| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem MailanhangWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.01.2016, 17:38
| #1 |
| | ![[Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang - Standard](images/icons/icon1.gif){kind=icon} [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Hallo zusammen, ein Freund von mir hat vor 2 Tagen ausversehen einen Mailanhang mit seltsamen Inhalt aufgemacht. Die Datei war anscheinend leer. Gestern wollte er sich dann bei seinem Onlinebanking anmelden und bekam nach dem login eine seltsame neue "Sicherheitsvorkehrung" präsentiert und sollte mehrere TAN Nummern eingeben. Er wurde zum Glück stutzig aufgrund einiger Rechtschreibfehler und hat nichts eingegeben. Ich vermute jetzt dass der Rechner infiziert ist. Ein komplettcheck mit McAffee hat keine Ergebnisse gebracht. Da er den Router noch auf kompletten Standardeinstellungen hatte, habe ich diesen komplett zurückgesetzt und das Passwort geändert. Ansonsten habe ich noch nichts gemacht. Wie soll ich jetzt weiter vorgehen? EDIT Hier noch der FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:18-01-2016
durchgeführt von ****** (Administrator) auf HOMEOFFICE (22-01-2016 17:55:44)
Gestartet von C:\Users\******\Downloads
Geladene Profile: ****** (Verfügbare Profile: ******)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
() C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Mindspark) C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbarsvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsScan_6.3.9654.17133_x64__8wekyb3d8bbwe\scanapp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] => "C:\PROGRA~2\RADIOR~2\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2014-06-06] (Realtek Semiconductor)
HKLM-x32\...\Run: [RadioRage EPM Support] => C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jmedint.exe [12824 2016-01-13] (Mindspark)
HKLM-x32\...\Run: [RadioRage Search Scope Monitor] => "C:\PROGRA~2\RADIOR~2\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
HKLM-x32\...\Run: [RadioRage_4j Browser Plugin Loader] => C:\PROGRA~2\RADIOR~2\bar\1.bin\4jbrmon.exe
HKLM-x32\...\Run: [RadioRage_4j Browser Plugin Loader 64] => C:\PROGRA~2\RADIOR~2\bar\1.bin\4jbrmon64.exe
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LauncherC1765nf] => C:\Program Files (x86)\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM-x32\...\Run: [StatusAutoRunC1765nf] => C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3850216 2013-02-06] (Dell Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort14reminder] => "C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\14\Config\Ereg\Ereg.ini"
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [RadioRage AppIntegrator 32-bit] => C:\Program Files (x86)\RadioRage_4j\bar\2.bin\AppIntegrator.exe [230424 2016-01-13] (Mindspark)
HKLM-x32\...\Run: [RadioRage AppIntegrator 64-bit] => C:\Program Files (x86)\RadioRage_4j\bar\2.bin\AppIntegrator64.exe [265752 2016-01-13] (Mindspark)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [24952376 2015-12-22] (Dropbox, Inc.)
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.4726.0226] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.4726.0226"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5907.0716] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5907.0716"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5930.0814] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5930.0814"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5951.0827] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\******\AppData\Local\Microsoft\OneDrive\17.3.5951.0827"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {50cf1d18-0370-11e4-825f-f0921ce1d5b1} - "F:\EasySuite.exe"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {547c5f6e-e7d8-11e3-8257-f0921ce1d5b1} - "F:\EasySuite.exe"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {547c653b-e7d8-11e3-8257-f0921ce1d5b1} - "F:\EasySuite.exe"
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => Keine Datei
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => Keine Datei
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-16]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyServer: [S-1-5-21-3515514006-1524455674-3752257747-1001] => 192.168.144.254:8080
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{5DA05922-7AF7-4783-A17E-1BAD0AB0AE94}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DA12B626-F5E6-41B2-B8A9-148FAA741D80}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.tb.ask.com/index.jhtml?n=77FD35DB&p2=^ZX^xdm448^LADEDE^de&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&si=CLii6Zz25b4CFSJqOgodDGsA6w
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
URLSearchHook: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 - (Kein Name) - {3c35ad63-af1d-4e21-b484-b6651a8efcf9} - C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jSrcAs.dll (Mindspark)
SearchScopes: HKLM -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^ZX^xdm448^LADEDE^de&si=CLii6Zz25b4CFSJqOgodDGsA6w&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&ind=2014060614&n=780c2046&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> DefaultScope {3D03DBCF-5477-4166-A890-BA05DA3F4030} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3323878&octid=EB_ORIGINAL_CTID&ISID=MBC844308-C977-4866-BF7B-0533644E97A3&SearchSource=58&CUI=&UM=5&UP=SP9F3586F2-FEA1-402C-AD4A-A5DF44A9053D&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^ZX^xdm448^LADEDE^de&si=CLii6Zz25b4CFSJqOgodDGsA6w&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&ind=2014060614&n=780c2046&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {3D03DBCF-5477-4166-A890-BA05DA3F4030} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {A5BE9AC0-9890-4C14-A001-C2319FD33FDA} URL = hxxps://de.search.yahoo.com/search?fr=mcafee&type=C011DE739D20151102&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-12-16] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-01-20] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Toolbar BHO -> {48909954-14fb-4971-a7b3-47e7af10b38a} -> C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbar.dll [2016-01-13] (Mindspark)
BHO-x32: Search Assistant BHO -> {5848763c-2668-44ca-adbe-2999a6ee2858} -> C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jSrcAs.dll [2016-01-13] (Mindspark)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM-x32 - RadioRage - {78ba36c9-6036-482b-b48d-ecca6f964b84} - C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbar.dll [2016-01-13] (Mindspark)
Toolbar: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> RadioRage - {78BA36C9-6036-482B-B48D-ECCA6F964B84} - C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbar.dll Keine Datei
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2015-12-03] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-12-03] (McAfee, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Homepage: hxxps://mail.google.com/mail/u/0/?tab=wm#inbox
FF Keyword.URL: hxxps://de.search.yahoo.com/search?fr=mcafee&type=B111DE739D20140704&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_286.dll [2016-01-20] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_286.dll [2016-01-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2014-12-08] (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-06-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-06] (Microsoft Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4j\bar\2.bin\NP4jStub.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\google-images.xml [2015-06-19]
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\google-maps.xml [2015-06-19]
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\McSiteAdvisor.xml [2016-01-22]
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\startpage-ssl.xml [2014-06-07]
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\youtube.xml [2015-11-13]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2015-04-01]
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-11-23]
FF Extension: WEB.DE MailCheck - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\extensions\mailcheck@web.de [2015-12-16]
FF Extension: Cliqz - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\Extensions\cliqz@cliqz.com.xpi [2016-01-21]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-12-16] [ist nicht signiert]
FF HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\extensions\cliqz@cliqz.com => nicht gefunden
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-12-02]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-12-02]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [Datei ist nicht signiert]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2787512 2015-12-22] (Microsoft Corporation)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-20] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-20] (Dropbox, Inc.)
R2 DLNBDB; C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [244712 2013-02-06] ()
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [157928 2015-12-02] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [863448 2015-12-03] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe [1694152 2015-12-02] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [679120 2015-10-20] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [233680 2015-09-21] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [378848 2015-10-21] (McAfee, Inc.)
R3 mfevtp; C:\windows\system32\mfevtps.exe [256840 2015-09-21] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [Datei ist nicht signiert]
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)
R2 RadioRage_4jService; C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbarsvc.exe [90648 2016-01-13] (Mindspark)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2014-06-06] (Realtek Semiconductor)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [80760 2015-09-23] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [415976 2015-09-23] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351120 2015-09-23] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [82072 2015-09-23] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [497888 2015-09-23] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [841944 2015-09-23] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [537192 2015-10-06] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2015-10-06] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [37960 2015-12-02] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [244544 2015-09-23] (McAfee, Inc.)
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 DNIMp50a64; System32\Drivers\DNIMp50a64.sys [X]
S3 DNISp50a64; System32\Drivers\DNISp50a64.sys [X]
S3 SPPD; \??\C:\windows\system32\drivers\SPPD.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-01-22 17:55 - 2016-01-22 17:59 - 00030173 _____ C:\Users\******\Downloads\FRST.txt
2016-01-22 17:53 - 2016-01-22 17:55 - 00000000 ____D C:\FRST
2016-01-22 17:53 - 2016-01-22 17:53 - 02370560 _____ (Farbar) C:\Users\******\Downloads\FRST64.exe
2016-01-22 17:48 - 2016-01-22 17:48 - 00003846 _____ C:\windows\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-01-21 15:25 - 2016-01-21 15:25 - 00151016 _____ C:\Users\******\Desktop\INNOTEC wav-e_Korrektur.pdf
2016-01-20 12:36 - 2016-01-20 12:36 - 55976344 _____ (Dropbox, Inc.) C:\Users\******\Downloads\Dropbox 3.12.6 Offline Installer.exe
2016-01-20 11:50 - 2016-01-20 11:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-01-20 11:49 - 2016-01-20 11:49 - 00690072 _____ (Dropbox, Inc.) C:\Users\******\Downloads\DropboxInstaller(2).exe
2016-01-20 11:45 - 2016-01-20 11:45 - 00690072 _____ (Dropbox, Inc.) C:\Users\******\Downloads\DropboxInstaller(1).exe
2016-01-20 11:32 - 2016-01-22 16:37 - 00001250 _____ C:\windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-01-20 11:32 - 2016-01-22 11:37 - 00001246 _____ C:\windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-01-20 11:32 - 2016-01-20 11:50 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-01-20 11:32 - 2016-01-20 11:32 - 00004222 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineUA
2016-01-20 11:32 - 2016-01-20 11:32 - 00003986 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineCore
2016-01-20 11:31 - 2016-01-20 11:31 - 00690072 _____ (Dropbox, Inc.) C:\Users\******\Downloads\DropboxInstaller.exe
2016-01-20 11:27 - 2016-01-20 11:27 - 00063877 _____ C:\Users\******\Downloads\16-0002575018_3176947_4152c9fd5456d30339e0d0110a66fb9a.pdf
2016-01-20 11:18 - 2016-01-20 11:18 - 00063942 _____ C:\Users\******\Downloads\16-0002574928_3176846_6e5f765356fa54f0d27ac5d62343beb8.pdf
2016-01-18 19:36 - 2016-01-22 07:44 - 00004020 _____ C:\windows\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse
2016-01-13 14:36 - 2015-12-11 05:38 - 25837568 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-01-13 14:36 - 2015-12-11 04:55 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-01-13 14:36 - 2015-12-11 03:43 - 04610560 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-01-13 14:35 - 2015-12-11 05:00 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-01-13 14:35 - 2015-12-11 04:50 - 20367360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-01-13 14:35 - 2015-12-11 04:45 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-01-13 14:35 - 2015-12-11 04:21 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-01-13 14:35 - 2015-12-11 04:18 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-01-13 14:35 - 2015-12-11 04:09 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2016-01-13 14:35 - 2015-12-11 04:09 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-01-13 14:35 - 2015-12-11 04:03 - 14456832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-01-13 14:35 - 2015-12-11 03:59 - 00798208 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-01-13 14:35 - 2015-12-11 03:43 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2016-01-13 14:35 - 2015-12-11 03:38 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-01-13 14:35 - 2015-12-11 03:37 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-01-13 14:35 - 2015-12-11 03:35 - 12856320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-01-13 14:35 - 2015-12-11 03:26 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-01-13 14:35 - 2015-12-11 03:14 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-01-13 14:35 - 2015-12-11 03:12 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-01-13 14:35 - 2015-12-11 03:08 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-01-13 14:35 - 2015-12-11 03:07 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-01-13 14:34 - 2015-12-30 20:32 - 07453016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2016-01-13 14:34 - 2015-12-30 20:32 - 01735000 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2016-01-13 14:34 - 2015-12-30 20:32 - 01499912 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2016-01-13 14:34 - 2015-12-10 01:40 - 00033456 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-01-13 14:34 - 2015-12-08 20:08 - 00685432 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2016-01-13 14:34 - 2015-12-08 20:07 - 00507176 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2016-01-13 14:34 - 2015-12-07 11:56 - 01380600 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 02745184 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02528784 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02450240 _____ (Microsoft Corporation) C:\windows\system32\WMVENCOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02447136 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVENCOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02334104 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 02324744 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01877504 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2adec.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01798480 ____C (Microsoft Corporation) C:\windows\system32\WMALFXGFXDSP.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01484888 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2adec.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01288128 _____ (Microsoft Corporation) C:\windows\system32\mfnetsrc.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01210200 _____ (Microsoft Corporation) C:\windows\system32\WMADMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 01150232 _____ (Microsoft Corporation) C:\windows\system32\WMADMOE.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 01115640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfnetsrc.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01037680 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00914672 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOE.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00850680 _____ (Microsoft Corporation) C:\windows\system32\mfnetcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00735496 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00700360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfnetcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00629600 _____ (Microsoft Corporation) C:\windows\system32\MP4SDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00584656 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00557856 _____ (Microsoft Corporation) C:\windows\system32\WMVSDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00498472 _____ (Microsoft Corporation) C:\windows\system32\mfsvr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00492736 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00463776 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP4SDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00399776 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfsvr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00299080 _____ (Microsoft Corporation) C:\windows\system32\VIDRESZR.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00275312 _____ (Microsoft Corporation) C:\windows\SysWOW64\MPG4DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00274280 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP43DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00250520 _____ (Microsoft Corporation) C:\windows\system32\MPG4DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00248432 _____ (Microsoft Corporation) C:\windows\system32\MP43DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00246856 _____ (Microsoft Corporation) C:\windows\system32\RESAMPLEDMO.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00244296 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00229272 _____ (Microsoft Corporation) C:\windows\SysWOW64\RESAMPLEDMO.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00203016 _____ (Microsoft Corporation) C:\windows\system32\COLORCNV.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00184912 _____ (Microsoft Corporation) C:\windows\SysWOW64\COLORCNV.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00183856 _____ (Microsoft Corporation) C:\windows\SysWOW64\VIDRESZR.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00116720 _____ (Microsoft Corporation) C:\windows\system32\MP3DMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00110544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00099136 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP3DMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00090904 _____ (Microsoft Corporation) C:\windows\system32\devenum.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00090392 _____ (Microsoft Corporation) C:\windows\system32\mfvdsp.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00081032 _____ (Microsoft Corporation) C:\windows\SysWOW64\devenum.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00076936 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfvdsp.dll
2016-01-13 14:34 - 2015-12-04 16:00 - 01097216 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00561952 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2016-01-13 14:34 - 2015-12-03 20:42 - 00397224 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00137968 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00106960 _____ (Microsoft Corporation) C:\windows\system32\ncryptsslp.dll
2016-01-13 14:34 - 2015-12-03 20:41 - 00177488 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-01-13 14:34 - 2015-12-03 19:52 - 00340872 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2016-01-13 14:34 - 2015-12-03 19:52 - 00120376 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-01-13 14:34 - 2015-12-03 19:52 - 00091416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncryptsslp.dll
2016-01-13 14:34 - 2015-12-03 19:28 - 00401920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-01-13 14:34 - 2015-12-03 19:28 - 00202240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-01-13 14:34 - 2015-12-03 19:07 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2016-01-13 14:34 - 2015-12-03 19:07 - 00289792 _____ (Microsoft Corporation) C:\windows\system32\ksproxy.ax
2016-01-13 14:34 - 2015-12-03 19:05 - 00644608 _____ (Microsoft Corporation) C:\windows\system32\WMVXENCD.DLL
2016-01-13 14:34 - 2015-12-03 19:02 - 01664000 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOE.DLL
2016-01-13 14:34 - 2015-12-03 19:00 - 00451072 _____ (Microsoft Corporation) C:\windows\system32\WMVSENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:58 - 00378880 ____C (Microsoft Corporation) C:\windows\system32\SysFxUI.dll
2016-01-13 14:34 - 2015-12-03 18:51 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2016-01-13 14:34 - 2015-12-03 18:36 - 01697792 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2016-01-13 14:34 - 2015-12-03 18:30 - 00468480 _____ (Microsoft Corporation) C:\windows\system32\MFWMAAEC.DLL
2016-01-13 14:34 - 2015-12-03 18:28 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2016-01-13 14:34 - 2015-12-03 18:28 - 00245760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksproxy.ax
2016-01-13 14:34 - 2015-12-03 18:27 - 00736256 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVXENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:24 - 01411584 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOE.DLL
2016-01-13 14:34 - 2015-12-03 18:23 - 00402432 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:16 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2016-01-13 14:34 - 2015-12-03 18:13 - 01441280 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-01-13 14:34 - 2015-12-03 18:07 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-01-13 14:34 - 2015-12-03 18:06 - 01501184 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2016-01-13 14:34 - 2015-12-03 18:01 - 00743936 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFWMAAEC.DLL
2016-01-13 14:34 - 2015-12-03 17:45 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-01-13 14:34 - 2015-12-03 17:40 - 01010688 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOD.DLL
2016-01-13 14:34 - 2015-12-03 17:29 - 00887296 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOD.DLL
2016-01-13 14:34 - 2015-12-02 16:04 - 00670208 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2016-01-13 14:34 - 2015-12-02 16:01 - 00561664 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 01380864 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00792064 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00705024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-01-08 11:18 - 2016-01-08 11:18 - 00000000 ____D C:\Users\******\AppData\LocalLow\Adobe
2016-01-08 11:18 - 2016-01-08 11:18 - 00000000 ____D C:\Users\******\AppData\Local\CEF
2016-01-07 17:21 - 2016-01-13 08:16 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2016-01-07 17:20 - 2016-01-13 08:15 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-01-07 17:20 - 2016-01-07 17:20 - 00002074 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-01-07 17:18 - 2016-01-08 11:19 - 00000000 ____D C:\ProgramData\Adobe
2016-01-07 17:18 - 2016-01-07 17:18 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-01-06 23:13 - 2016-01-16 15:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-04 09:26 - 2016-01-04 09:27 - 00017577 _____ C:\Users\******\Downloads\DRP56524684.pdf
2015-12-23 14:01 - 2015-12-23 14:01 - 00010952 _____ C:\Users\******\Downloads\Ihre Retourenmarke(1).pdf
2015-12-23 13:05 - 2015-12-23 13:05 - 00010392 _____ C:\Users\******\Downloads\Ihre Retourenmarke.pdf
2015-12-23 08:48 - 2015-12-23 08:48 - 01503872 _____ (Skype Technologies S.A.) C:\Users\******\Downloads\SkypeSetup(1).exe
2015-12-23 08:09 - 2015-12-23 08:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-12-23 08:08 - 2015-12-23 08:08 - 00003142 _____ C:\windows\System32\Tasks\{08ADFC07-D33C-49B3-B4D3-DB9A6BC0A54F}
2015-12-23 08:06 - 2015-12-23 08:06 - 01503872 _____ (Skype Technologies S.A.) C:\Users\******\Downloads\SkypeSetup.exe
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-01-22 17:55 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2016-01-22 17:54 - 2014-07-11 07:06 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-01-22 17:14 - 2014-02-11 06:12 - 00065536 _____ C:\windows\system32\spu_storage.bin
2016-01-22 16:52 - 2014-07-04 09:39 - 00000000 ____D C:\Users\******\Documents\Outlook-Dateien
2016-01-22 16:28 - 2015-01-06 17:01 - 00001140 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-22 12:53 - 2014-05-29 13:57 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3515514006-1524455674-3752257747-1001
2016-01-22 12:45 - 2015-08-28 17:10 - 00000386 _____ C:\windows\Tasks\HPCeeScheduleFor******.job
2016-01-22 08:28 - 2015-01-06 17:01 - 00001136 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-22 08:18 - 2015-05-03 09:56 - 00000000 ____D C:\Users\******\AppData\Roaming\Skype
2016-01-22 08:18 - 2015-05-03 09:56 - 00000000 ____D C:\ProgramData\Skype
2016-01-22 07:49 - 2014-07-26 11:32 - 00000000 ___RD C:\Users\******\Dropbox
2016-01-22 07:49 - 2014-07-26 11:20 - 00000000 ____D C:\Users\******\AppData\Roaming\Dropbox
2016-01-22 07:48 - 2014-09-27 15:19 - 00000000 __RDO C:\Users\******\OneDrive
2016-01-22 07:39 - 2013-08-22 14:36 - 00000000 ____D C:\windows\Inf
2016-01-21 13:28 - 2014-05-29 13:52 - 00000000 ____D C:\Users\******\AppData\Local\Packages
2016-01-21 12:59 - 2013-08-22 16:36 - 00000000 ____D C:\windows\system32\FxsTmp
2016-01-20 13:35 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-01-20 13:33 - 2014-06-07 10:51 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-01-20 13:33 - 2013-08-22 15:45 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-01-20 13:32 - 2013-08-22 14:25 - 00524288 ___SH C:\windows\system32\config\BBI
2016-01-20 12:27 - 2015-06-17 09:50 - 00000000 ____D C:\Users\******\AppData\Local\Dropbox
2016-01-20 11:43 - 2014-05-29 13:52 - 00000000 ____D C:\Users\******
2016-01-20 11:42 - 2014-07-11 07:06 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-01-20 11:39 - 2014-05-29 13:52 - 00000000 ____D C:\Users\******\AppData\Local\VirtualStore
2016-01-20 11:38 - 2014-07-26 11:32 - 00001253 _____ C:\Users\******\Desktop\Dropbox.lnk
2016-01-18 19:36 - 2013-08-22 14:25 - 00262144 ___SH C:\windows\system32\config\ELAM
2016-01-18 04:55 - 2013-08-22 16:36 - 00000000 ____D C:\windows\rescache
2016-01-16 15:33 - 2014-02-11 07:07 - 02922240 _____ C:\windows\system32\perfh007.dat
2016-01-16 15:33 - 2014-02-11 07:07 - 00843936 _____ C:\windows\system32\perfc007.dat
2016-01-16 15:33 - 2013-08-24 22:38 - 00337716 _____ C:\windows\system32\PerfStringBackup.INI
2016-01-16 15:24 - 2014-06-07 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-16 15:19 - 2015-04-17 10:28 - 00000000 ____D C:\windows\system32\appraiser
2016-01-16 15:19 - 2015-03-14 08:31 - 00000000 ___SD C:\windows\system32\CompatTel
2016-01-16 15:17 - 2014-06-01 17:52 - 00000000 ____D C:\windows\system32\MRT
2016-01-16 15:09 - 2014-06-01 17:52 - 143671360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-01-15 22:51 - 2015-05-03 09:56 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-01-15 18:45 - 2015-08-28 17:10 - 00003216 _____ C:\windows\System32\Tasks\HPCeeScheduleFor******
2016-01-13 14:58 - 2013-08-22 16:20 - 00000000 ____D C:\windows\CbsTemp
2016-01-11 17:16 - 2015-06-09 09:22 - 00000000 ____D C:\Users\******\AppData\Local\Microsoft Help
2016-01-08 11:18 - 2014-12-16 10:36 - 00000000 ____D C:\Users\******\AppData\Local\Adobe
2016-01-08 11:18 - 2014-05-29 13:52 - 00000000 ____D C:\Users\******\AppData\Roaming\Adobe
2016-01-07 17:24 - 2014-09-12 10:31 - 00000000 ____D C:\Users\******\Buchhaltung & Steuer
2016-01-07 17:11 - 2014-10-03 12:29 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2016-01-07 17:06 - 2015-01-23 13:23 - 00000000 __SHD C:\Users\******\AppData\LocalLow\EmieUserList
2016-01-07 17:06 - 2015-01-23 13:23 - 00000000 __SHD C:\Users\******\AppData\LocalLow\EmieBrowserModeList
2016-01-07 17:06 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\******\AppData\LocalLow\EmieSiteList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\******\AppData\Local\EmieUserList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\******\AppData\Local\EmieSiteList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\******\AppData\Local\EmieBrowserModeList
2016-01-07 10:38 - 2014-05-30 12:13 - 00000000 ____D C:\Users\******\Documents\Nadja
2016-01-05 21:04 - 2015-04-17 10:35 - 00826872 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-01-05 21:04 - 2015-04-17 10:35 - 00176632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-30 08:09 - 2014-07-12 15:30 - 00000000 ____D C:\Users\******\Documents\Benutzerdefinierte Office-Vorlagen
2015-12-23 08:09 - 2015-05-03 09:57 - 00000000 ____D C:\Users\******\AppData\Local\Skype
2015-12-23 08:09 - 2015-05-03 09:56 - 00002715 _____ C:\Users\Public\Desktop\Skype.lnk
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-06-09 10:06 - 2015-06-09 10:06 - 0037064 _____ () C:\Users\******\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
Einige Dateien in TEMP:
====================
C:\Users\******\AppData\Local\Temp\Extract.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-01-15 05:54
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:18-01-2016
durchgeführt von ******** (2016-01-22 18:01:08)
Gestartet von C:\Users\********\Downloads
Windows 8.1 (X64) (2014-05-29 12:52:03)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
******** (S-1-5-21-3515514006-1524455674-3752257747-1001 - Administrator - Enabled) => C:\Users\********
Administrator (S-1-5-21-3515514006-1524455674-3752257747-500 - Administrator - Disabled)
Gast (S-1-5-21-3515514006-1524455674-3752257747-501 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Out of date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Out of date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.010.20056 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.286 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AMD Catalyst Install Manager (HKLM\...\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CalendarSyncPlus (HKLM-x32\...\{09626C13-BFCB-4BF6-B894-05432F8F9ECA}) (Version: 1.2.1 - Ankesh Dave & Akanksha Gaur)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
CLIQZ (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 1.0.0 - CLIQZ.com)
CSV-Import 4.2 (HKLM-x32\...\CSV-Import_is1) (Version: - tm)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell C1765 Color MFP (HKLM-x32\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (x32 Version: 1.039.0 - Dell Inc.) Hidden
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.12.6 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.77 - Dropbox, Inc.) Hidden
EasyCash&Tax 2.17 (HKLM-x32\...\EasyCash&Tax_is1) (Version: - tm)
EasyRide&Tax 2.4 (HKLM-x32\...\EasyRide&Tax_is1) (Version: - tm)
ECTPlugAnlagenverzeichnis 1.5 (HKLM-x32\...\ECTPlugAnlagenverzeichnis_is1) (Version: - wolfram)
ECTPlugJavaScriptJournal 1.05 (HKLM-x32\...\ECTPlugJavaScriptJournal_is1) (Version: - tm)
ECTPlugWolframsJournal 1.03 (HKLM-x32\...\ECTPlugWolframsJournal_is1) (Version: - wolfram)
Elster-Export 2.5 (HKLM-x32\...\Elster-Export Plugin für EasyCash&Tax_is1) (Version: - tm)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP Documentation (HKLM-x32\...\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7045.4591 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
McAfee Internet Security (HKLM-x32\...\MSC) (Version: 14.0.6136 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.266.3 - McAfee, Inc.)
McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 7.6.0.202 - McAfee, Inc.)
McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.207 - McAfee, Inc.)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4787.1002 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4787.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\OneDriveSetup.exe) (Version: 17.3.6281.1202 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\...\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 43.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 43.0.4 (x86 de)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.4.5848 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Nuance PaperPort 14 (HKLM-x32\...\{08BCE67B-6305-4D8A-B749-F381E7E3DDA2}) (Version: 14.5.0000 - Nuance Communications, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 Create Module (HKLM-x32\...\{3D0D9604-0173-488D-9694-2638C44D7579}) (Version: 2.1.6.19758 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{D691E998-CF53-4F6C-AC20-E4284660E0E7}) (Version: 2.1.6.19758 - pdfforge GmbH)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
RadioRage Internet Explorer Toolbar (HKLM-x32\...\RadioRage_4jbar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ACHTUNG
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.30175 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7090 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.109 - Skype Technologies S.A.)
SUCCESSCONTROL CRM (HKLM-x32\...\{D894B85B-136E-492A-A893-CAD5F8AEF1D4}) (Version: 4.2.0 - Steppat GmbH - D 55743 Idar-Oberstein)
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.1.1739 - 1&1 Mail & Media GmbH)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WN111v2 (x32 Version: 3.0.0.3 - NETGEAR) Hidden
ZusammenfassendeMeldung 1.1 (HKLM-x32\...\ZusammenfassendeMeldung_is1) (Version: - tm)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {016A6395-22B5-40B1-B183-5B0F7429F26C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)
Task: {02AA71AC-36DC-4407-8D2E-EFF4B3829DF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0942731C-272F-4B27-8B0C-A93CF1C3F0A8} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {16435DAD-69E9-40FD-AF87-382F9F8C1E70} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {2376F85A-8A90-4C76-9463-9DBF2784ACB7} - System32\Tasks\HPCeeScheduleFor******** => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {271C63F0-37B1-4EC5-A7FB-998EC0E9FC08} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {2AEF7917-86DA-4A47-8AE9-E3D4440B0986} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {2FDE4632-7E8F-40DA-87A3-74CE1CB52E35} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3515514006-1524455674-3752257747-1001 => C:\Users\********\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2015-12-16] (Microsoft Corporation)
Task: {347F3D3E-92DF-448D-B4E7-1EB024E668E5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {36643155-C930-49DF-BC5D-71C598C6AE54} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-20] (Adobe Systems Incorporated)
Task: {3C0A963C-BC72-4E38-80BB-3FBB642F247F} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {5B97B846-EE62-452E-B772-FB7B8509BEB6} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)
Task: {67330A4E-4753-4E59-9FA0-70885A682597} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-01-20] (Microsoft Corporation)
Task: {6D608DE3-D36E-428B-B1B3-611784DEC3CB} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {7310BB94-2559-424B-8B0A-093ED95050BE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2016-01-16] (Microsoft Corporation)
Task: {77414170-08D5-4F7B-A7F4-3489F7BAB26B} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\21.0\mcdatrep.exe [2015-08-04] (McAfee, Inc.)
Task: {7DE2467A-EF9B-4870-A9B0-DE93D3EF5CC8} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-01-20] (Dropbox, Inc.)
Task: {85A0DEF0-1C6F-4BC2-ABA5-66A73B157384} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {8C9B6C78-0926-44A5-AC6D-C86667F63E09} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {8DBFB9C4-71AD-4689-81A2-662721EC6BA4} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {A42700F9-F984-41DA-862A-BDA548A734CD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2015-11-30] (Hewlett-Packard)
Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {CC1E1561-C026-43CA-8983-541CDF70A6C6} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-01-20] (Dropbox, Inc.)
Task: {D78F2D51-3A7B-4229-9F82-5339451A1053} - System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\21.0\mcdatrep.exe [2015-08-04] (McAfee, Inc.)
Task: {D7E95B81-AE81-4634-BFFE-227DC206BB77} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {D93B9F13-F587-468C-8D5E-5B2045F6FDD3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-01-06] (HP Inc.)
Task: {F9FA8821-9729-4A47-8883-4A10A0352E11} - System32\Tasks\{08ADFC07-D33C-49B3-B4D3-DB9A6BC0A54F} => Firefox.exe hxxp://ui.skype.com/ui/0/7.17.0.105/de/abandoninstall?source=lightinstaller&page=tsInstall
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFor********.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2013-09-05 12:22 - 2013-09-05 12:22 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-09-05 12:24 - 2013-09-05 12:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-09-05 12:24 - 2013-09-05 12:24 - 02540544 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-09-05 12:36 - 2013-09-05 12:36 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-09-05 12:36 - 2013-09-05 12:36 - 01298832 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2014-10-31 12:33 - 2012-06-20 15:15 - 00032768 _____ () C:\windows\system32\spool\PRTPROCS\x64\dltfm1zPP.dll
2013-02-06 17:40 - 2013-02-06 17:40 - 00244712 _____ () C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2014-10-31 12:10 - 2012-06-16 08:44 - 00046080 _____ () C:\windows\system32\dltsm1zwia.dll
2014-06-09 12:16 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-11-23 17:08 - 2014-11-23 17:08 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-12-16 09:10 - 2016-01-20 13:24 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2015-12-16 09:03 - 00000860 ____A C:\windows\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\********\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img1.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "RadioRage Home Page Guard 64 bit"
HKLM\...\StartupApproved\Run32: => "RadioRage Search Scope Monitor"
HKLM\...\StartupApproved\Run32: => "RadioRage EPM Support"
HKLM\...\StartupApproved\Run32: => "RadioRage_4j Browser Plugin Loader 64"
HKLM\...\StartupApproved\Run32: => "RadioRage_4j Browser Plugin Loader"
HKLM\...\StartupApproved\Run32: => "ISUSPM"
HKLM\...\StartupApproved\Run32: => "PPort14reminder"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "StatusAutoRunC1765nf"
HKLM\...\StartupApproved\Run32: => "LauncherC1765nf"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\StartupApproved\Run: => "Skype"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{33E24917-742B-4527-9DEE-C2BF7CB8D87D}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{80E99A19-ABAC-481A-B8D7-BACACF113E95}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{B4B5DC24-64C9-436F-AA56-D640F9DB0503}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{24BFB005-758A-48C3-B46B-E5AB73272C8E}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{F6C8599B-CDCB-4664-BD52-BA15F4D9E61A}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{01C790EB-14CB-4EC4-9FBA-D55B14DE1659}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{692CC1B8-C285-418F-92BE-A7A2E006D67F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{534BDA09-DE5E-4B43-A389-4F55B92D5EAC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7251BA1D-FC6A-4EB6-9D2F-A1098602A17C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{68237D3B-31DA-4706-8650-CB17D8F6A587}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5D9D469A-5DD5-4112-BCEB-D9EE4B85B21B}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{E555171E-5F28-40A0-A2FE-8FD033E0D7A2}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{6D63F0CC-FC57-4E3D-BC55-1761EED0FA0C}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{91226246-1044-4B2C-8AF4-7099FDE2F79C}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{4E9A8836-14F4-4397-9DF0-C82FB5830AAE}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{62E564B1-711A-49D7-BA53-552F8EC54223}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{BB66F94F-D934-4718-B788-2AB62E089909}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{16EE3E62-34EE-4265-A2D9-82E64DE46AD9}] => (Allow) LPort=2869
FirewallRules: [{D5322942-F6A2-45BB-85E3-E1E8423CF434}] => (Allow) LPort=1900
FirewallRules: [{9224B02A-1158-4E2C-8B01-2A4A0DC1F3A5}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{33147003-E8D8-463F-9073-EF532CD7D747}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{823C5044-4DC5-4F25-84E8-74019F12DF1B}] => (Allow) C:\Users\********\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{FA7CAB91-8538-44E0-B1E4-3585FF51E700}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{B4F9D888-19C5-43D2-8A8D-890A4FF83910}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{E261EF4E-C179-440C-B350-0A7A0E6E934F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9FAA7775-E9FE-42D5-985C-FFE9A45B5D75}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F397FD54-03BF-4EF9-817F-A9159B820F60}] => (Allow) C:\Users\********\AppData\Roaming\McAfee\Supportability\MVTLogs\ProductDetection64.exe
FirewallRules: [{739EB8A2-418E-41A0-B664-478C5984BE1A}] => (Allow) C:\Users\********\AppData\Roaming\McAfee\Supportability\MVTLogs\ProductDetection64.exe
FirewallRules: [TCP Query User{2C5E7836-B533-499E-8690-C8251DC974C1}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{9AEA9E3D-0A88-48D7-A52C-FE372A4290F6}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{59B7BE52-01C5-4BEB-8955-B150BBCD449C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{93808A96-1832-44DA-BEE4-E3663D335D47}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{856697D2-CEF8-4F5C-AC23-FD807139EDC1}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{740F1841-B445-40BA-8ADC-904D339A9AFA}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
==================== Wiederherstellungspunkte =========================
04-01-2016 09:02:46 Geplanter Prüfpunkt
13-01-2016 08:11:36 Geplanter Prüfpunkt
13-01-2016 20:16:27 HPSF Restore Point
15-01-2016 07:46:48 McAfee Vulnerability Scanner
22-01-2016 08:15:09 McAfee Vulnerability Scanner
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3110
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3110
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1547
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1547
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2016 01:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6578
Error: (01/22/2016 01:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6578
Error: (01/22/2016 01:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2016 01:09:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4719
Systemfehler:
=============
Error: (01/22/2016 05:14:50 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 9 Mal passiert.
Error: (01/22/2016 04:56:01 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.0.4 mit dem Computer mit der
Netzwerkhardwareadresse 48-5A-3F-6B-B4-47 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.
Error: (01/22/2016 04:53:59 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (01/22/2016 04:53:44 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:44 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:38 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:38 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:35 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:35 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:34 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
==================== Speicherinformationen ===========================
Prozessor: AMD A6-5200 APU with Radeon(TM) HD Graphics
Prozentuale Nutzung des RAM: 57%
Installierter physikalischer RAM: 3531.63 MB
Verfügbarer physikalischer RAM: 1498.85 MB
Summe virtueller Speicher: 6094.8 MB
Verfügbarer virtueller Speicher: 2142.19 MB
==================== Laufwerke ================================
Drive c: (Windows) (Fixed) (Total:470.73 GB) (Free:363.76 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (Recovery Image) (Fixed) (Total:9.49 GB) (Free:1.16 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: (Achim) (CDROM) (Total:0.49 GB) (Free:0 GB) UDF
Drive f: () (Removable) (Total:116.5 GB) (Free:104.35 GB) FAT32
Drive h: (Volume) (Fixed) (Total:449.8 GB) (Free:370.24 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EC635F4D)
Partition: GPT.
========================================================
Disk: 1 (Size: 116.5 GB) (Disk ID: CC4AE37A)
Partition 1: (Not Active) - (Size=116.5 GB) - (Type=0C)
==================== Ende von Addition.txt ============================
Max Geändert von Belaros (22.01.2016 um 18:07 Uhr) |
|
22.01.2016, 18:37
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Hi,
__________________und du bist das Sprachrohr für deinen Freund, der die Postings über seine Rechnerprobleme nicht selbst hier verfassen kann?   Die Logs sind aber nicht von deinem Rechner oder?  Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
22.01.2016, 18:43
| #3 |
| | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Die Logs sind vom befallenen Rechner.
__________________Und der Freund hat so viel Ahnung von PCs wie eine Kuh vom fliegen. Ich bin da halt immer die Ansprechstation. Auf dem PC ist nur die McAffee Software und die hat nichts gefunden. MfG |
|
22.01.2016, 18:44
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.01.2016, 12:46
| #5 |
| | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Habe ich gemacht. Hier das aktuelle Logfile FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:18-01-2016
durchgeführt von ***** (Administrator) auf HOMEOFFICE (23-01-2016 12:40:05)
Gestartet von C:\Users\*****\Desktop\Analyse PC
Geladene Profile: ***** (Verfügbare Profile: *****)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
() C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Mindspark) C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbarsvc.exe
(McAfee, Inc.) C:\Program Files\mcafee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] => "C:\PROGRA~2\RADIOR~2\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2014-06-06] (Realtek Semiconductor)
HKLM-x32\...\Run: [RadioRage EPM Support] => C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jmedint.exe [12824 2016-01-13] (Mindspark)
HKLM-x32\...\Run: [RadioRage Search Scope Monitor] => "C:\PROGRA~2\RADIOR~2\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LauncherC1765nf] => C:\Program Files (x86)\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM-x32\...\Run: [StatusAutoRunC1765nf] => C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3850216 2013-02-06] (Dell Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [36168 2013-05-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [18248 2013-05-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort14reminder] => "C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\14\Config\Ereg\Ereg.ini"
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [24952376 2015-12-22] (Dropbox, Inc.)
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.4726.0226] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.4726.0226"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5907.0716] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5907.0716"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5930.0814] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5930.0814"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\RunOnce: [Uninstall C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5951.0827] => C:\windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.5951.0827"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {50cf1d18-0370-11e4-825f-f0921ce1d5b1} - "F:\EasySuite.exe"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {547c5f6e-e7d8-11e3-8257-f0921ce1d5b1} - "F:\EasySuite.exe"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\MountPoints2: {547c653b-e7d8-11e3-8257-f0921ce1d5b1} - "F:\EasySuite.exe"
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => Keine Datei
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => Keine Datei
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-22] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Keine Datei
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-16]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyServer: [S-1-5-21-3515514006-1524455674-3752257747-1001] => 192.168.144.254:8080
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{5DA05922-7AF7-4783-A17E-1BAD0AB0AE94}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DA12B626-F5E6-41B2-B8A9-148FAA741D80}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.tb.ask.com/index.jhtml?n=77FD35DB&p2=^ZX^xdm448^LADEDE^de&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&si=CLii6Zz25b4CFSJqOgodDGsA6w
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK14/4
SearchScopes: HKLM -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^ZX^xdm448^LADEDE^de&si=CLii6Zz25b4CFSJqOgodDGsA6w&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&ind=2014060614&n=780c2046&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> DefaultScope {3D03DBCF-5477-4166-A890-BA05DA3F4030} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3323878&octid=EB_ORIGINAL_CTID&ISID=MBC844308-C977-4866-BF7B-0533644E97A3&SearchSource=58&CUI=&UM=5&UP=SP9F3586F2-FEA1-402C-AD4A-A5DF44A9053D&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^ZX^xdm448^LADEDE^de&si=CLii6Zz25b4CFSJqOgodDGsA6w&ptb=DBA59FBD-F6D7-434B-85BA-6FEF0B624426&ind=2014060614&n=780c2046&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {14C06940-625D-4E6F-BAC3-885493CBA384} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {3D03DBCF-5477-4166-A890-BA05DA3F4030} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {A5BE9AC0-9890-4C14-A001-C2319FD33FDA} URL = hxxps://de.search.yahoo.com/search?fr=mcafee&type=C011DE739D20151102&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3515514006-1524455674-3752257747-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-12-16] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-01-20] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-12-02] (McAfee, Inc.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2015-12-03] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-12-03] (McAfee, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Homepage: hxxps://mail.google.com/mail/u/0/?tab=wm#inbox
FF Keyword.URL: hxxps://de.search.yahoo.com/search?fr=mcafee&type=B111DE739D20140704&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_286.dll [2016-01-20] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_286.dll [2016-01-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2014-12-08] (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-06-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-06] (Microsoft Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4j\bar\2.bin\NP4jStub.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\google-images.xml [2015-06-19]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\google-maps.xml [2015-06-19]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\McSiteAdvisor.xml [2016-01-23]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\startpage-ssl.xml [2014-06-07]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\searchplugins\youtube.xml [2015-11-13]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2015-04-01]
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-11-23]
FF Extension: WEB.DE MailCheck - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\extensions\mailcheck@web.de [2015-12-16]
FF Extension: Cliqz - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\Extensions\cliqz@cliqz.com.xpi [2016-01-21]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-12-16] [ist nicht signiert]
FF HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g2ahbbh6.default\extensions\cliqz@cliqz.com => nicht gefunden
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-12-02]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-12-02]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [Datei ist nicht signiert]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2787512 2015-12-22] (Microsoft Corporation)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-20] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-01-20] (Dropbox, Inc.)
R2 DLNBDB; C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [244712 2013-02-06] ()
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [157928 2015-12-02] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [863448 2015-12-03] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe [1694152 2015-12-02] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [679120 2015-10-20] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [233680 2015-09-21] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [378848 2015-10-21] (McAfee, Inc.)
R3 mfevtp; C:\windows\system32\mfevtps.exe [256840 2015-09-21] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [Datei ist nicht signiert]
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-05-29] (Nuance Communications, Inc.)
R2 RadioRage_4jService; C:\Program Files (x86)\RadioRage_4j\bar\2.bin\4jbarsvc.exe [90648 2016-01-13] (Mindspark)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2014-06-06] (Realtek Semiconductor)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [80760 2015-09-23] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [415976 2015-09-23] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351120 2015-09-23] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [82072 2015-09-23] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [497888 2015-09-23] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [841944 2015-09-23] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [537192 2015-10-06] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2015-10-06] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [37960 2015-12-02] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [244544 2015-09-23] (McAfee, Inc.)
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 DNIMp50a64; System32\Drivers\DNIMp50a64.sys [X]
S3 DNISp50a64; System32\Drivers\DNISp50a64.sys [X]
S3 SPPD; \??\C:\windows\system32\drivers\SPPD.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-01-23 12:27 - 2016-01-23 12:27 - 00001291 _____ C:\Users\*****\Desktop\Revo Uninstaller.lnk
2016-01-23 12:27 - 2016-01-23 12:27 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2016-01-23 12:27 - 2016-01-23 12:27 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2016-01-23 12:26 - 2016-01-23 12:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\*****\Downloads\revosetup95.exe
2016-01-23 10:04 - 2016-01-23 10:04 - 00003846 _____ C:\windows\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-01-22 18:08 - 2016-01-23 12:40 - 00000000 ____D C:\Users\*****\Desktop\Analyse PC
2016-01-22 17:53 - 2016-01-23 12:40 - 00000000 ____D C:\FRST
2016-01-21 15:25 - 2016-01-21 15:25 - 00151016 _____ C:\Users\*****\Desktop\INNOTEC wav-e_Korrektur.pdf
2016-01-20 12:36 - 2016-01-20 12:36 - 55976344 _____ (Dropbox, Inc.) C:\Users\*****\Downloads\Dropbox 3.12.6 Offline Installer.exe
2016-01-20 11:50 - 2016-01-20 11:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-01-20 11:49 - 2016-01-20 11:49 - 00690072 _____ (Dropbox, Inc.) C:\Users\*****\Downloads\DropboxInstaller(2).exe
2016-01-20 11:45 - 2016-01-20 11:45 - 00690072 _____ (Dropbox, Inc.) C:\Users\*****\Downloads\DropboxInstaller(1).exe
2016-01-20 11:32 - 2016-01-23 12:37 - 00001250 _____ C:\windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-01-20 11:32 - 2016-01-23 12:37 - 00001246 _____ C:\windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-01-20 11:32 - 2016-01-20 11:50 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-01-20 11:32 - 2016-01-20 11:32 - 00004222 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineUA
2016-01-20 11:32 - 2016-01-20 11:32 - 00003986 _____ C:\windows\System32\Tasks\DropboxUpdateTaskMachineCore
2016-01-20 11:31 - 2016-01-20 11:31 - 00690072 _____ (Dropbox, Inc.) C:\Users\*****\Downloads\DropboxInstaller.exe
2016-01-20 11:27 - 2016-01-20 11:27 - 00063877 _____ C:\Users\*****\Downloads\16-0002575018_3176947_4152c9fd5456d30339e0d0110a66fb9a.pdf
2016-01-20 11:18 - 2016-01-20 11:18 - 00063942 _____ C:\Users\*****\Downloads\16-0002574928_3176846_6e5f765356fa54f0d27ac5d62343beb8.pdf
2016-01-13 14:36 - 2015-12-11 05:38 - 25837568 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-01-13 14:36 - 2015-12-11 04:55 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-01-13 14:36 - 2015-12-11 03:43 - 04610560 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-01-13 14:35 - 2015-12-11 05:00 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-01-13 14:35 - 2015-12-11 04:50 - 20367360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-01-13 14:35 - 2015-12-11 04:45 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-01-13 14:35 - 2015-12-11 04:21 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-01-13 14:35 - 2015-12-11 04:18 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-01-13 14:35 - 2015-12-11 04:09 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2016-01-13 14:35 - 2015-12-11 04:09 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-01-13 14:35 - 2015-12-11 04:03 - 14456832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-01-13 14:35 - 2015-12-11 03:59 - 00798208 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-01-13 14:35 - 2015-12-11 03:43 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2016-01-13 14:35 - 2015-12-11 03:38 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-01-13 14:35 - 2015-12-11 03:37 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-01-13 14:35 - 2015-12-11 03:35 - 12856320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-01-13 14:35 - 2015-12-11 03:26 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-01-13 14:35 - 2015-12-11 03:14 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-01-13 14:35 - 2015-12-11 03:12 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-01-13 14:35 - 2015-12-11 03:08 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-01-13 14:35 - 2015-12-11 03:07 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-01-13 14:34 - 2015-12-30 20:32 - 07453016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2016-01-13 14:34 - 2015-12-30 20:32 - 01735000 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2016-01-13 14:34 - 2015-12-30 20:32 - 01499912 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2016-01-13 14:34 - 2015-12-10 01:40 - 00033456 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-01-13 14:34 - 2015-12-08 20:08 - 00685432 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2016-01-13 14:34 - 2015-12-08 20:07 - 00507176 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2016-01-13 14:34 - 2015-12-07 11:56 - 01380600 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 02745184 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02528784 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02450240 _____ (Microsoft Corporation) C:\windows\system32\WMVENCOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02447136 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVENCOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 02334104 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 02324744 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01877504 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2adec.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01798480 ____C (Microsoft Corporation) C:\windows\system32\WMALFXGFXDSP.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01484888 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2adec.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01288128 _____ (Microsoft Corporation) C:\windows\system32\mfnetsrc.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01210200 _____ (Microsoft Corporation) C:\windows\system32\WMADMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 01150232 _____ (Microsoft Corporation) C:\windows\system32\WMADMOE.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 01115640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfnetsrc.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 01037680 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00914672 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOE.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00850680 _____ (Microsoft Corporation) C:\windows\system32\mfnetcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00735496 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00700360 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfnetcore.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00629600 _____ (Microsoft Corporation) C:\windows\system32\MP4SDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00584656 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00557856 _____ (Microsoft Corporation) C:\windows\system32\WMVSDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00498472 _____ (Microsoft Corporation) C:\windows\system32\mfsvr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00492736 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00463776 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP4SDECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00399776 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfsvr.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00299080 _____ (Microsoft Corporation) C:\windows\system32\VIDRESZR.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00275312 _____ (Microsoft Corporation) C:\windows\SysWOW64\MPG4DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00274280 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP43DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00250520 _____ (Microsoft Corporation) C:\windows\system32\MPG4DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00248432 _____ (Microsoft Corporation) C:\windows\system32\MP43DECD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00246856 _____ (Microsoft Corporation) C:\windows\system32\RESAMPLEDMO.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00244296 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00229272 _____ (Microsoft Corporation) C:\windows\SysWOW64\RESAMPLEDMO.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00203016 _____ (Microsoft Corporation) C:\windows\system32\COLORCNV.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00184912 _____ (Microsoft Corporation) C:\windows\SysWOW64\COLORCNV.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00183856 _____ (Microsoft Corporation) C:\windows\SysWOW64\VIDRESZR.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00116720 _____ (Microsoft Corporation) C:\windows\system32\MP3DMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00110544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00099136 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP3DMOD.DLL
2016-01-13 14:34 - 2015-12-05 06:58 - 00090904 _____ (Microsoft Corporation) C:\windows\system32\devenum.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00090392 _____ (Microsoft Corporation) C:\windows\system32\mfvdsp.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00081032 _____ (Microsoft Corporation) C:\windows\SysWOW64\devenum.dll
2016-01-13 14:34 - 2015-12-05 06:58 - 00076936 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfvdsp.dll
2016-01-13 14:34 - 2015-12-04 16:00 - 01097216 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00561952 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2016-01-13 14:34 - 2015-12-03 20:42 - 00397224 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00137968 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-01-13 14:34 - 2015-12-03 20:42 - 00106960 _____ (Microsoft Corporation) C:\windows\system32\ncryptsslp.dll
2016-01-13 14:34 - 2015-12-03 20:41 - 00177488 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-01-13 14:34 - 2015-12-03 19:52 - 00340872 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2016-01-13 14:34 - 2015-12-03 19:52 - 00120376 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-01-13 14:34 - 2015-12-03 19:52 - 00091416 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncryptsslp.dll
2016-01-13 14:34 - 2015-12-03 19:28 - 00401920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-01-13 14:34 - 2015-12-03 19:28 - 00202240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-01-13 14:34 - 2015-12-03 19:07 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2016-01-13 14:34 - 2015-12-03 19:07 - 00289792 _____ (Microsoft Corporation) C:\windows\system32\ksproxy.ax
2016-01-13 14:34 - 2015-12-03 19:05 - 00644608 _____ (Microsoft Corporation) C:\windows\system32\WMVXENCD.DLL
2016-01-13 14:34 - 2015-12-03 19:02 - 01664000 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOE.DLL
2016-01-13 14:34 - 2015-12-03 19:00 - 00451072 _____ (Microsoft Corporation) C:\windows\system32\WMVSENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:58 - 00378880 ____C (Microsoft Corporation) C:\windows\system32\SysFxUI.dll
2016-01-13 14:34 - 2015-12-03 18:51 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2016-01-13 14:34 - 2015-12-03 18:36 - 01697792 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2016-01-13 14:34 - 2015-12-03 18:30 - 00468480 _____ (Microsoft Corporation) C:\windows\system32\MFWMAAEC.DLL
2016-01-13 14:34 - 2015-12-03 18:28 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2016-01-13 14:34 - 2015-12-03 18:28 - 00245760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksproxy.ax
2016-01-13 14:34 - 2015-12-03 18:27 - 00736256 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVXENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:24 - 01411584 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOE.DLL
2016-01-13 14:34 - 2015-12-03 18:23 - 00402432 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSENCD.DLL
2016-01-13 14:34 - 2015-12-03 18:16 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2016-01-13 14:34 - 2015-12-03 18:13 - 01441280 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-01-13 14:34 - 2015-12-03 18:07 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-01-13 14:34 - 2015-12-03 18:06 - 01501184 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2016-01-13 14:34 - 2015-12-03 18:01 - 00743936 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFWMAAEC.DLL
2016-01-13 14:34 - 2015-12-03 17:45 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-01-13 14:34 - 2015-12-03 17:40 - 01010688 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOD.DLL
2016-01-13 14:34 - 2015-12-03 17:29 - 00887296 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOD.DLL
2016-01-13 14:34 - 2015-12-02 16:04 - 00670208 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2016-01-13 14:34 - 2015-12-02 16:01 - 00561664 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 01380864 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00792064 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00705024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2016-01-13 14:34 - 2015-11-17 22:07 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-01-08 11:18 - 2016-01-08 11:18 - 00000000 ____D C:\Users\*****\AppData\LocalLow\Adobe
2016-01-08 11:18 - 2016-01-08 11:18 - 00000000 ____D C:\Users\*****\AppData\Local\CEF
2016-01-07 17:21 - 2016-01-13 08:16 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2016-01-07 17:20 - 2016-01-13 08:15 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-01-07 17:20 - 2016-01-07 17:20 - 00002074 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-01-07 17:18 - 2016-01-08 11:19 - 00000000 ____D C:\ProgramData\Adobe
2016-01-07 17:18 - 2016-01-07 17:18 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-01-06 23:13 - 2016-01-16 15:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-04 09:26 - 2016-01-04 09:27 - 00017577 _____ C:\Users\*****\Downloads\DRP56524684.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-01-23 12:37 - 2015-01-06 17:01 - 00001136 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-23 12:37 - 2014-09-27 15:19 - 00000000 ___DO C:\Users\*****\OneDrive
2016-01-23 12:37 - 2014-07-26 11:32 - 00000000 ___RD C:\Users\*****\Dropbox
2016-01-23 12:37 - 2014-07-26 11:20 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2016-01-23 12:37 - 2013-08-22 14:36 - 00000000 ____D C:\windows\Inf
2016-01-23 12:36 - 2015-08-28 17:10 - 00000386 _____ C:\windows\Tasks\HPCeeScheduleFor*****.job
2016-01-23 12:36 - 2013-08-22 15:45 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-01-23 12:36 - 2013-08-22 14:25 - 00524288 ___SH C:\windows\system32\config\BBI
2016-01-23 12:32 - 2014-05-29 13:57 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3515514006-1524455674-3752257747-1001
2016-01-23 12:28 - 2015-01-06 17:01 - 00001140 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-23 12:20 - 2014-07-04 09:39 - 00000000 ____D C:\Users\*****\Documents\Outlook-Dateien
2016-01-23 11:54 - 2014-07-11 07:06 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-01-22 18:54 - 2015-08-28 17:10 - 00003216 _____ C:\windows\System32\Tasks\HPCeeScheduleFor*****
2016-01-22 18:06 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2016-01-22 17:14 - 2014-02-11 06:12 - 00065536 _____ C:\windows\system32\spu_storage.bin
2016-01-22 08:18 - 2015-05-03 09:56 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2016-01-22 08:18 - 2015-05-03 09:56 - 00000000 ____D C:\ProgramData\Skype
2016-01-21 13:28 - 2014-05-29 13:52 - 00000000 ____D C:\Users\*****\AppData\Local\Packages
2016-01-21 12:59 - 2013-08-22 16:36 - 00000000 ____D C:\windows\system32\FxsTmp
2016-01-20 13:35 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-01-20 13:33 - 2014-06-07 10:51 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-01-20 12:27 - 2015-06-17 09:50 - 00000000 ____D C:\Users\*****\AppData\Local\Dropbox
2016-01-20 11:43 - 2014-05-29 13:52 - 00000000 ____D C:\Users\*****
2016-01-20 11:42 - 2014-07-11 07:06 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-01-20 11:39 - 2014-05-29 13:52 - 00000000 ____D C:\Users\*****\AppData\Local\VirtualStore
2016-01-20 11:38 - 2014-07-26 11:32 - 00001253 _____ C:\Users\*****\Desktop\Dropbox.lnk
2016-01-18 19:36 - 2013-08-22 14:25 - 00262144 ___SH C:\windows\system32\config\ELAM
2016-01-18 04:55 - 2013-08-22 16:36 - 00000000 ____D C:\windows\rescache
2016-01-16 15:33 - 2014-02-11 07:07 - 02922240 _____ C:\windows\system32\perfh007.dat
2016-01-16 15:33 - 2014-02-11 07:07 - 00843936 _____ C:\windows\system32\perfc007.dat
2016-01-16 15:33 - 2013-08-24 22:38 - 00337716 _____ C:\windows\system32\PerfStringBackup.INI
2016-01-16 15:24 - 2014-06-07 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-16 15:19 - 2015-04-17 10:28 - 00000000 ____D C:\windows\system32\appraiser
2016-01-16 15:19 - 2015-03-14 08:31 - 00000000 ___SD C:\windows\system32\CompatTel
2016-01-16 15:17 - 2014-06-01 17:52 - 00000000 ____D C:\windows\system32\MRT
2016-01-16 15:09 - 2014-06-01 17:52 - 143671360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-01-15 22:51 - 2015-05-03 09:56 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-01-13 14:58 - 2013-08-22 16:20 - 00000000 ____D C:\windows\CbsTemp
2016-01-11 17:16 - 2015-06-09 09:22 - 00000000 ____D C:\Users\*****\AppData\Local\Microsoft Help
2016-01-08 11:18 - 2014-12-16 10:36 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2016-01-08 11:18 - 2014-05-29 13:52 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2016-01-07 17:24 - 2014-09-12 10:31 - 00000000 ____D C:\Users\*****\Buchhaltung & Steuer
2016-01-07 17:11 - 2014-10-03 12:29 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2016-01-07 17:06 - 2015-01-23 13:23 - 00000000 __SHD C:\Users\*****\AppData\LocalLow\EmieUserList
2016-01-07 17:06 - 2015-01-23 13:23 - 00000000 __SHD C:\Users\*****\AppData\LocalLow\EmieBrowserModeList
2016-01-07 17:06 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\*****\AppData\LocalLow\EmieSiteList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\*****\AppData\Local\EmieUserList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\*****\AppData\Local\EmieSiteList
2016-01-07 17:05 - 2015-01-23 13:22 - 00000000 __SHD C:\Users\*****\AppData\Local\EmieBrowserModeList
2016-01-07 10:38 - 2014-05-30 12:13 - 00000000 ____D C:\Users\*****\Documents\Nadja
2016-01-05 21:04 - 2015-04-17 10:35 - 00826872 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-01-05 21:04 - 2015-04-17 10:35 - 00176632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-30 08:09 - 2014-07-12 15:30 - 00000000 ____D C:\Users\*****\Documents\Benutzerdefinierte Office-Vorlagen
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-06-09 10:06 - 2015-06-09 10:06 - 0037064 _____ () C:\Users\*****\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
Einige Dateien in TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Extract.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-01-15 05:54
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:18-01-2016
durchgeführt von ***** (2016-01-23 12:41:34)
Gestartet von C:\Users\*****\Desktop\Analyse PC
Windows 8.1 (X64) (2014-05-29 12:52:03)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
***** (S-1-5-21-3515514006-1524455674-3752257747-1001 - Administrator - Enabled) => C:\Users\*****
Administrator (S-1-5-21-3515514006-1524455674-3752257747-500 - Administrator - Disabled)
Gast (S-1-5-21-3515514006-1524455674-3752257747-501 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Out of date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Out of date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.010.20056 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.286 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AMD Catalyst Install Manager (HKLM\...\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CalendarSyncPlus (HKLM-x32\...\{09626C13-BFCB-4BF6-B894-05432F8F9ECA}) (Version: 1.2.1 - Ankesh Dave & Akanksha Gaur)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
CLIQZ (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 1.0.0 - CLIQZ.com)
CSV-Import 4.2 (HKLM-x32\...\CSV-Import_is1) (Version: - tm)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell C1765 Color MFP (HKLM-x32\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (x32 Version: 1.039.0 - Dell Inc.) Hidden
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.12.6 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.77 - Dropbox, Inc.) Hidden
EasyCash&Tax 2.17 (HKLM-x32\...\EasyCash&Tax_is1) (Version: - tm)
EasyRide&Tax 2.4 (HKLM-x32\...\EasyRide&Tax_is1) (Version: - tm)
ECTPlugAnlagenverzeichnis 1.5 (HKLM-x32\...\ECTPlugAnlagenverzeichnis_is1) (Version: - wolfram)
ECTPlugJavaScriptJournal 1.05 (HKLM-x32\...\ECTPlugJavaScriptJournal_is1) (Version: - tm)
ECTPlugWolframsJournal 1.03 (HKLM-x32\...\ECTPlugWolframsJournal_is1) (Version: - wolfram)
Elster-Export 2.5 (HKLM-x32\...\Elster-Export Plugin für EasyCash&Tax_is1) (Version: - tm)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP Documentation (HKLM-x32\...\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7045.4591 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
McAfee Internet Security (HKLM-x32\...\MSC) (Version: 14.0.6136 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.266.3 - McAfee, Inc.)
McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 7.6.0.202 - McAfee, Inc.)
McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.207 - McAfee, Inc.)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4787.1002 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4787.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\OneDriveSetup.exe) (Version: 17.3.6281.1202 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\...\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 43.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 43.0.4 (x86 de)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.4.5848 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Nuance PaperPort 14 (HKLM-x32\...\{08BCE67B-6305-4D8A-B749-F381E7E3DDA2}) (Version: 14.5.0000 - Nuance Communications, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) Hidden
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 Create Module (HKLM-x32\...\{3D0D9604-0173-488D-9694-2638C44D7579}) (Version: 2.1.6.19758 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{D691E998-CF53-4F6C-AC20-E4284660E0E7}) (Version: 2.1.6.19758 - pdfforge GmbH)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.30175 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7090 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.109 - Skype Technologies S.A.)
SUCCESSCONTROL CRM (HKLM-x32\...\{D894B85B-136E-492A-A893-CAD5F8AEF1D4}) (Version: 4.2.0 - Steppat GmbH - D 55743 Idar-Oberstein)
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.1.1739 - 1&1 Mail & Media GmbH)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WN111v2 (x32 Version: 3.0.0.3 - NETGEAR) Hidden
ZusammenfassendeMeldung 1.1 (HKLM-x32\...\ZusammenfassendeMeldung_is1) (Version: - tm)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {016A6395-22B5-40B1-B183-5B0F7429F26C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)
Task: {02AA71AC-36DC-4407-8D2E-EFF4B3829DF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0942731C-272F-4B27-8B0C-A93CF1C3F0A8} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {16435DAD-69E9-40FD-AF87-382F9F8C1E70} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {271C63F0-37B1-4EC5-A7FB-998EC0E9FC08} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {2FDE4632-7E8F-40DA-87A3-74CE1CB52E35} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3515514006-1524455674-3752257747-1001 => C:\Users\*****\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2015-12-16] (Microsoft Corporation)
Task: {347F3D3E-92DF-448D-B4E7-1EB024E668E5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {36643155-C930-49DF-BC5D-71C598C6AE54} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-20] (Adobe Systems Incorporated)
Task: {3C0A963C-BC72-4E38-80BB-3FBB642F247F} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {5B97B846-EE62-452E-B772-FB7B8509BEB6} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)
Task: {67330A4E-4753-4E59-9FA0-70885A682597} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-01-20] (Microsoft Corporation)
Task: {7DE2467A-EF9B-4870-A9B0-DE93D3EF5CC8} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-01-20] (Dropbox, Inc.)
Task: {85A0DEF0-1C6F-4BC2-ABA5-66A73B157384} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {8A2B101B-FD01-4470-884D-4C2779C8F000} - System32\Tasks\HPCeeScheduleFor***** => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {8C9B6C78-0926-44A5-AC6D-C86667F63E09} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {8DBFB9C4-71AD-4689-81A2-662721EC6BA4} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {9E0132C0-FA07-46B9-BD7F-BFD6B47A4332} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\21.0\mcdatrep.exe [2015-08-04] (McAfee, Inc.)
Task: {A42700F9-F984-41DA-862A-BDA548A734CD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2015-11-30] (Hewlett-Packard)
Task: {B135047F-D998-40DA-B0DB-3675CA9A076B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {B2E03DCE-B0E5-4773-A02A-8F40C504DF95} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2016-01-16] (Microsoft Corporation)
Task: {B788F2E6-7CF7-40FD-A0EF-30976C58375A} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {CC1E1561-C026-43CA-8983-541CDF70A6C6} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-01-20] (Dropbox, Inc.)
Task: {D7E95B81-AE81-4634-BFFE-227DC206BB77} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {D93B9F13-F587-468C-8D5E-5B2045F6FDD3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-01-06] (HP Inc.)
Task: {F9FA8821-9729-4A47-8883-4A10A0352E11} - System32\Tasks\{08ADFC07-D33C-49B3-B4D3-DB9A6BC0A54F} => Firefox.exe hxxp://ui.skype.com/ui/0/7.17.0.105/de/abandoninstall?source=lightinstaller&page=tsInstall
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFor*****.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2013-09-05 12:22 - 2013-09-05 12:22 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-09-05 12:24 - 2013-09-05 12:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-09-05 12:24 - 2013-09-05 12:24 - 02540544 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-09-05 12:21 - 2013-09-05 12:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-09-05 12:36 - 2013-09-05 12:36 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-09-05 12:36 - 2013-09-05 12:36 - 01298832 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2014-10-31 12:33 - 2012-06-20 15:15 - 00032768 _____ () C:\windows\system32\spool\PRTPROCS\x64\dltfm1zPP.dll
2014-06-09 12:16 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-02-06 17:40 - 2013-02-06 17:40 - 00244712 _____ () C:\Program Files (x86)\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2014-10-31 12:10 - 2012-06-16 08:44 - 00046080 _____ () C:\windows\system32\dltsm1zwia.dll
2015-07-03 10:37 - 2015-07-03 10:37 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2013-09-05 12:31 - 2013-09-05 12:31 - 00064000 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2016-01-20 11:37 - 2015-12-21 20:42 - 00034768 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-01-20 11:50 - 2015-12-21 20:42 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00022848 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Random.OSRNG.winrandom.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00023352 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Util._counter.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00042296 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Cipher._AES.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-01-20 11:37 - 2015-12-21 20:42 - 00093640 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00018376 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-01-20 11:37 - 2015-12-22 01:22 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00692688 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00109520 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 01734984 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_python_x66cf7a7cx17a72769.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00021840 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-01-20 11:50 - 2015-12-21 20:42 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00114640 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00021320 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-01-20 11:50 - 2015-12-21 20:42 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-01-20 11:37 - 2015-12-21 20:42 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00117056 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00134608 _____ () C:\Program Files (x86)\Dropbox\Client\_elementtree.pyd
2016-01-20 11:50 - 2015-12-21 20:42 - 00134088 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-01-20 11:50 - 2015-12-21 20:42 - 00240584 _____ () C:\Program Files (x86)\Dropbox\Client\jpegtran.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00021304 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Util.strxor.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00084792 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-01-20 11:50 - 2015-12-22 01:22 - 01826608 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 03891504 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 01950000 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00519984 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00133936 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00225080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-01-20 11:37 - 2015-12-22 01:22 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00486704 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2016-01-20 11:50 - 2015-12-22 01:22 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-01-20 11:37 - 2015-12-21 20:42 - 00019920 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick.2\qtquick2plugin.dll
2016-01-20 11:37 - 2015-12-21 20:42 - 00786904 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Controls\qtquickcontrolsplugin.dll
2016-01-20 11:37 - 2015-12-21 20:42 - 00063448 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Layouts\qquicklayoutsplugin.dll
2016-01-20 11:37 - 2015-12-21 20:42 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Window.2\windowplugin.dll
2014-11-23 17:10 - 2014-11-23 17:10 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-02-11 06:35 - 2013-08-05 08:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-06 00:48 - 2013-08-06 00:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-11-23 17:08 - 2014-11-23 17:08 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2015-12-16 09:03 - 00000860 ____A C:\windows\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img1.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "RadioRage Home Page Guard 64 bit"
HKLM\...\StartupApproved\Run32: => "RadioRage Search Scope Monitor"
HKLM\...\StartupApproved\Run32: => "RadioRage EPM Support"
HKLM\...\StartupApproved\Run32: => "RadioRage_4j Browser Plugin Loader 64"
HKLM\...\StartupApproved\Run32: => "RadioRage_4j Browser Plugin Loader"
HKLM\...\StartupApproved\Run32: => "ISUSPM"
HKLM\...\StartupApproved\Run32: => "PPort14reminder"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "StatusAutoRunC1765nf"
HKLM\...\StartupApproved\Run32: => "LauncherC1765nf"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-3515514006-1524455674-3752257747-1001\...\StartupApproved\Run: => "Skype"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{33E24917-742B-4527-9DEE-C2BF7CB8D87D}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{80E99A19-ABAC-481A-B8D7-BACACF113E95}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{B4B5DC24-64C9-436F-AA56-D640F9DB0503}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{24BFB005-758A-48C3-B46B-E5AB73272C8E}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{F6C8599B-CDCB-4664-BD52-BA15F4D9E61A}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{01C790EB-14CB-4EC4-9FBA-D55B14DE1659}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{692CC1B8-C285-418F-92BE-A7A2E006D67F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{534BDA09-DE5E-4B43-A389-4F55B92D5EAC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7251BA1D-FC6A-4EB6-9D2F-A1098602A17C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{68237D3B-31DA-4706-8650-CB17D8F6A587}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5D9D469A-5DD5-4112-BCEB-D9EE4B85B21B}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{E555171E-5F28-40A0-A2FE-8FD033E0D7A2}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{6D63F0CC-FC57-4E3D-BC55-1761EED0FA0C}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{91226246-1044-4B2C-8AF4-7099FDE2F79C}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe
FirewallRules: [{4E9A8836-14F4-4397-9DF0-C82FB5830AAE}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{62E564B1-711A-49D7-BA53-552F8EC54223}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe
FirewallRules: [{BB66F94F-D934-4718-B788-2AB62E089909}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{16EE3E62-34EE-4265-A2D9-82E64DE46AD9}] => (Allow) LPort=2869
FirewallRules: [{D5322942-F6A2-45BB-85E3-E1E8423CF434}] => (Allow) LPort=1900
FirewallRules: [{9224B02A-1158-4E2C-8B01-2A4A0DC1F3A5}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{33147003-E8D8-463F-9073-EF532CD7D747}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{823C5044-4DC5-4F25-84E8-74019F12DF1B}] => (Allow) C:\Users\*****\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{FA7CAB91-8538-44E0-B1E4-3585FF51E700}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{B4F9D888-19C5-43D2-8A8D-890A4FF83910}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{E261EF4E-C179-440C-B350-0A7A0E6E934F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9FAA7775-E9FE-42D5-985C-FFE9A45B5D75}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F397FD54-03BF-4EF9-817F-A9159B820F60}] => (Allow) C:\Users\*****\AppData\Roaming\McAfee\Supportability\MVTLogs\ProductDetection64.exe
FirewallRules: [{739EB8A2-418E-41A0-B664-478C5984BE1A}] => (Allow) C:\Users\*****\AppData\Roaming\McAfee\Supportability\MVTLogs\ProductDetection64.exe
FirewallRules: [TCP Query User{2C5E7836-B533-499E-8690-C8251DC974C1}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{9AEA9E3D-0A88-48D7-A52C-FE372A4290F6}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{59B7BE52-01C5-4BEB-8955-B150BBCD449C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{93808A96-1832-44DA-BEE4-E3663D335D47}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{856697D2-CEF8-4F5C-AC23-FD807139EDC1}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{740F1841-B445-40BA-8ADC-904D339A9AFA}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
==================== Wiederherstellungspunkte =========================
04-01-2016 09:02:46 Geplanter Prüfpunkt
13-01-2016 08:11:36 Geplanter Prüfpunkt
13-01-2016 20:16:27 HPSF Restore Point
15-01-2016 07:46:48 McAfee Vulnerability Scanner
22-01-2016 08:15:09 McAfee Vulnerability Scanner
23-01-2016 12:28:39 Revo Uninstaller's restore point - RadioRage Internet Explorer Toolbar
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (01/23/2016 12:37:21 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (01/23/2016 12:37:21 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (01/23/2016 12:37:20 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (01/22/2016 06:53:23 PM) (Source: Microsoft Office 15) (EventID: 1000) (User: )
Description: Faulting application outlook.exe, version 15.0.4783.1000, stamp 56540b93, faulting module unknown, version 0.0.0.0, stamp 00000000, debug? 0, fault address 0x000009b0.
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3110
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3110
Error: (01/22/2016 02:07:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1547
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1547
Error: (01/22/2016 02:07:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Systemfehler:
=============
Error: (01/23/2016 12:36:51 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\windows\system32\Rtlihvs.dll
Fehlercode: 126
Error: (01/23/2016 02:02:49 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde mit folgendem Fehler beendet:
%%1
Error: (01/22/2016 05:14:50 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 9 Mal passiert.
Error: (01/22/2016 04:56:01 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.0.4 mit dem Computer mit der
Netzwerkhardwareadresse 48-5A-3F-6B-B4-47 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.
Error: (01/22/2016 04:53:59 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (01/22/2016 04:53:44 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:44 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:38 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:38 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/22/2016 04:53:35 PM) (Source: DCOM) (EventID: 10010) (User: HOMEOFFICE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
==================== Speicherinformationen ===========================
Prozessor: AMD A6-5200 APU with Radeon(TM) HD Graphics
Prozentuale Nutzung des RAM: 42%
Installierter physikalischer RAM: 3531.63 MB
Verfügbarer physikalischer RAM: 2032.77 MB
Summe virtueller Speicher: 5835.63 MB
Verfügbarer virtueller Speicher: 4296.84 MB
==================== Laufwerke ================================
Drive c: (Windows) (Fixed) (Total:470.73 GB) (Free:363.6 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (Recovery Image) (Fixed) (Total:9.49 GB) (Free:1.16 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: (Achim) (CDROM) (Total:0.49 GB) (Free:0 GB) UDF
Drive f: () (Removable) (Total:116.5 GB) (Free:104.35 GB) FAT32
Drive h: (Volume) (Fixed) (Total:449.8 GB) (Free:370.24 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: EC635F4D)
Partition: GPT.
========================================================
Disk: 1 (Size: 116.5 GB) (Disk ID: CC4AE37A)
Partition 1: (Not Active) - (Size=116.5 GB) - (Type=0C)
==================== Ende von Addition.txt ============================
|
|
23.01.2016, 13:03
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Ich würde mich auch von diesem McAfee Geraffel trennen. Hau es runter. Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ --> [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang |
|
05.02.2016, 20:43
| #7 |
| | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang Entschuldige bitte dass ich mich so lange nicht mehr gemeldet habe, aber ich hatte Klausuren und daher leider keine Zeit. So ich habe das Malware Anti-Rootkit laufen lassen und es hat nichts gefunden. Hier das Logfile: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.02.05.07
rootkit: v2016.01.20.01
Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.18161
*** *** :: HOMEOFFICE [administrator]
05.02.2016 20:19:03
mbar-log-2016-02-05 (20-19-03).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 352586
Time elapsed: 23 minute(s), 55 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
06.02.2016, 14:06
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang McAfee deinstalliert? Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu [Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang |
| anmelden, banking trojaner, check, datei, dnsapi.dll, ebanking, ergebnisse, freund, hallo zusammen, infiziert, inhalt, login, mailanhang, melde, melden, neue, nichts, nummern, office 365, onedrive, onlinebanking, passwort, phishing, phishingmail, rechner, rechtschreibfehler, router, seite, seltsame, tan, webadvisor, windows, windowsapps, zusammen |
![[Windows 8.1] Phishing Seite bei Onlinebanking nach seltsamem Mailanhang](iconimages/plagegeister-aller-art-deren-bekaempfung/windows-8-1-phishing-seite-onlinebanking-seltsamem-mailanhang_ltr.gif)
dann auf 
und dann auf 
. 
Linear-Darstellung
