiumd6a.cap
2015-11-18 04:26 - 2015-11-18 04:26 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atidemgy.dll
2015-11-18 04:26 - 2015-11-18 04:26 - 00223744 _____ C:\windows\system32\dgtrayicon.exe
2015-11-18 04:25 - 2015-11-18 04:25 - 00552448 _____ (AMD) C:\windows\system32\atieclxx.exe
2015-11-18 04:25 - 2015-11-18 04:25 - 00204800 _____ C:\windows\system32\amdgfxinfo64.dll
2015-11-18 04:25 - 2015-11-18 04:25 - 00189952 _____ C:\windows\SysWOW64\amdgfxinfo32.dll
2015-11-18 04:25 - 2015-11-18 04:25 - 00162304 _____ C:\windows\system32\atieah64.exe
2015-11-18 04:25 - 2015-11-18 04:25 - 00145408 _____ C:\windows\SysWOW64\atieah32.exe
2015-11-18 04:25 - 2015-11-18 04:25 - 00031744 _____ (AMD) C:\windows\system32\atimuixx.dll
2015-11-18 04:24 - 2015-11-18 04:24 - 00246272 _____ (AMD) C:\windows\system32\atiesrxx.exe
2015-11-18 04:22 - 2015-11-18 04:22 - 00190976 _____ (AMD) C:\windows\system32\atitmm64.dll
2015-11-18 04:10 - 2015-11-18 04:10 - 03471376 _____ C:\windows\SysWOW64\atiumdva.cap
2015-11-18 03:58 - 2015-11-18 03:58 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atisamu64.dll
2015-11-18 03:58 - 2015-11-18 03:58 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atisamu32.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 01272832 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiadlxx.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00941568 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atiadlxy.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00941568 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atiadlxx.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00157696 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6txx.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00075776 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6pxx.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00070144 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiglpxx.dll
2015-11-18 03:54 - 2015-11-18 03:54 - 00070144 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiglpxx.dll
2015-11-18 03:53 - 2015-11-18 03:53 - 00671232 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmpag.sys
2015-11-18 03:53 - 2015-11-18 03:53 - 00142336 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atigktxx.dll
2015-11-18 03:45 - 2015-11-18 03:45 - 00195072 _____ C:\windows\system32\hsa-thunk64.dll
2015-11-18 03:45 - 2015-11-18 03:45 - 00174592 _____ C:\windows\SysWOW64\hsa-thunk.dll
2015-11-18 03:43 - 2015-11-18 03:43 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\ati2erec.dll
2015-11-14 13:43 - 2015-11-14 13:43 - 00000000 ____D C:\Users\****\.AnyLogicUniversity
2015-11-14 13:43 - 2015-11-14 13:43 - 00000000 ____D C:\Program Files\Senselock
2015-11-13 15:33 - 2015-11-24 06:09 - 00000000 ____D C:\Users\****\Desktop\twd

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-12-12 14:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2015-12-12 13:57 - 2012-08-04 13:57 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-12-12 12:43 - 2009-07-14 05:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-12 12:43 - 2009-07-14 05:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-12 12:32 - 2012-06-15 00:44 - 18063628 _____ C:\windows\system32\perfh007.dat
2015-12-12 12:32 - 2012-06-15 00:44 - 05623960 _____ C:\windows\system32\perfc007.dat
2015-12-12 12:32 - 2009-07-14 06:13 - 00006504 _____ C:\windows\system32\PerfStringBackup.INI
2015-12-12 12:28 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-12-12 03:32 - 2012-07-23 23:13 - 00000000 ____D C:\Users\****\AppData\Roaming\Mp3tag
2015-12-12 02:11 - 2012-12-28 11:26 - 00000000 ____D C:\Program Files (x86)\Steam
2015-12-12 01:19 - 2013-02-25 23:13 - 00000000 ____D C:\Users\****\Office 2010 Activator v1.4.1.0
2015-12-12 01:19 - 2012-07-19 14:44 - 00000000 ____D C:\Users\****
2015-12-12 00:26 - 2012-07-22 18:54 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2015-12-11 18:10 - 2012-07-19 14:49 - 00003926 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{E6CFB42A-8A13-45D3-BB3C-832EB88BB857}
2015-12-09 19:50 - 2012-07-22 18:30 - 00000000 ____D C:\Users\****\Desktop\musik
2015-12-09 16:57 - 2012-08-04 13:57 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-12-09 16:57 - 2012-06-15 01:12 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-12-09 16:57 - 2012-06-15 01:12 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-06 15:13 - 2009-07-14 04:20 - 00000000 ____D C:\windows\inf
2015-12-06 15:09 - 2013-12-05 04:35 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-06 15:06 - 2012-12-25 20:57 - 00000000 ____D C:\AMD
2015-12-06 15:05 - 2012-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2015-12-04 00:02 - 2013-08-11 15:10 - 00000000 ____D C:\Users\****\Desktop\modellbau
2015-12-02 01:00 - 2013-04-05 19:42 - 00000000 ____D C:\ProgramData\InstallMate
2015-12-02 00:53 - 2015-02-18 16:51 - 00000000 ____D C:\HELI-X6
2015-12-02 00:17 - 2015-10-04 20:51 - 00000000 ____D C:\Program Files (x86)\Spirit Settings
2015-12-02 00:17 - 2015-01-24 02:04 - 00001112 _____ C:\Users\Public\Desktop\Spirit Settings.lnk
2015-12-02 00:17 - 2014-09-08 12:30 - 00001124 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spirit Settings.lnk
2015-12-02 00:11 - 2013-10-10 21:07 - 00000000 ____D C:\ProgramData\Oracle
2015-12-02 00:10 - 2015-01-03 11:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-12-02 00:10 - 2014-01-20 06:04 - 00000000 ____D C:\Program Files\Java
2015-12-02 00:10 - 2014-01-20 05:55 - 00000000 ____D C:\Program Files (x86)\Java
2015-12-02 00:10 - 2013-10-10 21:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-12-02 00:09 - 2015-09-15 03:41 - 00000000 ____D C:\Users\****\.oracle_jre_usage
2015-12-02 00:09 - 2014-01-20 06:04 - 00110176 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2015-12-01 12:09 - 2013-08-07 08:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-12-01 12:08 - 2013-08-07 08:40 - 00162072 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-12-01 12:08 - 2013-08-07 08:40 - 00140448 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-12-01 12:08 - 2013-08-07 08:40 - 00075472 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-11-28 18:37 - 2012-07-24 13:31 - 00000000 ____D C:\Users\****\AppData\Local\CrashDumps
2015-11-27 21:23 - 2015-04-19 18:24 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-23 07:03 - 2012-06-15 01:06 - 00000000 ____D C:\ProgramData\Temp
2015-11-23 06:57 - 2014-02-11 14:05 - 00000000 ____D C:\Users\****\Documents\RealFlight 7
2015-11-18 18:14 - 2015-10-17 18:13 - 00000000 ____D C:\Users\****\Desktop\Scandal
2015-11-18 09:20 - 2012-12-25 20:45 - 01229984 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\aticfx32.dll
2015-11-18 09:20 - 2012-12-25 20:45 - 00133016 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiuxpag.dll
2015-11-18 09:20 - 2012-12-25 20:44 - 10907328 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atidxx32.dll
2015-11-18 09:20 - 2012-09-28 02:11 - 00152568 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiuxp64.dll
2015-11-18 09:20 - 2012-02-14 15:17 - 01496736 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\aticfx64.dll
2015-11-18 09:20 - 2012-02-14 14:52 - 13189336 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atidxx64.dll
2015-11-18 09:20 - 2012-02-14 14:12 - 00102616 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiu9pag.dll
2015-11-18 09:19 - 2012-09-28 03:23 - 09070320 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdag.dll
2015-11-18 09:19 - 2012-09-28 02:22 - 08089248 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdva.dll
2015-11-13 03:26 - 2015-10-29 23:31 - 00000000 ____D C:\Users\****\Desktop\2 Broke Girls - Staffel 4

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-07-15 20:56 - 2010-01-15 09:36 - 0075040 _____ () C:\Program Files (x86)\Common Files\SpeechUninstall.exe
2012-08-29 18:23 - 2013-10-28 06:23 - 0000676 _____ () C:\Users\****\AppData\Roaming\DriveCalculator Preferences
2012-07-19 15:37 - 2012-07-19 15:37 - 0000173 _____ () C:\Users\****\AppData\Local\msmathematics.qat.****
2013-07-12 18:57 - 2013-07-12 18:57 - 0000848 _____ () C:\Users\****\AppData\Local\recently-used.xbel
2014-12-26 10:49 - 2014-12-26 10:49 - 0007605 _____ () C:\Users\****\AppData\Local\Resmon.ResmonCfg

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\****\adwcleaner_4.206.exe
C:\Users\****\HijackThis.exe
C:\Users\****\MP3QualityModifier.exe
C:\Users\****\TeamViewer_Setup_de.exe


Einige Dateien in TEMP:
====================
C:\Users\****\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-12-10 16:04

==================== Ende von FRST.txt ============================