Schritt 3: FRST.TXT

FRST Logfile:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
durchgeführt von Jolanda (Administrator) auf SCHEREREI (28-03-2016 23:20:04)
Gestartet von C:\Users\Jolanda\Desktop
Geladene Profile: Jolanda (Verfügbare Profile: Jolanda & Kinder)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\SYSTEM.SAV\util\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) Corporation) C:\Program Files\Intel Corporation\Intel(R) Technology Access\LegacyCsLoaderService.exe
(Intel(R) Corporation) C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TODO: <Company name>) C:\Windows\SysWOW64\SAiAdmin.exe
(TODO: <Company name>) C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe
(TODO: <Company name>) C:\Windows\SysWOW64\SAiDownloaderVista.exe
(SA International) C:\Windows\SysWOW64\SAiLicSvr.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
() C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-01-07] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2014-01-07] (IDT, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3957816 2014-02-07] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-02-07] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-02-07] (Hewlett-Packard)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1794904 2016-02-07] (NVIDIA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-12-17] (Apple Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [CamMonitor] => C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe [90112 2002-10-07] ()
HKLM-x32\...\Run: [Share-to-Web Namespace Daemon] => C:\Program Files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [69632 2002-04-17] (Hewlett-Packard)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [221728 2015-10-05] (Geek Software GmbH)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2012-09-25] ()
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: ["C:\Program Files (x86)\D-Link\D-ViewCam\MainConsole.EXE"] => C:\Program Files (x86)\D-Link\D-ViewCam\MainConsole.EXE [13692424 2013-10-18] (D-Link Corporation)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [14952 2016-03-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-08] (Apple Inc.)
HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)
HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.)
HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-08-16] (Apple Inc.)
HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-02-24]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Jolanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-12-31]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BDC44DF6-4558-4697-8848-A280FF4C8291}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D9B3877C-1BC5-49FB-AEA1-6689745055E2}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-03-15] (Microsoft Corporation)
BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-12-08] (AO Kaspersky Lab)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-03-15] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-02-25] (HP)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => Keine Datei
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2014-01-16] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-12-08] (AO Kaspersky Lab)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP)
Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-12-08] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-12-08] (AO Kaspersky Lab)
DPF: HKLM-x32 {2D20E99C-1FD7-48EC-9FDF-CF3555B273D4} hxxps://127.0.0.1:64566/VDControl.CAB?2,0,0,93
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Jolanda\AppData\Roaming\Mozilla\Firefox\Profiles\S7g2P7v1.default
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-12] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-10-29] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-17541869-1475532584-504080792-1001: www.mydlink.com/Uplayer -> C:\Users\Jolanda\AppData\Roaming\D-Link\mydlink services plugin\1.0.2.7\npUplayer.dll [2015-12-11] (D-Link Corporation)
FF Extension: Avira Browser Safety - C:\Users\Jolanda\AppData\Roaming\Mozilla\Firefox\Profiles\S7g2P7v1.default\Extensions\abs@avira.com.xpi [2016-03-24]
FF Extension: Avira SafeSearch Plus - C:\Users\Jolanda\AppData\Roaming\Mozilla\Firefox\Profiles\S7g2P7v1.default\Extensions\safesearchplus2@avira.com.xpi [2016-03-24]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2016-03-24]

Chrome: 
=======
CHR Profile: C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-09]
CHR Extension: (Google Docs) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Drive) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-04]
CHR Extension: (YouTube) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-07]
CHR Extension: (Google-Suche) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-04]
CHR Extension: (Google Tabellen) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-09]
CHR Extension: (Avira Browserschutz) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-03-24]
CHR Extension: (Google Docs Offline) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avira SafeSearch Plus) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipmkfpcnmccejididiaagpgchgjfajgp [2016-03-24]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-08]
CHR Extension: (Google Mail) - C:\Users\Jolanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-17]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S3 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-12-08] (Kaspersky Lab ZAO)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2016-03-19] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2828016 2016-02-09] (Microsoft Corporation)
R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [372736 2016-03-24] (Microsoft Corporation)
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [26680 2016-02-18] (Hewlett-Packard Company)
R2 iBtSiva; C:\system.sav\util\ibtsiva.exe [121288 2016-02-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-12] (Intel Corporation)
S3 Intel(R) TA SAM; C:\Program Files (x86)\Intel Corporation\Intel(R) Technology Access\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [18064 2015-04-18] ()
R2 Intel(R) Technology Access Legacy CS Loader; C:\Program Files\Intel Corporation\Intel(R) Technology Access\LegacyCsLoaderService.exe [144128 2015-07-31] (Intel(R) Corporation)
R2 Intel(R) TechnologyAccessService; C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe [481536 2015-07-31] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-10-14] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-09-25] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-12] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe [293128 2016-02-05] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; c:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-01-08] ()
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-02-07] (Softex Inc.) [Datei ist nicht signiert]
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2015-01-07] ()
R2 SAiAdmin; C:\Windows\SysWOW64\SAiAdmin.exe [65536 2007-08-27] (TODO: <Company name>) [Datei ist nicht signiert]
R2 SAiDownloader; C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\SAiDownloaderVistaUI.exe [417792 2007-09-11] (TODO: <Company name>) [Datei ist nicht signiert]
R2 SAiDownloaderVista; C:\Windows\SysWOW64\SAiDownloaderVista.exe [77824 2007-09-11] (TODO: <Company name>) [Datei ist nicht signiert]
R2 SAiLicSvr; C:\Windows\SysWOW64\SAiLicSvr.exe [86016 2014-11-11] (SA International) [Datei ist nicht signiert]
R2 SentinelKeysServer; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [328992 2008-07-11] (SafeNet, Inc.)
R2 SNMP; C:\Windows\System32\snmp.exe [50688 2016-03-24] (Microsoft Corporation)
R2 SNMP; C:\windows\SysWOW64\snmp.exe [46080 2016-03-24] (Microsoft Corporation)
R2 SpeedupService; C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe [24224 2016-03-23] (Avira Operations GmbH & Co. KG)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [340480 2014-01-07] (IDT, Inc.) [Datei ist nicht signiert]
S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ZeroConfigService; c:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2014-01-08] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [132608 2015-01-30] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
S3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [199112 2014-05-30] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70512 2015-06-27] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [77728 2016-03-24] (AO Kaspersky Lab)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [30328 2015-06-24] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [181640 2015-12-08] (AO Kaspersky Lab)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [227512 2015-12-08] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [927640 2016-03-24] (AO Kaspersky Lab)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [39608 2015-06-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [41656 2015-06-06] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-12-08] (AO Kaspersky Lab)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [87944 2015-12-08] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [102584 2015-06-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-03-28] (Malwarebytes)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-08-12] (Intel Corporation)
R1 ndisrd; C:\Windows\system32\DRIVERS\ndisrfl.sys [41688 2015-04-30] (Intel Corporation)
S3 NetTap630; C:\Windows\system32\DRIVERS\nettap630.sys [67800 2015-04-30] (Intel Corporation)
S3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3610592 2014-02-06] (Intel Corporation)
S3 SNTUSB64; C:\Windows\System32\drivers\SNTUSB64.SYS [58664 2008-07-11] (SafeNet, Inc.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-03-28 23:14 - 2016-03-28 23:15 - 00062538 _____ C:\Users\Jolanda\Desktop\SystemLook.txt
2016-03-28 23:13 - 2016-03-28 23:13 - 00165376 _____ C:\Users\Jolanda\Desktop\SystemLook_x64.exe
2016-03-28 23:04 - 2016-03-28 23:04 - 00009081 _____ C:\Users\Jolanda\Desktop\Fixlog- Schritt1.txt
2016-03-28 23:02 - 2016-03-28 23:02 - 00002907 _____ C:\Users\Jolanda\Desktop\fixlist.txt
2016-03-28 00:21 - 2016-03-28 23:20 - 00026048 _____ C:\Users\Jolanda\Desktop\FRST.txt
2016-03-28 00:21 - 2016-03-28 00:21 - 00040354 _____ C:\Users\Jolanda\Desktop\Addition.txt
2016-03-28 00:19 - 2016-03-28 00:19 - 00000623 _____ C:\Users\Jolanda\Desktop\JRT.txt
2016-03-28 00:18 - 2016-03-28 00:17 - 01610352 _____ (Malwarebytes) C:\Users\Jolanda\Desktop\JRT.exe
2016-03-28 00:15 - 2016-03-28 00:15 - 00002480 _____ C:\Users\Jolanda\Desktop\mbam_0.txt
2016-03-28 00:14 - 2016-03-28 00:14 - 00001187 _____ C:\Users\Jolanda\Desktop\mbam.txt
2016-03-28 00:06 - 2016-03-28 00:06 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-03-28 00:05 - 2016-03-28 00:05 - 22851472 _____ (Malwarebytes ) C:\Users\Jolanda\Desktop\mbam-setup-2.2.1.1043.exe
2016-03-27 23:53 - 2016-03-27 23:53 - 01538560 _____ C:\Users\Jolanda\Downloads\adwcleaner_5.106 (1).exe
2016-03-27 23:53 - 2016-03-27 23:53 - 01538560 _____ C:\Users\Jolanda\Desktop\adwcleaner_5.106.exe
2016-03-27 23:28 - 2016-03-27 23:39 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-03-27 23:27 - 2016-03-27 23:39 - 00000000 ____D C:\Users\Jolanda\Desktop\mbar
2016-03-27 23:27 - 2016-03-27 23:26 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Jolanda\Desktop\mbar-1.09.3.1001.exe
2016-03-27 13:19 - 2016-03-28 00:20 - 00000000 ____D C:\Users\Jolanda\Desktop\Pishing Kampf
2016-03-27 12:50 - 2016-03-27 12:53 - 00261584 _____ C:\TDSSKiller.3.1.0.9_27.03.2016_12.50.17_log.txt
2016-03-27 12:43 - 2016-03-28 23:20 - 00000000 ____D C:\FRST
2016-03-27 12:43 - 2016-03-27 12:43 - 02374144 _____ (Farbar) C:\Users\Jolanda\Desktop\FRST64.exe
2016-03-26 22:27 - 2016-03-27 23:59 - 00000000 ____D C:\AdwCleaner
2016-03-26 21:38 - 2016-03-28 23:18 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-26 21:37 - 2016-03-28 00:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2016-03-26 21:37 - 2016-03-28 00:06 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2016-03-26 21:37 - 2016-03-26 21:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-03-26 21:37 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2016-03-26 21:37 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2016-03-26 21:37 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2016-03-26 21:31 - 2016-03-26 21:31 - 00000000 ____D C:\windows\LastGood.Tmp
2016-03-24 21:38 - 2016-03-24 21:38 - 00003864 _____ C:\windows\System32\Tasks\Opera scheduled Autoupdate 1458848301
2016-03-24 21:38 - 2016-03-24 21:38 - 00001150 _____ C:\Users\Public\Desktop\Opera.lnk
2016-03-24 21:38 - 2016-03-24 21:38 - 00001150 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-03-24 21:38 - 2016-03-24 21:38 - 00000000 ____D C:\Users\Jolanda\AppData\Roaming\Opera Software
2016-03-24 21:38 - 2016-03-24 21:38 - 00000000 ____D C:\Users\Jolanda\AppData\Local\Opera Software
2016-03-24 21:38 - 2016-03-24 21:38 - 00000000 ____D C:\Program Files (x86)\Opera
2016-03-24 21:09 - 2016-03-24 21:09 - 00002465 _____ C:\Users\Jolanda\Desktop\Sicherer Zahlungsverkehr.lnk
2016-03-24 21:09 - 2016-03-24 21:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2016-03-24 21:09 - 2016-03-24 21:08 - 00002163 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2016-03-24 21:08 - 2016-03-28 23:05 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-03-24 21:08 - 2016-03-24 21:11 - 00927640 _____ (AO Kaspersky Lab) C:\windows\system32\Drivers\klif.sys
2016-03-24 21:08 - 2016-03-24 21:08 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2016-03-24 21:08 - 2015-12-08 22:34 - 00227512 _____ (AO Kaspersky Lab) C:\windows\system32\Drivers\klhk.sys
2016-03-24 21:08 - 2015-12-08 22:34 - 00181640 _____ (AO Kaspersky Lab) C:\windows\system32\Drivers\klflt.sys
2016-03-24 21:08 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\windows\system32\klfphc.dll
2016-03-24 15:34 - 2016-03-24 15:34 - 00000000 ____D C:\Users\Jolanda\AppData\Local\Avira
2016-03-24 15:25 - 2016-03-26 17:27 - 00000000 ____D C:\Users\Public\Speedup Sessions
2016-03-24 15:25 - 2016-03-24 21:06 - 00000000 ____D C:\Program Files (x86)\Avira
2016-03-24 15:25 - 2016-03-24 21:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-03-24 15:25 - 2016-03-24 21:04 - 00000000 ____D C:\ProgramData\Avira
2016-03-24 15:25 - 2016-03-24 15:25 - 00001166 _____ C:\Users\Public\Desktop\Avira System Speedup.lnk
2016-03-24 15:25 - 2016-03-24 15:25 - 00000000 ____D C:\Users\Jolanda\AppData\Roaming\Mozilla
2016-03-24 15:24 - 2016-03-24 15:24 - 04733568 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jolanda\Downloads\avira_de_av_56f3ea4370024__ws.exe
2016-03-24 14:42 - 2016-03-24 14:42 - 00001453 _____ C:\Users\Jolanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-24 14:40 - 2016-03-24 14:40 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IIS
2016-03-24 14:40 - 2016-03-24 14:40 - 00000000 ____D C:\windows\SysWOW64\BestPractices
2016-03-24 14:40 - 2016-03-24 14:40 - 00000000 ____D C:\windows\system32\BestPractices
2016-03-22 18:46 - 2016-03-22 18:47 - 01547688 _____ C:\Users\Kinder\Downloads\Clean Bandit - Rather Be feat. Jess Glynne (Robin Schulz Remix).mp3.eu38gk0.partial
2016-03-22 18:08 - 2016-03-22 18:08 - 00726033 _____ C:\Users\Jolanda\Documents\jerseyrapport.pdf
2016-03-19 13:49 - 2016-03-19 13:49 - 00000000 ____D C:\Program Files\Windows Identity Foundation
2016-03-15 21:33 - 2016-03-15 21:33 - 00000000 ____D C:\Users\Jolanda\AppData\Local\PDF24
2016-03-14 20:06 - 2016-03-14 20:06 - 00516897 _____ C:\Users\Jolanda\Documents\rapportverlauf.pdf
2016-03-14 16:48 - 2016-03-14 16:48 - 00180835 _____ C:\Users\Jolanda\Documents\schnittmuster blache natel.pdf
2016-03-14 16:35 - 2016-03-14 16:35 - 02098965 _____ C:\Users\Jolanda\Documents\Blache_Muttertag_2070x1070mm.pdf
2016-03-11 23:03 - 2016-03-11 23:03 - 00356673 _____ C:\Users\Jolanda\Documents\lebenslauf.pdf
2016-03-11 16:46 - 2016-03-11 16:46 - 00116661 _____ C:\Users\Jolanda\Downloads\325.211.1-1-1.de.pdf
2016-03-11 16:37 - 2016-03-11 16:37 - 01310132 _____ C:\Users\Jolanda\Downloads\Dienstleistungen des Haushalts.pdf
2016-03-10 08:58 - 2016-03-10 08:58 - 00000000 ___HD C:\$WINDOWS.~BT
2016-03-09 09:59 - 2016-02-20 17:45 - 01373184 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-03-09 09:59 - 2016-02-20 17:45 - 01168896 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-03-09 09:59 - 2016-02-20 17:45 - 00696832 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-03-09 09:59 - 2016-02-20 17:45 - 00689152 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-03-09 09:59 - 2016-02-20 17:45 - 00499200 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-03-09 09:59 - 2016-02-20 17:45 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-03-09 09:59 - 2016-02-12 21:14 - 00136904 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-03-09 09:59 - 2016-02-12 17:14 - 03708416 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-03-09 09:59 - 2016-02-12 16:55 - 00409088 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2016-03-09 09:59 - 2016-02-12 16:54 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-03-09 09:59 - 2016-02-12 16:54 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-03-09 09:59 - 2016-02-12 16:54 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-03-09 09:59 - 2016-02-12 16:51 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2016-03-09 09:59 - 2016-02-12 16:51 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2016-03-09 09:59 - 2016-02-12 16:51 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2016-03-09 09:59 - 2016-02-12 16:48 - 02244096 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-03-09 09:59 - 2016-02-12 16:47 - 00897024 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-03-09 09:59 - 2016-02-12 16:46 - 00726528 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2016-03-09 09:59 - 2016-02-11 16:21 - 00869576 _____ (Microsoft Corporation) C:\windows\system32\msvcr120_clr0400.dll
2016-03-09 09:59 - 2016-02-11 16:21 - 00678600 _____ (Microsoft Corporation) C:\windows\system32\msvcp120_clr0400.dll
2016-03-09 09:59 - 2016-02-11 16:20 - 00875720 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcr120_clr0400.dll
2016-03-09 09:59 - 2016-02-11 16:20 - 00536776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcp120_clr0400.dll
2016-03-09 09:59 - 2016-02-08 23:05 - 20352512 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-03-09 09:59 - 2016-02-08 22:39 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-03-09 09:59 - 2016-02-08 22:34 - 02280448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2016-03-09 09:59 - 2016-02-08 22:29 - 00099328 _____ (Microsoft Corporation) C:\windows\SysWOW64\hlink.dll
2016-03-09 09:59 - 2016-02-08 22:28 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-03-09 09:59 - 2016-02-08 22:10 - 04611072 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-03-09 09:59 - 2016-02-08 22:07 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2016-03-09 09:59 - 2016-02-08 22:05 - 25816576 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-03-09 09:59 - 2016-02-08 22:03 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2016-03-09 09:59 - 2016-02-08 22:02 - 13012480 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-03-09 09:59 - 2016-02-08 22:02 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-03-09 09:59 - 2016-02-08 22:01 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2016-03-09 09:59 - 2016-02-08 21:43 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-03-09 09:59 - 2016-02-08 21:39 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-03-09 09:59 - 2016-02-08 21:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-03-09 09:59 - 2016-02-08 20:27 - 02887680 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-03-09 09:59 - 2016-02-08 20:26 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-03-09 09:59 - 2016-02-08 20:16 - 06052352 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-03-09 09:59 - 2016-02-08 20:14 - 00108544 _____ (Microsoft Corporation) C:\windows\system32\hlink.dll
2016-03-09 09:59 - 2016-02-08 20:13 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-03-09 09:59 - 2016-02-08 19:51 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-03-09 09:59 - 2016-02-08 19:42 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2016-03-09 09:59 - 2016-02-08 19:37 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2016-03-09 09:59 - 2016-02-08 19:34 - 00798720 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-03-09 09:59 - 2016-02-08 19:33 - 14613504 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-03-09 09:59 - 2016-02-08 19:33 - 02123264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-03-09 09:59 - 2016-02-08 19:19 - 02597376 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-03-09 09:59 - 2016-02-08 19:15 - 02880000 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2016-03-09 09:59 - 2016-02-08 19:07 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-03-09 09:59 - 2016-02-08 18:55 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-03-09 09:59 - 2016-02-06 20:08 - 00031744 _____ (Microsoft Corporation) C:\windows\system32\seclogon.dll
2016-03-09 09:59 - 2016-02-06 18:58 - 00987648 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-03-09 09:59 - 2016-02-06 18:32 - 00801792 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2016-03-09 09:59 - 2016-02-05 21:07 - 00292696 _____ (Microsoft Corporation) C:\windows\system32\WMASF.DLL
2016-03-09 09:59 - 2016-02-05 21:07 - 00243032 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMASF.DLL
2016-03-09 09:59 - 2016-02-05 21:06 - 00046768 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-03-09 09:59 - 2016-02-05 17:03 - 15432704 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2016-03-09 09:59 - 2016-02-05 17:00 - 13318144 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2016-03-09 09:59 - 2016-02-05 16:59 - 07784960 _____ (Microsoft Corporation) C:\windows\system32\Windows.Data.Pdf.dll
2016-03-09 09:59 - 2016-02-05 16:55 - 05264384 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Data.Pdf.dll
2016-03-09 09:59 - 2016-02-05 16:48 - 07075840 _____ (Microsoft Corporation) C:\windows\system32\glcndFilter.dll
2016-03-09 09:59 - 2016-02-05 16:47 - 05268480 _____ (Microsoft Corporation) C:\windows\SysWOW64\glcndFilter.dll
2016-03-09 09:59 - 2016-02-04 20:18 - 04174336 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-03-09 09:59 - 2016-02-04 20:18 - 00358912 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2016-03-09 09:59 - 2016-02-04 20:12 - 00044032 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2016-03-09 09:59 - 2016-02-04 19:44 - 00301568 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2016-03-09 09:59 - 2016-02-04 19:39 - 00035840 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2016-03-09 09:59 - 2016-02-04 19:24 - 00603648 _____ (Microsoft Corporation) C:\windows\system32\mfds.dll
2016-03-09 09:59 - 2016-02-04 19:02 - 00483328 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfds.dll
2016-03-09 09:59 - 2016-02-03 22:37 - 01661576 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
2016-03-09 09:59 - 2016-02-03 22:36 - 01212248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
2016-03-09 09:59 - 2016-02-03 17:09 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\olepro32.dll
2016-03-09 09:59 - 2016-02-03 17:00 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\asycfilt.dll
2016-03-09 09:59 - 2016-02-03 17:00 - 00077824 _____ (Microsoft Corporation) C:\windows\SysWOW64\asycfilt.dll
2016-03-09 09:59 - 2016-01-31 21:16 - 00148832 ____C (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
2016-03-09 09:59 - 2016-01-24 20:19 - 00419160 ____C (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2016-03-09 09:59 - 2016-01-24 20:19 - 00378712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\storport.sys
2016-03-09 09:59 - 2016-01-24 20:19 - 00331608 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2016-03-09 09:59 - 2016-01-24 13:57 - 01335296 _____ (Microsoft Corporation) C:\windows\system32\mispace.dll
2016-03-09 09:59 - 2016-01-24 13:45 - 01063424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mispace.dll
2016-03-09 09:59 - 2016-01-10 18:41 - 01707008 _____ (Microsoft Corporation) C:\windows\system32\comsvcs.dll
2016-03-09 09:59 - 2016-01-10 18:31 - 01344512 _____ (Microsoft Corporation) C:\windows\SysWOW64\comsvcs.dll
2016-03-09 09:59 - 2016-01-09 03:49 - 00218448 _____ (Microsoft Corporation) C:\windows\system32\rsaenh.dll
2016-03-09 09:59 - 2016-01-09 03:49 - 00192120 _____ (Microsoft Corporation) C:\windows\SysWOW64\rsaenh.dll
2016-03-09 09:59 - 2016-01-09 03:38 - 00091992 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2016-03-09 09:59 - 2016-01-07 01:46 - 00148752 _____ (Microsoft Corporation) C:\windows\SysWOW64\wscapi.dll
2016-03-09 09:59 - 2016-01-07 01:45 - 00177712 _____ (Microsoft Corporation) C:\windows\system32\wscapi.dll
2016-03-09 09:59 - 2016-01-06 20:25 - 00416768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2016-03-09 09:59 - 2016-01-06 18:47 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\wscsvc.dll
2016-03-09 09:59 - 2016-01-05 17:00 - 00570880 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2016-03-09 09:59 - 2015-12-30 23:53 - 02017624 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2016-03-09 09:59 - 2015-12-30 22:49 - 00470360 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2016-03-09 09:59 - 2015-12-20 16:57 - 00839168 _____ (Microsoft Corporation) C:\windows\system32\netlogon.dll
2016-03-09 09:59 - 2015-12-20 16:56 - 00616960 _____ (Microsoft Corporation) C:\windows\system32\msra.exe
2016-03-09 09:59 - 2015-12-20 16:43 - 00696320 _____ (Microsoft Corporation) C:\windows\SysWOW64\netlogon.dll
2016-03-09 09:59 - 2015-11-19 16:33 - 00994760 _____ (Microsoft Corporation) C:\windows\system32\ucrtbase.dll
2016-03-09 09:59 - 2015-11-19 16:26 - 00922432 _____ (Microsoft Corporation) C:\windows\SysWOW64\ucrtbase.dll
2016-03-09 09:58 - 2016-01-15 18:56 - 02487296 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
2016-03-09 09:58 - 2016-01-15 18:45 - 01482240 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
2016-03-08 18:25 - 2016-03-08 18:25 - 01499560 _____ C:\Users\Kinder\Downloads\Galantis - Runaway (U & I) (Kaskade Remix).mp3.2b3dj63.partial
2016-03-06 19:22 - 2016-03-06 19:22 - 00000000 ____D C:\Users\Kinder\AppData\Local\CEF
2016-03-06 10:56 - 2016-03-06 10:59 - 00103702 _____ C:\Users\Jolanda\Documents\Blache Muttertag.pdf
2016-03-05 12:34 - 2016-03-05 12:34 - 02319360 _____ C:\Users\Kinder\Downloads\Louane - JOUR 1 (vidéo officielle).mp3.ax4m0zt.partial
2016-02-29 18:39 - 2016-02-29 18:39 - 01626297 _____ C:\Users\Jolanda\Documents\Bleche Schrauben 1.pdf
2016-02-28 17:34 - 2016-02-28 17:35 - 02060288 _____ C:\Users\Kinder\Downloads\Andreas Gabalier - Hulapalu (Offizielles Video).mp3.unguzy0.partial

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-03-28 23:19 - 2014-12-05 23:40 - 00000000 ____D C:\Users\Jolanda\AppData\Local\CrashDumps
2016-03-28 23:19 - 2014-11-07 09:53 - 00003178 _____ C:\windows\System32\Tasks\HPCeeScheduleForJolanda
2016-03-28 23:19 - 2014-11-07 09:53 - 00000360 _____ C:\windows\Tasks\HPCeeScheduleForJolanda.job
2016-03-28 23:19 - 2014-10-29 15:01 - 00000000 ___RD C:\Users\Jolanda\iCloudDrive
2016-03-28 23:18 - 2014-10-29 12:07 - 00000000 ___DO C:\Users\Jolanda\OneDrive
2016-03-28 23:18 - 2013-08-22 16:45 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-03-28 23:17 - 2013-08-22 15:25 - 00524288 ___SH C:\windows\system32\config\BBI
2016-03-28 18:48 - 2014-10-29 12:23 - 00003942 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{52FDBD38-27AC-41F7-98A0-03BC02EB7CDF}
2016-03-28 18:47 - 2014-12-03 07:50 - 00000000 ____D C:\Users\Jolanda\AppData\Roaming\Skype
2016-03-28 18:46 - 2013-08-22 15:36 - 00000000 ____D C:\windows\Inf
2016-03-28 01:00 - 2014-08-28 05:34 - 00817966 _____ C:\windows\system32\perfh007.dat
2016-03-28 01:00 - 2014-08-28 05:34 - 00189680 _____ C:\windows\system32\perfc007.dat
2016-03-28 01:00 - 2014-08-28 05:30 - 00836018 _____ C:\windows\system32\perfh00C.dat
2016-03-28 01:00 - 2014-08-28 05:30 - 00191004 _____ C:\windows\system32\perfc00C.dat
2016-03-28 01:00 - 2014-03-18 17:32 - 02946542 _____ C:\windows\system32\PerfStringBackup.INI
2016-03-28 00:11 - 2014-10-29 12:11 - 00003594 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-17541869-1475532584-504080792-1001
2016-03-27 23:59 - 2015-11-01 17:50 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2016-03-27 23:59 - 2015-11-01 17:49 - 00000000 ____D C:\ProgramData\Lavasoft
2016-03-27 23:59 - 2014-08-27 20:56 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-03-26 22:04 - 2013-08-22 17:36 - 00000000 ____D C:\windows\system32\NDF
2016-03-26 21:52 - 2015-11-01 17:50 - 00000000 ____D C:\Users\Jolanda\AppData\Roaming\Lavasoft
2016-03-26 21:49 - 2013-08-22 17:36 - 00000000 ____D C:\windows\tracing
2016-03-26 18:30 - 2013-08-22 17:20 - 00000000 ____D C:\windows\CbsTemp
2016-03-24 21:37 - 2015-02-02 15:57 - 00000000 ____D C:\Program Files (x86)\Google
2016-03-24 21:11 - 2015-06-06 09:51 - 00077728 _____ (AO Kaspersky Lab) C:\windows\system32\Drivers\kldisk.sys
2016-03-24 21:08 - 2013-08-22 17:36 - 00000000 ___HD C:\windows\ELAMBKUP
2016-03-24 21:08 - 2013-08-22 15:25 - 00262144 ___SH C:\windows\system32\config\ELAM
2016-03-24 21:05 - 2014-12-01 14:56 - 00000000 ____D C:\Program Files (x86)\NortonInstaller
2016-03-24 21:04 - 2014-04-02 16:46 - 00000000 ____D C:\ProgramData\Package Cache
2016-03-24 18:37 - 2014-10-29 12:18 - 00000000 ____D C:\Users\Jolanda\Documents\Outlook-Dateien
2016-03-24 18:31 - 2014-10-29 15:01 - 00000000 ____D C:\Users\Jolanda\AppData\Local\8206D33A-AB3A-4064-9961-8F8AF7F4407D.aplzod
2016-03-24 15:55 - 2015-04-05 16:36 - 00000000 ___SD C:\windows\SysWOW64\GWX
2016-03-24 15:55 - 2015-04-05 16:36 - 00000000 ___SD C:\windows\system32\GWX
2016-03-24 15:55 - 2013-08-22 17:36 - 00000000 ____D C:\windows\rescache
2016-03-24 15:32 - 2013-08-22 16:44 - 00395352 _____ C:\windows\system32\FNTCACHE.DAT
2016-03-24 14:40 - 2014-04-02 16:45 - 00000000 ____D C:\inetpub
2016-03-24 14:40 - 2013-08-22 17:36 - 00000000 ____D C:\windows\SysWOW64\inetsrv
2016-03-24 14:40 - 2013-08-22 17:36 - 00000000 ____D C:\windows\system32\inetsrv
2016-03-24 14:40 - 2013-08-22 13:33 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\evntcmd.exe
2016-03-24 14:40 - 2013-08-22 13:33 - 00011776 _____ (Microsoft Corporation) C:\windows\system32\snmpmib.dll
2016-03-24 14:40 - 2013-08-22 13:31 - 00121856 _____ (Microsoft Corporation) C:\windows\system32\evntwin.exe
2016-03-24 14:40 - 2013-08-22 13:31 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\evntagnt.dll
2016-03-24 14:40 - 2013-08-22 13:31 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\snmp.exe
2016-03-24 14:40 - 2013-08-22 13:31 - 00023552 _____ (Microsoft Corporation) C:\windows\system32\TFTP.EXE
2016-03-24 14:40 - 2013-08-22 13:31 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\wow64mib.dll
2016-03-24 14:40 - 2013-08-22 13:27 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\lmmib2.dll
2016-03-24 14:40 - 2013-08-22 13:25 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\aspperf.dll
2016-03-24 14:40 - 2013-08-22 13:20 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\hostmib.dll
2016-03-24 14:40 - 2013-08-22 12:45 - 00133120 _____ (Microsoft Corporation) C:\windows\system32\telnet.exe
2016-03-24 14:40 - 2013-08-22 12:31 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\snmpsnap.dll
2016-03-24 14:40 - 2013-08-22 08:58 - 00107882 _____ C:\windows\system32\mib_ii.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00048593 _____ C:\windows\system32\hostmib.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00034317 _____ C:\windows\system32\msiprip2.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00030448 _____ C:\windows\system32\mcastmib.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00026236 _____ C:\windows\system32\wins.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00026100 _____ C:\windows\system32\lmmib2.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00022462 _____ C:\windows\system32\rfc2571.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00021271 _____ C:\windows\system32\http.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00015799 _____ C:\windows\system32\ipforwd.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00015032 _____ C:\windows\system32\authserv.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00014032 _____ C:\windows\system32\accserv.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00013767 _____ C:\windows\system32\msipbtp.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00006179 _____ C:\windows\system32\ftp.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00004597 _____ C:\windows\system32\dhcp.mib
2016-03-24 14:40 - 2013-08-22 08:58 - 00004411 _____ C:\windows\system32\smi.mib
2016-03-24 14:40 - 2013-08-22 06:05 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\snmpmib.dll
2016-03-24 14:40 - 2013-08-22 06:04 - 00021504 _____ (Microsoft Corporation) C:\windows\SysWOW64\evntcmd.exe
2016-03-24 14:40 - 2013-08-22 06:03 - 00090624 _____ (Microsoft Corporation) C:\windows\SysWOW64\evntagnt.dll
2016-03-24 14:40 - 2013-08-22 06:03 - 00046080 _____ (Microsoft Corporation) C:\windows\SysWOW64\snmp.exe
2016-03-24 14:40 - 2013-08-22 06:02 - 00096256 _____ (Microsoft Corporation) C:\windows\SysWOW64\evntwin.exe
2016-03-24 14:40 - 2013-08-22 06:00 - 00037376 _____ (Microsoft Corporation) C:\windows\SysWOW64\lmmib2.dll
2016-03-24 14:40 - 2013-08-22 05:59 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\aspperf.dll
2016-03-24 14:40 - 2013-08-22 05:53 - 00041984 _____ (Microsoft Corporation) C:\windows\SysWOW64\hostmib.dll
2016-03-24 14:40 - 2013-08-22 05:15 - 00181248 _____ (Microsoft Corporation) C:\windows\SysWOW64\snmpsnap.dll
2016-03-24 14:40 - 2013-08-22 01:53 - 00107882 _____ C:\windows\SysWOW64\mib_ii.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00048593 _____ C:\windows\SysWOW64\hostmib.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00034317 _____ C:\windows\SysWOW64\msiprip2.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00030448 _____ C:\windows\SysWOW64\mcastmib.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00026236 _____ C:\windows\SysWOW64\wins.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00026100 _____ C:\windows\SysWOW64\lmmib2.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00022462 _____ C:\windows\SysWOW64\rfc2571.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00021271 _____ C:\windows\SysWOW64\http.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00015799 _____ C:\windows\SysWOW64\ipforwd.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00015032 _____ C:\windows\SysWOW64\authserv.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00014032 _____ C:\windows\SysWOW64\accserv.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00013767 _____ C:\windows\SysWOW64\msipbtp.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00006179 _____ C:\windows\SysWOW64\ftp.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00004597 _____ C:\windows\SysWOW64\dhcp.mib
2016-03-24 14:40 - 2013-08-22 01:53 - 00004411 _____ C:\windows\SysWOW64\smi.mib
2016-03-23 18:00 - 2014-10-29 14:55 - 00003592 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-17541869-1475532584-504080792-1004
2016-03-21 15:13 - 2014-10-29 12:05 - 00000000 ____D C:\Users\Jolanda
2016-03-20 11:59 - 2014-10-29 14:51 - 00003938 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{F4582879-6B7E-44D6-95F4-5468B990172E}
2016-03-19 13:49 - 2013-08-22 17:36 - 00000000 ____D C:\windows\PolicyDefinitions
2016-03-19 13:49 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-16 20:35 - 2013-08-22 17:36 - 00000000 ____D C:\windows\AppReadiness
2016-03-15 21:11 - 2013-08-22 17:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-03-15 21:10 - 2014-10-29 12:27 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-03-14 20:50 - 2014-11-19 22:44 - 00087040 ___SH C:\Users\Jolanda\Documents\Thumbs.db
2016-03-11 15:27 - 2014-10-29 12:29 - 00003102 _____ C:\windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-17541869-1475532584-504080792-1001
2016-03-11 12:58 - 2014-12-10 16:07 - 00000000 ____D C:\windows\system32\appraiser
2016-03-10 15:38 - 2014-10-29 12:05 - 00000000 ____D C:\Users\Jolanda\AppData\Local\Packages
2016-03-10 14:33 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-03-10 09:01 - 2014-04-03 01:43 - 00000000 ____D C:\windows\Panther
2016-03-10 08:55 - 2014-10-31 15:17 - 143659408 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-03-10 08:55 - 2014-10-31 15:17 - 00000000 ____D C:\windows\system32\MRT
2016-03-09 09:58 - 2015-12-09 14:51 - 00718336 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2016-03-09 09:58 - 2015-12-09 14:51 - 00372224 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2016-03-09 09:58 - 2015-12-09 14:51 - 00325632 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2016-03-08 19:39 - 2016-01-27 21:27 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-08 18:24 - 2014-12-02 20:41 - 00000000 ____D C:\Users\Kinder\AppData\Local\CrashDumps
2016-03-08 09:00 - 2013-08-22 17:38 - 00829944 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-03-08 09:00 - 2013-08-22 17:38 - 00176632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-06 19:22 - 2015-03-19 19:49 - 00000000 ____D C:\Users\Kinder\AppData\Local\Adobe
2016-03-03 14:29 - 2014-10-29 12:19 - 00000000 ____D C:\Users\Jolanda\Jolanda
2016-03-02 20:35 - 2016-01-05 20:09 - 00000000 ____D C:\Users\Kinder\Documents\Bettina

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-03-14 15:28 - 2016-03-16 12:13 - 0140015 _____ () C:\ProgramData\work.log

==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-03-28 02:32

==================== Ende von FRST.txt ============================
         

--- --- ---


Addition.txt

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
durchgeführt von Jolanda (2016-03-28 23:20:20)
Gestartet von C:\Users\Jolanda\Desktop
Windows 8.1 (X64) (2014-10-29 10:05:55)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-17541869-1475532584-504080792-500 - Administrator - Disabled)
Gast (S-1-5-21-17541869-1475532584-504080792-501 - Limited - Disabled)
Jolanda (S-1-5-21-17541869-1475532584-504080792-1001 - Administrator - Enabled) => C:\Users\Jolanda
Kinder (S-1-5-21-17541869-1475532584-504080792-1004 - Limited - Enabled) => C:\Users\Kinder

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Kaspersky Internet Security (Disabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Disabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader Driver  (HKLM-x32\...\AmUStor) (Version: 20.26.3317.04170 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver  (x32 Version: 20.26.3317.04170 - Alcor Micro Corp.) Hidden
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Artcut2009 (HKLM-x32\...\{FA01D751-CE47-4533-BB5D-9BB34514A43B}) (Version: 7.0 - Beijing Wentai Technology Co. Ltd)
A-TWIN.Cash (HKLM-x32\...\{730132C4-A4B4-46A6-BD7F-21895351F571}) (Version: 1.73.7 - AGRIDEA)
Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.0.0 - Electronic Arts)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Brother MFL-Pro Suite DCP-9010CN (HKLM-x32\...\{A1BBEE16-49B1-42F2-95B8-54C8C6A1C0C3}) (Version: 3.0.3.0 - Brother Industries, Ltd.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.73.0.2014 - Georgy Berdyshev)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.6.3728 - CyberLink Corp.)
CyberLink MediaEspresso 6.7 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.7.1.4928 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.5.4824 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.6.3702 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.6.3625 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3626 - CyberLink Corp.)
Device Pack (HKLM-x32\...\{D54D4A22-4382-4485-92DF-00C39F123E87}) (Version: 1.5.4 - D-Link)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
D-Link D-ViewCam (HKLM-x32\...\{440E9F90-0619-4E84-8226-65AD5073AD24}) (Version: 3.6.0 - D-Link)
easySoft-Pro 6 Demo (HKLM-x32\...\{CB2774A4-2000-4FD5-A11F-9C2028252743}) (Version: 6.93.5264 - Eaton Industries GmbH)
Evernote v. 5.1.1 (HKLM-x32\...\{19ABCFE2-7EED-11E3-B98A-00163E98E7D6}) (Version: 5.1.1.2334 - Evernote Corp.)
FlexiSTARTER Secabo Edition (HKLM-x32\...\{11F55C04-2154-4934-8F81-3A35C4284821}) (Version: 1.00.0000 - SA International)
Fotopick FotoFun-Designer (HKLM-x32\...\Fotopick FotoFun-Designer) (Version:  - )
Fotopick FotoFun-Designer (HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\1920167009.client.my-silverx.com) (Version:  - client.my-silverx.com)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Documentation (HKLM-x32\...\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Photo and Imaging 2.0 - Photosmart Cameras (HKLM-x32\...\{BC3EAA6A-FA0A-4E88-87DE-A34D0DFF3FDF}) (Version: 2.0.0000 - {&Tahoma8}Hewlett-Packard)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7493.4758 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.06 - Hewlett-Packard)
HP Speicher-Disc (HKLM-x32\...\{B376402D-58EA-45EA-BD50-DD924EB67A70}) (Version: 1.0.4.805 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E959FD01-BD01-4CC4-9BB8-4EBE8309BF37}) (Version: 8.2.8.25 - HP)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{A38E954F-9043-42BD-9DE9-246ED183791D}) (Version: 12.2.8.17 - HP)
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6496.0 - IDT)
Inst5675 (Version: 8.01.06 - Softex Inc.) Hidden
Inst5676 (Version: 8.01.06 - Softex Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel(R) PRO/Wireless Driver (HKLM\...\{47a10c10-a8ba-4682-bf62-1b3340f292d6}) (Version: 16.10.0000.1228 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1342.1) (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Technology Access (HKLM-x32\...\{fb74531f-28c3-4dca-9849-e6b8faa85afe}) (Version: 1.5.0.1021 - Intel Corporation)
Intel(R) Technology Access Software Asset Manager (x32 Version: 1.0.1562 - Intel Corporation) Hidden
Intel(R) Update Manager (HKLM-x32\...\{B991A1BC-DE0F-41B3-9037-B2F948F706EC}) (Version: 3.1.1228 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) 4.0 (HKLM-x32\...\{E8390040-ED6A-4AE0-8244-8AA73FC13F76}) (Version: 17.0.1422.02 - Intel Corporation)
iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}) (Version: 16.0.0.614 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.0.614 - Kaspersky Lab) Hidden
Kleiner Eisbär 2 (HKLM-x32\...\Kleiner Eisbär 2) (Version:  - )
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.292.3 - McAfee, Inc.)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4805.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-17541869-1475532584-504080792-1001\...\OneDriveSetup.exe) (Version: 17.3.6302.0225 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
mydlink services plugin (HKLM-x32\...\{1A9B665A-5F27-4F71-BF90-22FDFE7A1635}) (Version: 1.0.2.7 - D-Link Corporation)
NVIDIA Grafiktreiber 335.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.58 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Opera Stable 36.0.2130.32 (HKLM-x32\...\Opera 36.0.2130.32) (Version: 36.0.2130.32 - Opera Software)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.988 - Even Balance, Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7316 - CyberLink Corp.) Hidden
Sentinel Protection Installer 7.5.0 (HKLM-x32\...\{A5A63519-F5C2-4F4A-849A-F28A1AB3D522}) (Version: 7.5.0 - SafeNet, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Steuer 2014 15.0.4 (HKLM-x32\...\0557-1095-3602-3415) (Version: 15.0.4 - Information Factory AG)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Web Companion (HKLM-x32\...\{1bbd04c2-0e1a-4118-ad8f-fcc9898b3355}) (Version: 2.3.1395.2683 - Lavasoft)
Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3134FEF0E1D959EC0CC2E458C94B7057B2AC0CC9) (Version: 10/22/2009 2.06.00 - FTDI)
Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\88EB56038379B8B7DCFB4D2448A60F52E064B265) (Version: 10/22/2009 2.06.00 - FTDI)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {002B5271-6579-4AA5-A7A6-96293A69CD5A} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)
Task: {01D702E9-2395-4440-834D-0E8042B8DC64} - System32\Tasks\IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d-Logon => C:\Program Files (x86)\Intel Corporation\Intel(R) Technology Access\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [2015-04-18] ()
Task: {2233C817-BFEC-4AFB-8121-7221F136E196} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {28FF716A-F30C-4CEA-9F2E-C40901F92C95} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {2D0197F0-9D9B-47C1-B4BD-B5A2A13A2361} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)
Task: {3713733B-4A9D-4295-B685-CA60AE262DEF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {3785DA0F-8694-4DDE-8CB5-942E440EA60E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
Task: {3952F466-CD64-401B-8E83-D5AD562C8FEC} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2016-03-10] (Microsoft Corporation)
Task: {5A4C1D3C-A9A3-4E9D-A33F-A6F0C841AA6D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)
Task: {62E6311B-BA0A-489B-9E7D-0B6A67191C66} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {7C1301C3-4FB1-46D0-BD32-E9B6B0B917CA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-02-22] (HP Inc.)
Task: {87EE6FBC-4ABC-4691-9A59-90CE4E01AEB2} - System32\Tasks\Opera scheduled Autoupdate 1458848301 => C:\Program Files (x86)\Opera\launcher.exe [2016-03-14] (Opera Software)
Task: {8A31B06A-8A7C-4788-A72E-143BE7B53069} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-03-11] (Hewlett-Packard)
Task: {8CB8CA0D-8573-4855-963B-BCFF0E952DBD} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe
Task: {99788249-B8D7-42B0-AE75-27C5427205DC} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9B75C3B5-69B3-4A41-998F-B1762FD8ED7B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {BD31CB16-7350-480F-B0D1-2496E2051CBF} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe
Task: {CCD7243F-877D-4FF7-892A-1F720E40E9B6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {CE3D2851-E10E-4BFD-90A0-B835B077E15A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)
Task: {D53EC0CE-A7DD-43D4-8113-2724A53189C5} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-17541869-1475532584-504080792-1001 => C:\Users\Jolanda\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-03-11] (Microsoft Corporation)
Task: {DE424774-CFD8-4B3C-BBA1-FA7638554482} - System32\Tasks\IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d => C:\Program Files (x86)\Intel Corporation\Intel(R) Technology Access\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [2015-04-18] ()
Task: {F93666F3-1AA2-4C6B-B86E-C1DCB4079FBA} - System32\Tasks\HPCeeScheduleForJolanda => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\windows\Tasks\HPCeeScheduleForJolanda.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-08-27 20:42 - 2014-05-18 22:01 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-07 11:24 - 2014-02-07 11:24 - 02108928 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2014-02-07 11:21 - 2014-02-07 11:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2014-02-07 11:21 - 2014-02-07 11:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2014-02-07 11:21 - 2014-02-07 11:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2014-02-07 11:40 - 2014-02-07 11:40 - 00368528 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2014-02-07 11:40 - 2014-02-07 11:40 - 00714128 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2015-10-13 06:45 - 2015-10-13 06:45 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-29 12:27 - 2015-10-13 05:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-07-07 11:44 - 2015-07-07 11:44 - 00088064 _____ () C:\Program Files\Intel Corporation\Intel(R) Technology Access\libglog.dll
2015-07-07 13:41 - 2015-07-07 13:41 - 01793280 _____ () C:\Program Files\Intel Corporation\Intel(R) Technology Access\cpprest120_1_4.dll
2015-07-07 13:41 - 2015-07-07 13:41 - 00354560 _____ () C:\Program Files\Intel Corporation\Intel(R) Technology Access\JsonCpp.dll
2015-01-07 11:19 - 2015-01-07 12:44 - 00076888 _____ () C:\windows\SysWOW64\PnkBstrA.exe
2014-02-07 11:28 - 2014-02-07 11:28 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2002-04-17 11:49 - 2002-04-17 11:49 - 00077824 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
2015-11-06 18:51 - 2012-09-25 12:26 - 01163264 ____N () C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
2016-02-22 20:12 - 2016-02-22 20:12 - 00325824 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2016-02-22 20:12 - 2016-02-22 20:12 - 00325824 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2015-10-13 06:46 - 2014-10-11 14:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2002-04-17 11:49 - 2002-04-17 11:49 - 00024576 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll
2015-11-06 18:13 - 2015-10-05 10:22 - 00074272 _____ () C:\Program Files (x86)\PDF24\zlib.dll
2015-11-06 18:13 - 2015-10-05 10:22 - 00051744 _____ () C:\Program Files (x86)\PDF24\OperationUI.dll
2016-02-22 20:12 - 2016-02-22 20:12 - 00325824 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-11-06 18:51 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 15:25 - 2016-03-28 23:04 - 00000035 ____A C:\windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-17541869-1475532584-504080792-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jolanda\Pictures\iCloud Photos\My Photo Stream\IMG_2341.JPG
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{163EAFBE-E73C-4D5D-9A31-B20CA9A2292F}] => (Allow) c:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{CBEDE5E1-BC18-4AD2-82A5-7957AD2A7329}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{CC85C985-F14B-4AC7-BF04-6227CBB5E982}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{A5568C50-C701-42D1-A3E9-2EBB7A752A75}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{188842B1-CCF4-4BEE-B15F-7FCA5448F80F}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{4E64603A-5106-4AE3-BC0E-9E87E165EA90}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{5B775600-FB59-486B-B119-418B94B97247}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{3CEBD08F-3C3F-4873-9964-D56BA52EE15B}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{28A9C164-BB92-441F-A536-5F5D18835894}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{8AF7E5C3-79E7-44C9-A163-A0D18F0063B9}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{A613B4C6-1F16-4F03-80E9-2ED92506095B}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{C7112E49-298A-4AE4-8088-4D5E2B82BD0D}] => (Allow) C:\Users\Jolanda\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{7D542D48-3C88-4B9F-AB3B-859D913035E8}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
FirewallRules: [{11A5A9D2-4AE0-4913-8C7F-85CB8F795871}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
FirewallRules: [{ACEDAA45-053B-445B-8527-8C3BA81D406D}] => (Allow) C:\Windows\SysWOW64\SAiLicSvr.exe
FirewallRules: [{2C241B36-0F96-4F4B-8B02-55A50C21D6FB}] => (Allow) C:\Windows\SysWOW64\SAiLicSvr.exe
FirewallRules: [{C62508D2-5154-4442-93AF-0EB45D527377}] => (Allow) C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\App2.exe
FirewallRules: [{5A77C9E6-F658-48D5-A9E2-F7CF46DC292D}] => (Allow) C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\App2.exe
FirewallRules: [{5265C3E3-A3D3-4943-8333-52AC77D30D63}] => (Allow) C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\App.exe
FirewallRules: [{D7EBEAD9-92DB-40FD-90AD-6BD5B2A773EB}] => (Allow) C:\Program Files (x86)\Secabo\FlexiSTARTER Secabo Edition\Program\App.exe
FirewallRules: [{E951C9B0-3BD4-49F3-BD8F-1972A0D9CDB0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{D72E199C-93F1-4779-91AC-0811AED14010}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2287157C-D942-40DE-91F6-468D0ED163C8}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{29E82C9A-FC89-44D5-85FD-384F6252F0AD}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{EDDBF3A5-2F19-4916-8EF3-4D6A9988D78F}] => (Allow) C:\Program Files (x86)\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe
FirewallRules: [{7E7A980A-BFA1-4B99-9C6C-9AE565A1D441}] => (Allow) C:\Program Files (x86)\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe
FirewallRules: [{9C5F6637-7420-4829-888A-A3772C92F230}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{935300A0-BBC9-4AC0-A6F7-AFDBC862EFB2}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{ACB0B247-EECB-4AFB-8BA4-75CBD1CA4F2A}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{9C02AFF9-DE9F-41D6-B98C-1F50DF37972A}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{D186C7EB-9127-4995-A9F2-C2E234AD3763}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{FCC7200F-502D-4252-921E-71884C42D18D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{1D12F24A-8D0A-4776-9D2A-91FBB0E19DCF}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{7F6BE4B5-668F-41B2-92F9-09D8BEE6F1A5}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{CA557E9A-6541-490A-888B-88EBFBF22C8F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{8684EB89-C45C-493E-8B7E-5506A8B70860}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{3D233E74-AC42-4EE9-9F87-FAAAC8E453CC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D1BB3E47-F4AC-4BD4-B489-E444F5E31EE5}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{81EFF5D2-CD9A-4236-B1B0-1CD4EA42BD8B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{704AEB41-5E17-4894-89D2-F2FF3831415F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7AA81E07-0910-454E-A5B2-6729F2AAF362}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [SNMP-In-UDP] => (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-Out-UDP] => (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe

==================== Wiederherstellungspunkte =========================


==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Intel(R) Dual Band Wireless-AC 7260
Description: Intel(R) Dual Band Wireless-AC 7260
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel Corporation
Service: NETwNb64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/28/2016 11:19:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MainConsole.exe, Version: 3.6.0.0, Zeitstempel: 0x5260127c
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0abfddd0
ID des fehlerhaften Prozesses: 0x1f10
Startzeit der fehlerhaften Anwendung: 0xMainConsole.exe0
Pfad der fehlerhaften Anwendung: MainConsole.exe1
Pfad des fehlerhaften Moduls: MainConsole.exe2
Berichtskennung: MainConsole.exe3
Vollständiger Name des fehlerhaften Pakets: MainConsole.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MainConsole.exe5

Error: (03/28/2016 11:18:49 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz   konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.   0x0.

Error: (03/28/2016 11:18:49 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (03/28/2016 11:18:49 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (03/28/2016 11:18:15 PM) (Source: EvntAgnt) (EventID: 2019) (User: )
Description: Erweiterungs-Agent für SNMP-Ereignisprotokoll wurde nicht richtig initialisiert.

Error: (03/28/2016 11:18:15 PM) (Source: EvntAgnt) (EventID: 1020) (User: )
Description: Fehler beim Verarbeiten von Registrierungsparametern. Erweiterungs-Agent wird beendet.

Error: (03/28/2016 11:18:15 PM) (Source: EvntAgnt) (EventID: 2019) (User: )
Description: Erweiterungs-Agent für SNMP-Ereignisprotokoll wurde nicht richtig initialisiert.

Error: (03/28/2016 11:18:15 PM) (Source: EvntAgnt) (EventID: 3005) (User: )
Description: Fehler beim Setzen der Position an das Ende der Protokolldatei -- Suche nach Protokollende ist fehlgeschlagen. Als Handle wurde 3573350456 angegeben. Der Rückgabecode von ReadEventLog ist 122.

Error: (03/28/2016 11:05:39 PM) (Source: EvntAgnt) (EventID: 2019) (User: )
Description: Erweiterungs-Agent für SNMP-Ereignisprotokoll wurde nicht richtig initialisiert.

Error: (03/28/2016 11:05:39 PM) (Source: EvntAgnt) (EventID: 1020) (User: )
Description: Fehler beim Verarbeiten von Registrierungsparametern. Erweiterungs-Agent wird beendet.


Systemfehler:
=============
Error: (03/28/2016 11:18:13 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.

Error: (03/28/2016 11:05:36 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "WMI-Leistungsadapter" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Bluetooth OBEX Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Support Solutions Framework Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SAiDownloader" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SAiDownloaderVista" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/28/2016 11:04:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Bluetooth Device Monitor" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


CodeIntegrity:
===================================
  Date: 2016-03-24 20:09:07.377
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:09:07.205
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:09:07.034
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:56.717
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:56.545
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:56.374
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:28.224
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:28.037
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:07:27.857
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-24 20:05:40.231
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
Prozentuale Nutzung des RAM: 13%
Installierter physikalischer RAM: 16337.14 MB
Verfügbarer physikalischer RAM: 14173.1 MB
Summe virtueller Speicher: 18769.14 MB
Verfügbarer virtueller Speicher: 16698.57 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:106.19 GB) (Free:3.57 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (Recovery Image) (Fixed) (Total:11.57 GB) (Free:1.26 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: (DATADRIVE1) (Fixed) (Total:931.39 GB) (Free:928.56 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: F349C5E8)

Partition: GPT.

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 7A4356AB)

Partition: GPT.

==================== Ende von Addition.txt ============================
         

Hey super - ich komme wieder auf e-Banking Seiten!!!

Servus,

Zitat von Altbadener

Hey super - ich komme wieder auf e-Banking Seiten!!!

sehr gut.





Wir entfernen die letzten Reste und kontrollieren nochmal alles.



Hinweis: Der Suchlauf mit ESET kann länger dauern.



Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
C:\Program Files (x86)\RebateInformer
C:\Users\Jolanda\AppData\Local\SweetLabs App Platform
Unlock: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce
CMD: reg delete "HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Application Restart #5 /f
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7DFDE1A-30B3-43C9-82C4-92D3A5789311}
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6}
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SiteRanker
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lavasoft\Web Companion
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1bbd04c2-0e1a-4118-ad8f-fcc9898b3355}
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

• Starte die HitmanPro.exe
• Klicke auf
  
• Entferne den Haken bei
  
• Klicke auf
  und
• Akzeptiere die Lizenzbedingungen und klicke auf
• Klicke auf
  
  und auf
• Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
  und speichere die Logdatei auf Deinem Desktop.
• Schließe HitmanPro und poste mir das Log.

 

Schritt 4

• Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?







Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die Logdatei von ESET,
• die Logdatei von HitmanPro,
• die beiden neuen Logdateien von FRST,
• die Beantwortung der gestellten Fragen.

Schritt 1: fixlog.txt

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
durchgeführt von Jolanda (2016-03-29 00:06:00) Run:2
Gestartet von C:\Users\Jolanda\Desktop
Geladene Profile: Jolanda (Verfügbare Profile: Jolanda & Kinder)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
CloseProcesses:
C:\Program Files (x86)\RebateInformer
C:\Users\Jolanda\AppData\Local\SweetLabs App Platform
Unlock: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce
CMD: reg delete "HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Application Restart #5 /f
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7DFDE1A-30B3-43C9-82C4-92D3A5789311}
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6}
DeleteKey: HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SiteRanker
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lavasoft\Web Companion
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1bbd04c2-0e1a-4118-ad8f-fcc9898b3355}
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
         
*****************

Prozess erfolgreich geschlossen.
"C:\Program Files (x86)\RebateInformer" => nicht gefunden.
"C:\Users\Jolanda\AppData\Local\SweetLabs App Platform" => nicht gefunden.
"HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce" => Schlüssel konnte nicht entsperrt werden

=========  reg delete "HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Application Restart #5 /f =========

FEHLER: Ung�ltige Syntax.
Geben Sie "REG DELETE /?" ein, um die Syntax anzuzeigen.

========= Ende von CMD: =========

HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SweetLabs App Platform => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7DFDE1A-30B3-43C9-82C4-92D3A5789311} => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6} => Schlüssel nicht gefunden. 
HKEY_USERS\S-1-5-21-17541869-1475532584-504080792-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\SiteRanker => Schlüssel nicht gefunden. 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Lavasoft\Web Companion => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105} => Schlüssel erfolgreich entfernt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057} => Schlüssel nicht gefunden. 
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1bbd04c2-0e1a-4118-ad8f-fcc9898b3355} => Schlüssel erfolgreich entfernt

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-17541869-1475532584-504080792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-17541869-1475532584-504080792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========


=========  ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl�sungscache wurde geleert.

========= Ende von CMD: =========


=========  netsh winsock reset =========


Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlie�en.


========= Ende von CMD: =========

EmptyTemp: => 154.9 MB temporäre Dateien entfernt.


Das System musste neu gestartet werden.

==== Ende von Fixlog 00:06:06 ====
         

Schritt 2: ESET Online Scanner log.txt

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=ff14b194ba0f124a96fd65109d2f9480
# end=init
# utc_time=2016-03-28 10:12:27
# local_time=2016-03-29 12:12:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 28790
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=ff14b194ba0f124a96fd65109d2f9480
# end=updated
# utc_time=2016-03-28 10:14:28
# local_time=2016-03-29 12:14:28 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=ff14b194ba0f124a96fd65109d2f9480
# engine=28790
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-03-28 10:40:09
# local_time=2016-03-29 12:40:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1305 16777213 100 100 88801 23423461 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 393742 22994379 0 0
# scanned=373409
# found=2
# cleaned=0
# scan_time=1540
sh=AA190194CD322F27B81B57B66F0E48B16DDF09FC ft=1 fh=7a1e2a1eaadddca3 vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jolanda\Downloads\FreeYouTubeToMP3Converter.exe"
sh=AA190194CD322F27B81B57B66F0E48B16DDF09FC ft=1 fh=7a1e2a1eaadddca3 vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jolanda\Downloads\FreeYouTubeToMP3Converter_3.11.35.1031.exe"
         

ESET deinstalliert und Folder gelöscht

Schritt 3: HitmanPro_x64:

	
	
HitmanPro 3.7.13.258
www.hitmanpro.com

   Computer name . . . . : SCHEREREI
   Windows . . . . . . . : 6.3.0.9600.X64/8
   User name . . . . . . : SCHEREREI\Jolanda
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2016-03-29 00:49:51
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 16s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 85

   Objects scanned . . . : 2*265*086
   Files scanned . . . . : 86*904
   Remnants scanned  . . : 754*542 files / 1*423*640 keys

Suspicious files ____________________________________________________________

   C:\Users\Jolanda\AppData\Local\PunkBuster\BC2\pb\dll\wc002305.dll
      Size . . . . . . . : 962*185 bytes
      Age  . . . . . . . : 446.5 days (2015-01-07 12:44:05)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C8E59E65AE451CE761E7C48F8BA802CD17513057DEA65A4D4B4F6001153FD414
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Jolanda\AppData\Local\PunkBuster\BC2\pb\pbcl.dll
      Size . . . . . . . : 962*185 bytes
      Age  . . . . . . . : 446.5 days (2015-01-07 12:44:05)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C8E59E65AE451CE761E7C48F8BA802CD17513057DEA65A4D4B4F6001153FD414
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Jolanda\AppData\Local\PunkBuster\BC2\pb\pbclold.dll
      Size . . . . . . . : 891*962 bytes
      Age  . . . . . . . : 446.5 days (2015-01-07 12:36:32)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A324BDA2B890227F72D9F12323AD3FF51582CE312286C296F6558BD3F3927616
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Jolanda\AppData\Local\PunkBuster\BC2\pb\PnkBstrK.sys
      Size . . . . . . . : 139*048 bytes
      Age  . . . . . . . : 446.5 days (2015-01-07 12:36:44)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : A935B2B22381F56ED9F78AF35FE20333F974CB4CB1257763434B7667DE17AD57
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\Jolanda\Desktop\FRST64.exe
      Size . . . . . . . : 2*374*144 bytes
      Age  . . . . . . . : 1.5 days (2016-03-27 12:43:40)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 1CB35A93213562911D4E4218EFFCB9FC5A946B6E1A99509BCD2B5C936898D159
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\Jolanda\Documents\BFBC2\pb\pbcl.dll
      Size . . . . . . . : 891*962 bytes
      Age  . . . . . . . : 446.5 days (2015-01-07 12:36:31)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A324BDA2B890227F72D9F12323AD3FF51582CE312286C296F6558BD3F3927616
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Kinder\AppData\Local\PunkBuster\BC2\pb\dll\wc002305.dll
      Size . . . . . . . : 962*185 bytes
      Age  . . . . . . . : 446.1 days (2015-01-07 22:06:52)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C8E59E65AE451CE761E7C48F8BA802CD17513057DEA65A4D4B4F6001153FD414
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Kinder\AppData\Local\PunkBuster\BC2\pb\pbcl.dll
      Size . . . . . . . : 962*185 bytes
      Age  . . . . . . . : 287.6 days (2015-06-15 10:03:22)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C8E59E65AE451CE761E7C48F8BA802CD17513057DEA65A4D4B4F6001153FD414
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Kinder\AppData\Local\PunkBuster\BC2\pb\pbclold.dll
      Size . . . . . . . : 962*185 bytes
      Age  . . . . . . . : 446.1 days (2015-01-07 21:51:22)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C8E59E65AE451CE761E7C48F8BA802CD17513057DEA65A4D4B4F6001153FD414
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\Kinder\AppData\Local\PunkBuster\BC2\pb\PnkBstrK.sys
      Size . . . . . . . : 139*048 bytes
      Age  . . . . . . . : 446.1 days (2015-01-07 21:51:34)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : A935B2B22381F56ED9F78AF35FE20333F974CB4CB1257763434B7667DE17AD57
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\Kinder\Documents\BFBC2\pb\pbcl.dll
      Size . . . . . . . : 891*962 bytes
      Age  . . . . . . . : 446.1 days (2015-01-07 21:51:22)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A324BDA2B890227F72D9F12323AD3FF51582CE312286C296F6558BD3F3927616
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.


Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\Classes\Allin1Convert_8h.HTMLMenu.1\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.HTMLMenu\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.HTMLPanel.1\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.HTMLPanel\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.PseudoTransparentPlugin.1\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.PseudoTransparentPlugin\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.SettingsPlugin.1\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.SettingsPlugin\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector.1\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\CLSID\{a4c2fb10-84c3-44eb-9f9e-860fa1d9a797}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{1B520A16-E83A-48F9-8802-8F485F24A452}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{1E6170F4-3856-40E4-A2EB-2D8FB46574A4}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{289211A5-2A74-454B-9F1F-FA9A8D9CD6D8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{3E698E62-9516-4670-AD6C-DC58181BC9F8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{43E76D04-EB5C-4D74-A11D-7403BAFE540B}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{45A28B99-6C20-441D-9D4D-F7EC7C701F6C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{4CE34BDA-95CD-431D-AA32-0FF7589C0376}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{4E089F3E-F5E1-4759-AF16-E7EBE24CAA9C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{5D076356-28C1-43B2-B29B-1AAE8D518E83}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{5E58CDA9-3B21-4611-A859-26EE28950E61}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{628BA19D-7BED-4C54-8210-AFE66BB15D06}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{6C5561B6-3DD2-46B5-83BE-EAE744366046}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{774BFD7A-2CE7-4785-8957-2D62F7F4A83C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{8077E854-138D-4396-ABB8-44C39E621705}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{B0602473-26E3-425F-A819-D8651D6D83A8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{B1339BE3-9E4D-49D4-97F2-E4220530F65C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{B992BF10-B9DF-413D-BFBE-0DAED5BF0ABC}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{BB644C1C-BDFC-4390-8BCF-8E864D1859E6}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{EA3743AC-948C-4E65-A61F-10EDA13D79CA}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Interface\{F11B9E79-0F7B-4C8B-B507-F06982497901}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\TypeLib\{2561FD25-FE31-4E56-A120-AF7FEAAE3124}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\TypeLib\{76FC1003-0825-48BD-B59B-3B7A5754972C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\TypeLib\{B48AC2CD-9662-47E0-A3C0-3B01BB3F463E}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\TypeLib\{BE698E51-830B-447A-954D-901D6E05DDE2}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\TypeLib\{BFCF748F-A56E-451F-AA45-0D7EB699E416}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{27f49273-de3a-4111-90f9-6c474c37aefb}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7caefafc-9a1e-4bcc-94dd-bc7d8d52717a}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{889f49d2-6cea-40be-be5f-7217485f9745}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{de0f6787-9d1c-42b7-a0b9-eac630f87902}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{e4ef697f-434b-4dc7-a464-4412462206db}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{f2c368c5-9f44-4d43-89f3-a1cc87f1da96}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{1B520A16-E83A-48F9-8802-8F485F24A452}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{1E6170F4-3856-40E4-A2EB-2D8FB46574A4}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{289211A5-2A74-454B-9F1F-FA9A8D9CD6D8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3E698E62-9516-4670-AD6C-DC58181BC9F8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{43E76D04-EB5C-4D74-A11D-7403BAFE540B}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{45A28B99-6C20-441D-9D4D-F7EC7C701F6C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{4CE34BDA-95CD-431D-AA32-0FF7589C0376}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{4E089F3E-F5E1-4759-AF16-E7EBE24CAA9C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{5D076356-28C1-43B2-B29B-1AAE8D518E83}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{5E58CDA9-3B21-4611-A859-26EE28950E61}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{628BA19D-7BED-4C54-8210-AFE66BB15D06}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6C5561B6-3DD2-46B5-83BE-EAE744366046}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{774BFD7A-2CE7-4785-8957-2D62F7F4A83C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{8077E854-138D-4396-ABB8-44C39E621705}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{B0602473-26E3-425F-A819-D8651D6D83A8}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{B1339BE3-9E4D-49D4-97F2-E4220530F65C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{B992BF10-B9DF-413D-BFBE-0DAED5BF0ABC}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{BB644C1C-BDFC-4390-8BCF-8E864D1859E6}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{EA3743AC-948C-4E65-A61F-10EDA13D79CA}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F11B9E79-0F7B-4C8B-B507-F06982497901}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{2561FD25-FE31-4E56-A120-AF7FEAAE3124}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{76FC1003-0825-48BD-B59B-3B7A5754972C}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{B48AC2CD-9662-47E0-A3C0-3B01BB3F463E}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{BE698E51-830B-447A-954D-901D6E05DDE2}\ (Allin1Convert)
   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{BFCF748F-A56E-451F-AA45-0D7EB699E416}\ (Allin1Convert)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{27f49273-de3a-4111-90f9-6c474c37aefb}\ (Allin1Convert)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7caefafc-9a1e-4bcc-94dd-bc7d8d52717a}\ (Allin1Convert)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e4ef697f-434b-4dc7-a464-4412462206db}\ (Allin1Convert)
   HKU\S-1-5-21-17541869-1475532584-504080792-1001\Software\Classes\Wow6432Node\CLSID\{5bcf818d-78c8-41b8-ba89-65c5fdac4fc4}\ (Allin1Convert)
   HKU\S-1-5-21-17541869-1475532584-504080792-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7CAEFAFC-9A1E-4BCC-94DD-BC7D8D52717A}\ (Allin1Convert)
   HKU\S-1-5-21-17541869-1475532584-504080792-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C2FB10-84C3-44EB-9F9E-860FA1D9A797}\ (Allin1Convert)
   HKU\S-1-5-21-17541869-1475532584-504080792-1001_Classes\Wow6432Node\CLSID\{5bcf818d-78c8-41b8-ba89-65c5fdac4fc4}\ (Allin1Convert)