Win 10 - Sparkasse wird geblockt - Avast zeigt URL:Mal an

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:27-02-2016
durchgeführt von Heribert (Administrator) auf KARL (01-03-2016 10:59:28)
Gestartet von C:\Users\Heribert\Downloads
Geladene Profile: Heribert (Verfügbare Profile: Heribert)
Platform: Windows 10 Home Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Edge)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe
(Intel(R) Corporation) C:\Program Files\Intel Corporation\Intel(R) Technology Access\LegacyCsLoaderService.exe
(Intel(R) Corporation) C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(TODO: <Company name>) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Pokki) C:\Users\Heribert\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\Utilman.exe
(Microsoft Corporation) C:\Windows\SysWOW64\gpupdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\grpconv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\grpconv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13650648 2013-08-21] (Realtek Semiconductor)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [402344 2015-12-19] ()
HKLM\...\Run: [HotKeysCmds] => "C:\Windows\system32\hkcmd.exe"
HKLM\...\Run: [Persistence] => "C:\Windows\system32\igfxpers.exe"
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46952 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [30568 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Allin1Convert_8h Browser Plugin Loader 64] => C:\PROGRA~2\ALLIN1~2\bar\1.bin\8hbrmon64.exe
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139768 2016-02-29] (AVAST Software)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [Icecream_Screen_Recorder_Prefetcher] => C:\Program Files (x86)\Icecream Screen Recorder\recorder.exe [2074112 2015-10-16] (Icecream)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [distributebc] => C:\Users\Heribert\AppData\Local\Temp\Distribute-reception\distribute-champion.exe [225280 2016-02-27] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [lutherbriefly] => C:\Users\Heribert\AppData\Local\Temp\Luther_bases\luther-chambers.exe [184320 2016-02-27] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [nec-desire] => C:\Users\Heribert\AppData\Local\Temp\Nec-bring\nec_attendance.exe [154112 2016-02-28] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [lenfuture] => C:\Users\Heribert\AppData\Local\Temp\Len_metal\len-cream.exe [175616 2016-02-28] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [knowkey] => C:\Users\Heribert\AppData\Local\Temp\Knowgrass\know-chair.exe [159232 2016-02-29] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [lenders_buffalo] => C:\Users\Heribert\AppData\Local\Temp\Lenders-campaigns\lenders_ideal.exe [139264 2016-03-01] () <===== ACHTUNG
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\Run: [diode-82] => C:\ProgramData\diode-99\diode-22.exe [493888 2016-03-01] (Roger Sondermann)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\RunOnce: [Uninstall C:\Users\Heribert\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Heribert\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\RunOnce: [Application Restart #1] => C:\Users\Heribert\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe [7874536 2016-02-15] (Pokki)
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\...\RunOnce: [calculus-16] => C:\Users\Heribert\AppData\Roaming\calculus-5\calculus-01.exe [986112 2016-03-01] (Fabio Martin)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-02-29] (AVAST Software)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-05] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-05] (IvoSoft)
Startup: C:\Users\Heribert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014-05-04]
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Heribert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vacuum-1.lnk [2016-03-01]
ShortcutTarget: vacuum-1.lnk -> C:\Users\Heribert\AppData\Roaming\vacuum-0\vacuum-5.exe (Don HO don.h@free.fr)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{851c1639-84a9-464f-a95c-7282616f255d}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE01&ocid=UE01DHP
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
HKU\S-1-5-21-2810097519-173548134-1090291591-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?pc=UE01&ocid=UE01DHP
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {75b4241f-171e-44a3-bf44-23613b6e3e03} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^AYY^xdm070^YYA^de&si=flvrunner&ptb=5D18FFB3-9C75-455A-BFB3-F16B44D6D2F9&ind=2014050407&n=780bf867&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2810097519-173548134-1090291591-1001 -> {75b4241f-171e-44a3-bf44-23613b6e3e03} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^AYY^xdm070^YYA^de&si=flvrunner&ptb=5D18FFB3-9C75-455A-BFB3-F16B44D6D2F9&ind=2014050407&n=780bf867&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-2810097519-173548134-1090291591-1001 -> {8589B754-6D5F-4946-A6FE-57D32E6E70E3} URL = hxxps://de.search.yahoo.com/search?fr=mcafee&type=A011DE662&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-2810097519-173548134-1090291591-1001 -> {95A7D792-A903-11E4-82AF-448A5B2CC70F} URL = hxxp://search.homepage-web.com/?src=omnibox&partner=acer&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2810097519-173548134-1090291591-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
SearchScopes: HKU\S-1-5-21-2810097519-173548134-1090291591-1001 -> {D999020A-7F9C-4B89-836C-3411A14C94C8} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-02-29] (AVAST Software)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-29] (AVAST Software)

FireFox:
========
FF ProfilePath: C:\Users\Heribert\AppData\Roaming\Mozilla\Firefox\Profiles\y298qjfq.default
FF Homepage: hxxp://homepage-web.com/?s=acer&m=start
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2016-01-18] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-01-18] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-19] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-19] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-07-12] ()
FF Plugin HKU\S-1-5-21-2810097519-173548134-1090291591-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-01-18] (Tracker Software Products (Canada) Ltd.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-29]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: Default -> hxxp://homepage-web.com/?s=acer&m=home
CHR StartupUrls: Default -> "hxxp://homepage-web.com/?s=acer&m=start"
CHR DefaultSearchURL: Default -> hxxps://secure.homepage-web.com/?src=omnibox&partner=acer&q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.homepage-web.com
CHR Profile: C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-08]
CHR Extension: (Google Drive) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Google-Suche) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-16]
CHR Extension: (Google Docs Offline) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-09]
CHR Extension: (Google Mail) - C:\Users\Heribert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-29]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-29] (AVAST Software)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53320 2014-11-13] (Just Develop It) <==== ACHTUNG
S3 Browser7Maintenance; C:\Program Files (x86)\Browser 7 Maintenance Service\maintenanceservice.exe [148280 2015-12-25] (Deutsche Telekom AG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [Datei ist nicht signiert]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe [2800896 2014-05-02] (Acer Incorporated)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [235008 2013-07-16] (TODO: <Company name>) [Datei ist nicht signiert]
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373160 2015-12-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-19] (Intel Corporation)
S3 Intel(R) TA SAM; C:\Program Files (x86)\Intel Corporation\Intel(R) Technology Access\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [19088 2015-08-12] (Intel Corporation)
R2 Intel(R) TechnologyAccessLegacyCSLoader; C:\Program Files\Intel Corporation\Intel(R) Technology Access\LegacyCsLoaderService.exe [157344 2015-12-03] (Intel(R) Corporation)
R2 Intel(R) TechnologyAccessService; C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe [486048 2015-12-03] (Intel(R) Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-11-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-19] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-04-03] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-04-03] (McAfee, Inc.)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4278112 2013-08-01] (Symantec Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-02-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-29] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1065720 2016-02-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-29] (AVAST Software)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0405000.009\ccSetx64.sys [150104 2013-07-30] (Symantec Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70592 2014-04-03] (McAfee, Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-19] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [177544 2014-04-03] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311856 2014-04-03] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69352 2014-04-03] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [522360 2014-04-03] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [784760 2014-04-03] (McAfee, Inc.)
R1 ndisrd; C:\Windows\system32\DRIVERS\ndisrfl.sys [50448 2015-07-28] (Intel Corporation)
R3 NetTap630; C:\Windows\system32\DRIVERS\nettap630.sys [76560 2015-07-29] (Intel Corporation)
R2 RtkIOAC60; C:\Windows\system32\DRIVERS\RtkIOAC60.sys [29912 2013-07-19] (Realtek semiconductor corp)
R3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [402960 2015-05-14] (Realsil Semiconductor Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S1 hblpqvdx; \??\C:\WINDOWS\system32\drivers\hblpqvdx.sys [X]
S1 juqshllu; \??\C:\WINDOWS\system32\drivers\juqshllu.sys [X]
S1 ldnqdaas; \??\C:\WINDOWS\system32\drivers\ldnqdaas.sys [X]
S0 mfewfpk; system32\drivers\mfewfpk.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-03-01 10:58 - 2016-03-01 10:58 - 00000000 ____D C:\ProgramData\diode-99
2016-03-01 09:47 - 2016-03-01 09:47 - 00083480 _____ C:\Users\Heribert\Downloads\Addition.txt
2016-03-01 09:46 - 2016-03-01 10:59 - 00022078 _____ C:\Users\Heribert\Downloads\FRST.txt
2016-03-01 09:46 - 2016-03-01 10:59 - 00000000 ____D C:\FRST
2016-03-01 09:45 - 2016-03-01 09:45 - 02371072 _____ (Farbar) C:\Users\Heribert\Downloads\FRST64.exe
2016-03-01 09:37 - 2016-03-01 09:37 - 00000000 ____D C:\Users\Heribert\AppData\Roaming\vacuum-0
2016-03-01 09:35 - 2016-03-01 09:38 - 00000000 ____D C:\AdwCleaner
2016-03-01 09:35 - 2016-03-01 09:35 - 00000000 ____D C:\ProgramData\evkit-3
2016-03-01 09:33 - 2016-03-01 09:33 - 00000000 ____D C:\Users\Heribert\AppData\Roaming\calculus-5
2016-02-29 20:26 - 2016-02-29 20:26 - 01518592 _____ C:\Users\Heribert\Downloads\AdwCleaner_5.037.exe
2016-02-29 16:12 - 2016-02-29 20:00 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-02-29 16:12 - 2016-02-29 16:12 - 00001175 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-02-29 16:12 - 2016-02-29 16:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2016-02-29 16:12 - 2016-02-29 16:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-29 16:12 - 2016-02-29 16:12 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2016-02-29 16:12 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-02-29 16:12 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-02-29 16:12 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-02-29 16:11 - 2016-02-29 16:12 - 22908888 _____ (Malwarebytes ) C:\Users\Heribert\Downloads\mbam-setup-org-2.2.0.1024.exe
2016-02-29 13:20 - 2016-02-29 13:20 - 00004006 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-02-29 13:20 - 2016-02-29 13:20 - 00001943 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2016-02-29 13:20 - 2016-02-29 13:20 - 00001931 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-02-29 13:20 - 2016-02-29 13:20 - 00000000 ____D C:\Users\Heribert\AppData\Roaming\AVAST Software
2016-02-29 13:19 - 2016-02-29 13:20 - 00463744 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys
2016-02-29 13:19 - 2016-02-29 13:20 - 00287016 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswvmm.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 01065720 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00398152 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2016-02-29 13:19 - 2016-02-29 13:19 - 00165344 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00107792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00052184 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2016-02-29 13:19 - 2016-02-29 13:19 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2016-02-29 13:19 - 2016-02-29 13:19 - 00000000 ____D C:\Program Files\AVAST Software
2016-02-29 13:17 - 2016-02-29 13:17 - 00000000 ____D C:\ProgramData\AVAST Software
2016-02-29 13:11 - 2016-02-29 13:17 - 201900432 _____ (AVAST Software) C:\Users\Heribert\Downloads\avast_free2253_antivirus_setup.exe
2016-02-29 10:50 - 2016-02-29 11:35 - 00000638 _____ C:\WINDOWS\Tasks\TrackerAutoUpdate.job
2016-02-29 10:50 - 2016-02-29 10:50 - 00003200 _____ C:\WINDOWS\System32\Tasks\TrackerAutoUpdate
2016-02-29 10:50 - 2016-02-29 10:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
2016-02-29 10:50 - 2016-02-29 10:50 - 00000000 ____D C:\Program Files\Tracker Software
2016-02-29 10:48 - 2016-02-29 10:49 - 17765360 _____ (Tracker Software Products Ltd ) C:\Users\Heribert\Downloads\PDFXVwer3161.exe
2016-02-28 06:45 - 2016-02-29 12:48 - 00000000 ____D C:\Users\Heribert\Downloads\gtavvids2
2016-02-27 16:56 - 2016-02-27 16:56 - 00149187 _____ C:\Users\Heribert\Downloads\2016_03rechnung_4767967152.pdf
2016-02-25 16:41 - 2016-02-25 16:41 - 00065309 _____ C:\Users\Heribert\Downloads\MIR_1608.pdf
2016-02-24 11:00 - 2016-02-24 11:00 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2016-02-24 09:39 - 2016-02-24 11:00 - 00000000 ____D C:\ProgramData\adl
2016-02-24 09:36 - 2016-02-24 09:36 - 00495337 _____ C:\Users\Heribert\Downloads\05_BH0000540V002.pdf
2016-02-24 09:29 - 2016-02-24 09:29 - 00562523 _____ C:\Users\Heribert\Downloads\BH0000340V003.pdf
2016-02-24 09:29 - 2016-02-24 09:29 - 00517949 _____ C:\Users\Heribert\Downloads\BH0000440V001.pdf
2016-02-23 09:10 - 2016-02-23 09:10 - 00010320 _____ C:\Users\Heribert\Downloads\Pressetext zur Eröffnung.pdf
2016-02-22 07:49 - 2016-02-22 07:49 - 00082651 _____ C:\Users\Heribert\Downloads\MIR_1606.pdf
2016-02-22 07:43 - 2016-02-22 07:43 - 00038431 _____ C:\Users\Heribert\Downloads\16-02-18 BA-Planung.pdf
2016-02-22 07:41 - 2016-02-22 07:41 - 00071560 _____ C:\Users\Heribert\Downloads\MIR_1607.pdf
2016-02-15 22:20 - 2016-02-15 22:20 - 07012241 _____ C:\Users\Heribert\Downloads\Apache_OpenOffice_4.1.2_Win_x86_install_de (1).exe.4swysyd.partial
2016-02-15 20:55 - 2016-02-15 20:55 - 02169154 _____ C:\Users\Heribert\Documents\Unfallanzeige.pdf
2016-02-15 20:51 - 2016-02-15 20:52 - 02092491 _____ C:\Users\Heribert\Documents\BL0606320V001a.pdf
2016-02-15 20:29 - 2016-02-15 20:29 - 00096802 _____ C:\Users\Heribert\Documents\BL0606320V001.pdf
2016-02-10 11:22 - 2016-01-27 06:56 - 21124344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-02-10 11:22 - 2016-01-27 06:55 - 05242496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2016-02-10 11:22 - 2016-01-27 06:37 - 01998176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-02-10 11:22 - 2016-01-27 06:10 - 22394368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-02-10 11:22 - 2016-01-27 06:05 - 19339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-02-10 11:22 - 2016-01-27 06:05 - 18678272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-02-10 11:22 - 2016-01-27 06:04 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-02-10 11:22 - 2016-01-27 05:58 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-02-10 11:22 - 2016-01-27 05:55 - 12125696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-02-10 11:22 - 2016-01-27 05:54 - 24603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-02-10 11:22 - 2016-01-27 05:48 - 13382656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-02-10 11:22 - 2016-01-27 05:41 - 03592704 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-02-10 11:21 - 2016-01-29 07:57 - 04502352 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-02-10 11:21 - 2016-01-29 07:33 - 04064320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-02-10 11:21 - 2016-01-27 07:15 - 01557776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-02-10 11:21 - 2016-01-27 07:15 - 01542816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-02-10 11:21 - 2016-01-27 07:01 - 07476064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-02-10 11:21 - 2016-01-27 07:01 - 01997328 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-02-10 11:21 - 2016-01-27 07:01 - 01819720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-02-10 11:21 - 2016-01-27 06:59 - 00304752 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2016-02-10 11:21 - 2016-01-27 06:57 - 02919320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-02-10 11:21 - 2016-01-27 06:57 - 01824264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2016-02-10 11:21 - 2016-01-27 06:57 - 00820704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2016-02-10 11:21 - 2016-01-27 06:55 - 00081112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpenWith.exe
2016-02-10 11:21 - 2016-01-27 06:54 - 00295264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-02-10 11:21 - 2016-01-27 06:46 - 02606824 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2016-02-10 11:21 - 2016-01-27 06:46 - 01270072 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2016-02-10 11:21 - 2016-01-27 06:45 - 22564328 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-02-10 11:21 - 2016-01-27 06:45 - 06605544 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2016-02-10 11:21 - 2016-01-27 06:44 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-02-10 11:21 - 2016-01-27 06:44 - 00085320 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpenWith.exe
2016-02-10 11:21 - 2016-01-27 06:43 - 00359776 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-02-10 11:21 - 2016-01-27 06:37 - 00576352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-02-10 11:21 - 2016-01-27 06:21 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-02-10 11:21 - 2016-01-27 06:15 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ztrace_maps.dll
2016-02-10 11:21 - 2016-01-27 06:13 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-02-10 11:21 - 2016-01-27 06:12 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2016-02-10 11:21 - 2016-01-27 06:11 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-02-10 11:21 - 2016-01-27 06:10 - 00099840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll
2016-02-10 11:21 - 2016-01-27 06:08 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-02-10 11:21 - 2016-01-27 06:08 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ztrace_maps.dll
2016-02-10 11:21 - 2016-01-27 06:07 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iassam.dll
2016-02-10 11:21 - 2016-01-27 06:05 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-02-10 11:21 - 2016-01-27 06:05 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2016-02-10 11:21 - 2016-01-27 06:04 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-02-10 11:21 - 2016-01-27 06:03 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll
2016-02-10 11:21 - 2016-01-27 06:02 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll
2016-02-10 11:21 - 2016-01-27 06:01 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-02-10 11:21 - 2016-01-27 05:59 - 00258048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iassam.dll
2016-02-10 11:21 - 2016-01-27 05:57 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-02-10 11:21 - 2016-01-27 05:55 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-02-10 11:21 - 2016-01-27 05:52 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-02-10 11:21 - 2016-01-27 05:50 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-02-10 11:21 - 2016-01-27 05:50 - 01504768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-02-10 11:21 - 2016-01-27 05:50 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2016-02-10 11:21 - 2016-01-27 05:49 - 05662208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-02-10 11:21 - 2016-01-27 05:44 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cfgbkend.dll
2016-02-10 11:21 - 2016-01-27 05:42 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-02-10 11:21 - 2016-01-27 05:39 - 02275328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-02-10 11:21 - 2016-01-27 05:38 - 07835648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-02-10 11:21 - 2016-01-27 05:38 - 01734656 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-02-10 11:21 - 2016-01-27 05:37 - 04894720 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-02-10 11:21 - 2016-01-27 05:36 - 02757120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-02-10 11:21 - 2016-01-27 05:32 - 01087488 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2016-02-10 11:21 - 2016-01-27 05:31 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\cfgbkend.dll
2016-02-09 05:53 - 2016-02-09 05:53 - 00000000 ____D C:\WINDOWS\System32\Tasks\Intel
2016-02-09 05:53 - 2016-02-09 05:53 - 00000000 ____D C:\ProgramData\Intel Telemetry
2016-02-08 10:20 - 2016-03-01 10:50 - 00000294 _____ C:\WINDOWS\Tasks\PC-Mechanic Maintenance.job
2016-02-08 10:20 - 2016-03-01 09:34 - 00000308 _____ C:\WINDOWS\Tasks\PC-Mechanic Startup.job
2016-02-08 10:20 - 2016-02-08 10:20 - 00003342 _____ C:\WINDOWS\System32\Tasks\PC-Mechanic Maintenance
2016-02-08 10:20 - 2016-02-08 10:20 - 00002716 _____ C:\WINDOWS\System32\Tasks\PC-Mechanic Startup
2016-02-08 10:20 - 2016-02-08 10:20 - 00001242 _____ C:\Users\Public\Desktop\PC Mechanic.lnk
2016-02-08 10:20 - 2016-02-08 10:20 - 00000000 ____D C:\Users\Heribert\AppData\Roaming\Uniblue
2016-02-08 10:20 - 2016-02-08 10:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2016-02-08 10:20 - 2016-02-08 10:20 - 00000000 ____D C:\Program Files (x86)\Uniblue
2016-02-04 23:51 - 2016-02-04 23:51 - 00057669 _____ C:\Users\Heribert\Downloads\MIR_1605.pdf
2016-02-01 23:19 - 2016-02-01 23:19 - 00048718 _____ C:\Users\Heribert\Downloads\Gemeindeversammlung vom 26.1.16.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-03-01 10:30 - 2014-04-11 19:11 - 00001128 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf55b17de452ec.job
2016-03-01 09:34 - 2014-04-07 20:38 - 00000000 ____D C:\Users\Heribert\AppData\Local\SweetLabs App Platform
2016-03-01 09:33 - 2014-04-11 19:05 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-01 09:32 - 2015-12-19 20:58 - 00000000 __SHD C:\Users\Heribert\IntelGraphicsProfiles
2016-03-01 09:32 - 2015-12-19 09:59 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-03-01 05:53 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-02-29 19:56 - 2015-12-19 10:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-02-29 17:38 - 2015-10-30 07:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-02-29 15:32 - 2015-12-31 13:31 - 00000000 ____D C:\Users\Heribert\AppData\Local\Mozilla
2016-02-29 13:02 - 2015-10-11 17:38 - 00000000 ____D C:\Users\Heribert\AppData\Local\JDownloader v2.0
2016-02-29 07:11 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-02-24 11:00 - 2015-10-30 08:21 - 00000000 ____D C:\WINDOWS\INF
2016-02-19 22:31 - 2014-04-11 19:08 - 00002268 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-19 22:31 - 2014-04-11 19:08 - 00002256 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-19 17:16 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\rescache
2016-02-17 15:21 - 2015-10-30 22:08 - 00003380 _____ C:\WINDOWS\System32\Tasks\SweetLabs App Platform
2016-02-15 21:14 - 2015-12-19 10:15 - 02158090 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-02-15 21:14 - 2015-10-30 19:35 - 01041232 _____ C:\WINDOWS\system32\perfh007.dat
2016-02-15 21:14 - 2015-10-30 19:35 - 00244172 _____ C:\WINDOWS\system32\perfc007.dat
2016-02-15 20:27 - 2014-04-11 16:29 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-02-15 07:13 - 2014-04-11 16:29 - 146614896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-02-13 09:33 - 2014-04-07 20:31 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-02-12 05:41 - 2015-10-30 19:44 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-11 10:08 - 2015-10-30 08:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-02-09 05:53 - 2015-12-19 09:58 - 00000000 ____D C:\Program Files\Intel
2016-02-09 05:53 - 2015-09-20 12:27 - 00003886 _____ C:\WINDOWS\System32\Tasks\IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d
2016-02-09 05:53 - 2015-09-20 12:27 - 00003652 _____ C:\WINDOWS\System32\Tasks\IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d-Logon
2016-02-09 05:53 - 2015-02-22 13:00 - 00000000 ____D C:\ProgramData\Package Cache
2016-02-04 05:25 - 2014-04-11 19:11 - 00004216 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1cf55b17de452ec
2016-02-04 05:25 - 2014-04-11 19:05 - 00003954 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-02-03 20:01 - 2015-10-30 08:26 - 00828920 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-02-03 20:01 - 2015-10-30 08:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-01-01 14:45 - 2016-01-01 14:45 - 3429056 _____ (COMODO) C:\ProgramData\cis6245.exe
2015-12-19 09:59 - 2015-12-19 09:59 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\Heribert\AppData\Local\Temp\Distribute-reception\distribute-champion.exe
C:\Users\Heribert\AppData\Local\Temp\Luther_bases\luther-chambers.exe
C:\Users\Heribert\AppData\Local\Temp\Nec-bring\nec_attendance.exe
C:\Users\Heribert\AppData\Local\Temp\Len_metal\len-cream.exe
C:\Users\Heribert\AppData\Local\Temp\Knowgrass\know-chair.exe
C:\Users\Heribert\AppData\Local\Temp\Lenders-campaigns\lenders_ideal.exe
C:\ProgramData\cis6245.exe


Einige Dateien in TEMP:
====================
C:\Users\Heribert\AppData\Local\Temp\i4jdel0.exe
C:\Users\Heribert\AppData\Local\Temp\oct79CF.tmp.exe
C:\Users\Heribert\AppData\Local\Temp\proxy_vole808286248391921855.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-02-25 22:31

==================== Ende von FRST.txt ============================