| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFoxWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
27.05.2016, 18:05
| #1 |
| |  Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox problem siehe Titel: Auf dem Windows 8 Rechner scheint ein Malwareproblem zu herrschen, in den Browserfenstern ist zunehmend Werbung zu sehen die Titelseite von Firefox ist übersät mit Spieleicons. IE meldet ein Addon Problem, die von MS vorgeshclagenen Problemlösungen scheitern. Lösungssuche ist durch ständiges Abstürzen von Websites ("Website xy reagiert nicht und muss beendet werden") und blockierten Eingabefenstern erschwert.Ein Posten hier im Forum war bis dahin unmöglich, daher: Scan mittes Malwareerkennung und Virenscanner. - Malware wurde mit Malwarebytes und Spybot erkannt und entfernt. - (Logdateien untenstehend). Deshalb danach überhaupt erst FRST Scan möglich, voila, untenstehend inc Addition txt. Nun ist alles zwar besser, d.h. Internet wieder einigermassen benutzbar, aber nicht behoben, denn der Rechner bleibt auch in anderen Programmen verlangsamt, im Taskmanager zeigen sich weiterhin weder Arbeitsspeicher noch die CPU überlastet. Herzlichen Dank im voraus, gut dass Ihr da seid.  Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-05-2016
durchgeführt von Rhea (2016-05-24 00:11:22)
Gestartet von C:\Users\Rhea\Downloads
Windows 8.1 (Update) (X64) (2014-05-23 00:02:59)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3879709871-1962586687-2025067079-500 - Administrator - Disabled)
Gast (S-1-5-21-3879709871-1962586687-2025067079-501 - Limited - Disabled)
Rhea (S-1-5-21-3879709871-1962586687-2025067079-1001 - Administrator - Enabled) => C:\Users\Rhea
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.35 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0935-000001000000}) (Version: 9.35.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.7.0 - Conexant)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.33 - Lenovo)
Energy Manager (x32 Version: 1.0.0.33 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.50 - FileZilla Project)
Garmin BaseCamp (HKLM-x32\...\{B0BED0BB-E1C4-49AA-840F-7CA052ADF5EB}) (Version: 4.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GMX MailCheck (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.6.1 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 4.0.1.0 - 1&1 Mail & Media GmbH)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{E7E2BEA6-ECCE-4306-9486-A08781BE0AD0}) (Version: 2.0.0.1104 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.0.1104 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.0.13.12271 - Lenovo)
Lenovo Yoga PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.1.9.5 - Lenovo)
Lenovo Yoga PhoneCompanion (x32 Version: 1.1.9.5 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 45.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 de)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
Mozilla Thunderbird 38.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.6.0 (x86 de)) (Version: 38.6.0 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PHOTOfunSTUDIO 9.6 PE (HKLM-x32\...\{7113ACE0-A2FA-463B-969A-E3FD7BF42573}) (Version: 9.06.710.1031 - Panasonic Corporation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.310 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.1.16 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.60 (17.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.79.00(26.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM-x32\...\Easy Wireless Setup) (Version: 3.70.18.0 - Samsung Electronics Co., Ltd.)
Samsung M2070 Series (HKLM-x32\...\Samsung M2070 Series) (Version: 1.19 (03.12.2014) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series XPS (Windows 8) (HKLM-x32\...\Samsung M2070 Series XPS (Windows 8)) (Version: 3.03.08.00:05 - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.11.28 (10.03.2015) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.01.12 (15.10.2014) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Assistant (HKLM-x32\...\Samsung Scan Assistant) (Version: 1.05.07 (20.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.25 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.06.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SILKYPIX Developer Studio 4.2 SE (HKLM-x32\...\InstallShield_{8B9D37A0-F77B-41DD-932A-CE01DEC1ADAA}) (Version: 4 - Ichikawa Soft Laboratory)
SILKYPIX Developer Studio 4.2 SE (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.6 - Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
Yoga Picks (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.013.1202 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {48F86BC9-1A37-4268-8DC9-4B902CAEC945} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {4D1C6EFB-FADF-4188-9DAE-072F214E05B7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-22] (Adobe Systems Incorporated)
Task: {721CA287-0ACF-41C2-A15A-35A9A2785A33} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {7520915A-6376-4F3A-9F78-6895858C2E24} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {80EFEDA3-E3E4-451A-81B7-A19891B23FDA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {CFE11131-73E0-419A-BE2D-C3A87FC84D8F} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-10-08] (1&1 Mail & Media GmbH)
Task: {D8C74952-C759-495C-BAED-612B80646889} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {E150FFDF-A864-4558-96E3-20BABF992B86} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\WINDOWS\system32\MRT.exe [2016-05-23] (Microsoft Corporation)
Task: {F69EE45E-80DB-40F7-B912-B46E9C2F1791} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11517530520.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd10c1016 -pinnedTimeHigh 0x01d0d295 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/ende/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11689991990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd3990412 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000056 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/82/bebalanced-k%C3%B6rper
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12072113890.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0327686a -pinnedTimeHigh 0x01d0f4b0 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000017 hxxp://www.clipfish.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12425247930.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xf60c1a3b -pinnedTimeHigh 0x01cfbe56 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/frde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13304856320.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0de30816 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://www.unwetterzentrale.de/uwz/temperatur.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13506273490.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x245d8140 -pinnedTimeHigh 0x01d0fb60 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001e hxxp://woerterbuchnetz.de/DWB/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-14704389310.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x709605fc -pinnedTimeHigh 0x01d07bb4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000029 hxxp://localhost/joomla341/administrator/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-15829586810.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x8dac8991 -pinnedTimeHigh 0x01d0f876 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000015 hxxp://www.amazon.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-16228374220.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xdd5a7938 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000050 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/83/bebalanced-geist
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-17714738290.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa06bf05f -pinnedTimeHigh 0x01cfbdf1 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000001e hxxp://www.gpsies.com/login.do
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-18349738120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x012fa14d -pinnedTimeHigh 0x01d06bbc -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000042 hxxp://www.niederschlagsradar.de/niederschlagsprognose.aspx?type=1
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1856752590.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x9e55eab1 -pinnedTimeHigh 0x01d06bcf -securityFlags 0x00000000 -tileType 0x00000002 -url 0x0000001a hxxp://www.codecheck.info/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1930419650.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x16618286 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000011 hxxp://fritz.box/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20172485120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x1a75fa60 -pinnedTimeHigh 0x01cfbc92 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://www.bahn.de/p/view/index.shtml
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20504568990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xebcbbc70 -pinnedTimeHigh 0x01cfbc91 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000003b hxxp://www.boeser-wolf.schule.de/concours/2014/accueil.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-5511536870.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa5d41f09 -pinnedTimeHigh 0x01d138b2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/esde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-6764561640.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xc0dd7b7c -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000051 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/80/bebalanced-basics
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\13362524720.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfdbd1b9c -pinnedTimeHigh 0x01cfc2d2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://wetterstationen.meteomedia.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\14722268070.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0374d018 -pinnedTimeHigh 0x01d138f7 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000026 hxxp://www.duden.de/schwierige-woerter
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16003941200.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x029e0744 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000017 hxxp://www.sat24.com/eu
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16371692260.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x6ede0d80 -pinnedTimeHigh 0x01d12204 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000013 hxxp://www.faz.net/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19320121740.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x4f006974 -pinnedTimeHigh 0x01d0d42f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000028 hxxps://www.aerzte-finanz.de/praxispilot
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19571323130.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x08753f27 -pinnedTimeHigh 0x01d0b0b6 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000002d hxxp://online.rote-liste.de/suche/ferro-sanol
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19858872700.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe480d8c3 -pinnedTimeHigh 0x01d06bc9 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003c hxxp://www.hautschutzengel.de/bedenkliche-inhaltsstoffe.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\21415739090.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe924f5b3 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000059 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/84/bebalanced-sch%C3%B6nheit
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\330252100.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x40fe2528 -pinnedTimeHigh 0x01d07ba4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://localhost/joomla341/administrator/index.php
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4300483340.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xcc6d0835 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000053 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/81/bebalanced-workouts
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4699799270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x2a286297 -pinnedTimeHigh 0x01cfe086 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000041 hxxp://fahrplanauskunft.vrn.de/vrn/XSLT_TRIP_REQUEST2?language=de
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4736959030.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x693ce4b5 -pinnedTimeHigh 0x01d06bc1 -securityFlags 0x00000000 -tileType 0x00000003 -url 0x000000a5 hxxp://scholar.google.com/scholar?hl=en&q=%22101-86-0%22+OR+%22hexyl+cinnamaldehyde%22+OR+%2
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\6473758050.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xff1fdcd2 -pinnedTimeHigh 0x01cfe091 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000044 hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8167997760.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfb848207 -pinnedTimeHigh 0x01d0fea8 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001c hxxp://www.dirksbiokiste.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8302254560.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfce9884c -pinnedTimeHigh 0x01d0fb5f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001b hxxp://dwb.uni-trier.de/de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8511463020.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe44b0b80 -pinnedTimeHigh 0x01d12ea3 -securityFlags 0x00000000 -tileType 0x00000002 -url 0x00000041 hxxps://www.efiliale.de/efiliale/internetmarke/productDetails.jsp
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2014-12-02 13:52 - 2014-12-02 13:52 - 00029184 _____ () C:\WINDOWS\System32\ssm4mlm.dll
2015-05-22 19:34 - 2014-04-16 10:22 - 00029184 _____ () C:\WINDOWS\System32\usp02l.dll
2014-03-07 00:05 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2015-05-22 19:34 - 2014-11-26 13:07 - 00118576 _____ () C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00062224 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-03-07 00:00 - 2013-11-18 17:40 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
2013-11-15 04:01 - 2013-11-15 04:01 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-11-15 03:58 - 2013-11-15 03:58 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-11-15 04:04 - 2013-11-15 04:04 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00294672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-09-08 13:39 - 2014-09-08 13:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2014-09-08 13:38 - 2014-09-08 13:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-03-07 00:00 - 2013-12-02 19:09 - 00044560 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Util.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00020480 _____ () C:\WINDOWS\system32\WinMetadata\Windows.System.winmd
2015-12-23 12:13 - 2015-12-23 12:13 - 00347136 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Gloaae92e31#\1b6c35238563de0cb93d3ed0826a69a3\Windows.Globalization.ni.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00112640 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Networking.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00030208 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Foundation.winmd
2014-03-07 00:06 - 2014-03-07 00:06 - 00815104 _____ () C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00108304 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2015-05-22 19:34 - 2013-10-04 06:53 - 00734720 _____ () C:\WINDOWS\system32\SnMinDrv.dll
2015-05-22 18:05 - 2014-09-19 00:08 - 00087552 ____N () C:\WINDOWS\system32\SSDEVM64.DLL
2015-10-28 10:32 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-28 10:32 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-28 10:32 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00102672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00101648 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2014-09-08 13:32 - 2014-09-08 13:32 - 00050688 _____ () C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-12-03 14:35 - 2014-06-04 11:21 - 00571904 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2014-12-03 14:35 - 2014-05-19 18:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00034768 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00093640 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00018376 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-05-22 16:37 - 2016-05-07 00:35 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00692688 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00121296 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021840 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00114640 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021832 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00117056 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134608 _____ () C:\Program Files (x86)\Dropbox\Client\_elementtree.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134088 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00240584 _____ () C:\Program Files (x86)\Dropbox\Client\jpegtran.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021824 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32._winffi_kernel32.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-05-22 16:37 - 2016-04-19 21:50 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-05-22 16:37 - 2016-05-07 00:34 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-05-22 16:37 - 2016-05-07 00:34 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01971504 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00132912 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00223544 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-03-22 19:06 - 00450771 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rhea\Documents\privat\baby\Hypnobirthing\rosa\Rose 11.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A1565219-9C4A-477E-B087-633B3F01E71E}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{27C039CA-A127-4E1D-B1D3-CFEB670B44C4}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{52CA7F06-4BB9-4795-8066-9B58632D957C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{A68DF61A-3CEB-457C-A455-E979D0DFD9D9}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{3BA7C7BB-201C-4578-8032-226B84A5187E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{D77998D3-8628-4C19-B4A4-AF6FD6322E17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{53831517-DB8D-477E-A9BA-0C3A6D4F67AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1061C061-F384-43B0-A0D9-6DDF4EE6503F}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{7D299E78-91AB-4FFE-A9D0-96D0355417B2}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{1AF7B847-EFE8-41FB-8695-62F373AFC563}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{68C4E61F-D08F-4ECF-BDF9-34E20341F5B6}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{B954C488-1AA4-4941-8C2B-67D5286A963E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{E1072E6A-6360-495F-926E-F632C4A9689B}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{2F8C4FC1-9C82-4726-8649-49E2C93B9D8E}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{AF6153E9-14EE-4199-BED9-3D14AB492CF1}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{D4FA5DEE-C506-4A04-935D-390F5C6079FB}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{F1A3B9EF-D5FB-4574-9BEB-96ECBB0D684B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{D921552C-CE68-403D-9DBE-CAC966A95EE2}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon64.exe
FirewallRules: [{4EA57459-AD30-41FA-9486-39ECF62DD501}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon.exe
FirewallRules: [{CA400C7C-FCAD-4924-A278-73C732755889}] => (Allow) C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxMon64.exe
FirewallRules: [{0DB4AB93-0BF1-452D-B832-A710ACAE9614}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{0A36E50D-B3B9-4F9E-89E2-F7D348BB11A2}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{92202204-EA1B-4534-9299-601CA49D30CE}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{0DC69213-20AD-406C-9DB4-D19FB35403CB}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{15E878E5-17D9-450B-8885-D2F99A877B4C}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{734C61A7-FE33-43F5-B970-B3128ED0BA66}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{A3E00CDA-21C0-4CB5-A0CB-EA9660A81F86}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{A7D4F664-91A4-45EF-8290-231FF96AF0AA}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{76B16069-4BCF-41A5-8FD8-C7D5BC69D901}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{80397F1C-99AE-4B60-889A-1A3D5E3B664F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{5A4CBF62-620D-4DE8-8BEC-D96A19665375}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{B01021EE-1A36-4775-B364-BBFD21F779CC}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [{6AE25776-262D-4156-A3AD-06CEFDE05C0E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{E1687298-987D-4B20-9A26-B60751527F08}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{ED9943F9-DE46-46E9-925F-100E5091517E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{8A2BA25A-496F-4DCC-A5C7-C19393A3D961}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{62296BC3-29A2-4E43-A5B9-FC5F4AFF9F77}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
25-03-2016 22:43:12 Windows Update
22-05-2016 23:47:21 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/23/2016 11:48:13 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:48:12 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:45:11 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:45:10 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:04:06 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:54 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:53 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:53 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:38:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: aa4
Startzeit: 01d1b5322dd6c3a1
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\system32\wwahost.exe
Berichts-ID: 221e8e6f-2126-11e6-82f4-d681fdd3c146
Vollständiger Name des fehlerhaften Pakets: GJDigitalGmbH.BRIGITTE.deApp_1.1.0.29_neutral__kekzhddbb11ja
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (05/23/2016 10:37:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d98
Startzeit: 01d1b5322de511e4
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\syswow64\backgroundTaskHost.exe
Berichts-ID: 21d24245-2126-11e6-82f4-d681fdd3c146
Vollständiger Name des fehlerhaften Pakets: E046963F.LenovoSupport_1.2.5.0_x86__k1h2ywk1493x8
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Systemfehler:
=============
Error: (05/23/2016 11:46:55 PM) (Source: DCOM) (EventID: 10000) (User: NT-AUTORITÄT)
Description: C:\WINDOWS\system32\PrintIsolationHost.exe -Embedding19{A677570A-2BA2-4E9A-B2E2-8A02CD8B4FD3}
Error: (05/23/2016 11:46:52 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {A677570A-2BA2-4E9A-B2E2-8A02CD8B4FD3}
Error: (05/23/2016 11:46:29 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (05/23/2016 11:44:02 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:02 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:00 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:00 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:18:53 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/23/2016 11:18:38 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/23/2016 10:39:11 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Modules Installer konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Prozentuale Nutzung des RAM: 45%
Installierter physikalischer RAM: 3979.22 MB
Verfügbarer physikalischer RAM: 2184.76 MB
Summe virtueller Speicher: 4683.22 MB
Verfügbarer virtueller Speicher: 2827.06 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.74 GB) (Free:344.75 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.99 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 9E01DD02)
Partition: GPT.
==================== Ende von Addition.txt ============================
FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-05-2016
durchgeführt von Rhea (Administrator) auf MNEMOSYNE (24-05-2016 00:09:06)
Gestartet von C:\Users\Rhea\Downloads
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
() C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(© 2015 Microsoft Corporation) C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
() C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780400 2013-10-28] (Synaptics Incorporated)
HKLM\...\Run: [Yoga PhoneCompanion] => C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe [844304 2014-03-07] (Lenovo)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-03-07] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM-x32\...\Run: [Yoga Picks] => C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe [119824 2013-12-02] (Lenovo)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2457560 2015-03-19] (FileZilla Project)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [2171456 2015-12-17] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23745808 2016-05-07] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-11-15] (Atheros Communications)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [BingSvc] => C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-01-02] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [589312 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 9.6 PE.lnk [2016-05-23]
ShortcutTarget: PHOTOfunSTUDIO 9.6 PE.lnk -> C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2016-05-23]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{47953B4F-4698-4BE4-8629-D04F23915DC9}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{927CA755-A3D5-411C-BDE0-BDE30D80941F}: [DhcpNameServer] 150.201.1.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.shopssl.de;www1.wdr.de
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.msn.com/de-de/?pc=SL5M&ocid=SL5MDHP&osmkt=de-de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> DefaultScope {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {4E2A6A0E-B18C-469F-BC62-EAFB366818A5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {79EE8967-C73E-45F3-9A1A-E79B6BA5E802} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {C6966AB3-7BDE-4182-86B6-DD1910E1B58A} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-25] (Oracle Corporation)
BHO-x32: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-25] (Oracle Corporation)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser//?type=hp&ts=1429294429&from=corna&uid=WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774
about:preferences
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\bing-.xml [2016-01-01]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-images.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-maps.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\heise-netze-spam-listen-abfrage.xml [2016-02-19]
FF Extension: Bing Search - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-01-01]
FF Extension: Adblock Plus - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-03] [ist nicht signiert]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [318592 2013-11-15] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [779736 2015-03-19] (FileZilla Project)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-03-07] (Lenovo)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2013-11-04] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe [285712 2014-03-07] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionVap.exe [304144 2014-03-07] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Samsung Network Fax Server; C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxServer64.exe [801472 2015-03-10] (Samsung Electronics Co., Ltd.)
R2 SamsungUPDUtilSvc; C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe [118576 2014-11-26] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-03-07] (Lenovo)
R2 YogaPicks.AppService; C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe [19440 2013-11-18] ()
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-11-15] (Atheros) [Datei ist nicht signiert]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-11-15] (Qualcomm Atheros)
R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-28] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 rtsuvc; \SystemRoot\system32\DRIVERS\rtsuvc.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-24 00:09 - 2016-05-24 00:10 - 00024409 _____ C:\Users\Rhea\Downloads\FRST.txt
2016-05-23 23:42 - 2016-05-23 23:42 - 00001210 _____ C:\Users\Rhea\Desktop\malwarebytes230516.txt
2016-05-23 23:17 - 2016-05-23 23:17 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-23 23:16 - 2016-05-23 23:45 - 00001123 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-23 23:15 - 2016-05-23 23:15 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64 (1).exe
2016-05-23 23:14 - 2016-05-23 23:14 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64.exe
2016-05-23 23:11 - 2016-05-23 23:15 - 22851472 _____ (Malwarebytes ) C:\Users\Rhea\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-23 00:47 - 2016-03-16 03:58 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-05-23 00:47 - 2016-03-14 18:50 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-05-23 00:47 - 2016-03-12 02:49 - 02466136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-05-23 00:47 - 2016-03-12 02:47 - 00160160 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-12 02:47 - 00121912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-10 18:55 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-05-23 00:47 - 2016-03-10 18:52 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00413696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-05-23 00:47 - 2016-03-05 19:44 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-23 00:47 - 2016-03-05 19:04 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-23 00:47 - 2016-02-27 20:28 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-05-23 00:47 - 2016-02-27 19:57 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 19:19 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 18:32 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-05-23 00:47 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-05-23 00:47 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-05-23 00:47 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-05-23 00:47 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-05-23 00:47 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-05-23 00:47 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-05-23 00:47 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-05-22 23:17 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-22 23:17 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-22 23:17 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-22 23:17 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-22 23:17 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-22 23:17 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-22 23:17 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-05-22 23:17 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-22 23:17 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-05-22 23:16 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-22 23:16 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-22 23:16 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-05-22 23:16 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-22 23:16 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-05-22 23:16 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-05-22 23:16 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-22 23:16 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-05-22 23:16 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-05-22 23:15 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-05-22 23:15 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-05-22 23:15 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-05-22 23:15 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-05-22 23:15 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-22 23:15 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-05-22 23:15 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-22 23:15 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-22 23:15 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-22 23:15 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-05-22 23:15 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-05-22 23:14 - 2016-04-11 08:21 - 00074584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2016-05-22 23:14 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-22 23:14 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-22 23:14 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-05-22 23:14 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-22 23:14 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-22 23:14 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-22 23:14 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-22 23:14 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-22 23:14 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-05-22 23:14 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-05-22 23:14 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-05-22 23:14 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-05-22 23:14 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-22 23:14 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-05-22 16:37 - 2016-05-22 16:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-24 00:09 - 2014-12-17 19:53 - 00000000 ____D C:\FRST
2016-05-23 23:53 - 2014-05-23 02:08 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3879709871-1962586687-2025067079-1001
2016-05-23 23:49 - 2016-03-22 17:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-23 23:49 - 2016-02-17 12:12 - 00000000 ___RD C:\Users\Rhea\Dropbox
2016-05-23 23:47 - 2016-02-17 12:08 - 00001226 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-05-23 23:47 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-23 23:46 - 2013-08-22 15:25 - 01835008 ___SH C:\WINDOWS\system32\config\BBI
2016-05-23 23:45 - 2016-03-08 21:27 - 00001159 _____ C:\Users\Rhea\Desktop\GM5 Bedienungsanleitung.lnk
2016-05-23 23:45 - 2016-02-24 15:44 - 00001376 _____ C:\Users\Rhea\Desktop\todo - Verknüpfung.lnk
2016-05-23 23:45 - 2016-02-16 12:03 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-23 23:45 - 2016-02-14 20:21 - 00001695 _____ C:\Users\Rhea\Desktop\Lärmprotokoll 2 2016 - Verknüpfung.lnk
2016-05-23 23:45 - 2015-10-28 10:32 - 00001418 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-23 23:45 - 2015-09-05 13:14 - 00000982 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-05-23 23:45 - 2014-11-04 22:37 - 00001186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-23 23:45 - 2014-10-07 14:25 - 00001744 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eigene Musik.lnk
2016-05-23 23:45 - 2014-10-05 15:46 - 00000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-05-23 23:45 - 2014-10-05 11:53 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2016-05-23 23:45 - 2014-10-03 14:46 - 00000752 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bilder.lnk
2016-05-23 23:45 - 2014-08-22 22:43 - 00000763 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2016-05-23 23:45 - 2014-07-30 23:35 - 00001364 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RouteConverterWindows.lnk
2016-05-23 23:45 - 2014-06-26 11:49 - 00002125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-23 23:45 - 2014-05-23 02:03 - 00001465 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-23 23:45 - 2014-03-07 00:06 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartVoiceToast.lnk
2016-05-23 23:45 - 2014-03-06 23:55 - 00002007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-05-23 23:44 - 2013-08-22 17:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2016-05-23 23:13 - 2016-02-17 12:08 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-05-23 23:10 - 2014-03-07 07:41 - 00767130 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-23 23:10 - 2014-03-07 07:41 - 00160216 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-23 23:10 - 2013-10-07 20:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-23 23:10 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-05-23 15:20 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-23 14:01 - 2013-08-22 16:44 - 00371640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-23 13:53 - 2013-08-22 21:12 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-23 09:42 - 2014-06-13 00:55 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-23 09:42 - 2014-06-13 00:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-23 09:28 - 2014-05-23 02:03 - 00000000 ____D C:\Users\Rhea
2016-05-23 00:18 - 2016-02-16 12:04 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-23 00:03 - 2014-12-16 18:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-22 22:53 - 2016-01-13 00:57 - 00177488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-05-22 16:48 - 2016-03-23 19:48 - 19942080 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-05-22 16:48 - 2016-03-22 17:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-22 16:37 - 2016-02-17 12:08 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-05-22 16:32 - 2016-02-17 12:08 - 00000000 ____D C:\Users\Rhea\AppData\Local\Dropbox
2016-05-11 22:08 - 2015-03-11 23:30 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 22:08 - 2015-03-11 23:30 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-11-27 00:53 - 2005-11-27 00:53 - 0049152 _____ ( ) C:\Program Files\Interop.WIA.dll
2013-08-25 18:57 - 2013-08-25 18:57 - 0001968 _____ () C:\Program Files\License.txt
2014-07-22 15:14 - 2014-07-22 15:14 - 0828992 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Base.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 3087872 _____ () C:\Program Files\PaintDotNet.Base.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0562752 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Core.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1826304 _____ () C:\Program Files\PaintDotNet.Core.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0090688 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Data.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0265728 _____ () C:\Program Files\PaintDotNet.Data.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0195648 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Effects.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0495104 _____ () C:\Program Files\PaintDotNet.Effects.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 1766976 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.exe
2014-06-27 14:41 - 2014-06-27 14:41 - 0000429 _____ () C:\Program Files\PaintDotNet.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0337472 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Framework.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1019392 _____ () C:\Program Files\PaintDotNet.Framework.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 4711936 _____ () C:\Program Files\PaintDotNet.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0416832 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Resources.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0050688 _____ () C:\Program Files\PaintDotNet.Resources.pdb
2014-06-23 11:10 - 2014-06-23 11:10 - 0145066 ____R () C:\Program Files\PaintDotNet.Strings.3.cs.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0141037 ____R () C:\Program Files\PaintDotNet.Strings.3.da.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0147174 ____R () C:\Program Files\PaintDotNet.Strings.3.DE.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0146230 ____R () C:\Program Files\PaintDotNet.Strings.3.ES.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0158177 ____R () C:\Program Files\PaintDotNet.Strings.3.fa.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0140166 ____R () C:\Program Files\PaintDotNet.Strings.3.fi.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148878 ____R () C:\Program Files\PaintDotNet.Strings.3.FR.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0188674 ____R () C:\Program Files\PaintDotNet.Strings.3.hi.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0145645 ____R () C:\Program Files\PaintDotNet.Strings.3.hu.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0144519 ____R () C:\Program Files\PaintDotNet.Strings.3.it.resources
2014-06-20 16:13 - 2014-06-20 16:13 - 0155356 ____R () C:\Program Files\PaintDotNet.Strings.3.JA.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148596 ____R () C:\Program Files\PaintDotNet.Strings.3.KO.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0147437 ____R () C:\Program Files\PaintDotNet.Strings.3.lt.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0142834 ____R () C:\Program Files\PaintDotNet.Strings.3.nl.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0143720 ____R () C:\Program Files\PaintDotNet.Strings.3.pl.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0145666 ____R () C:\Program Files\PaintDotNet.Strings.3.PT-BR.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0145325 ____R () C:\Program Files\PaintDotNet.Strings.3.pt-PT.resources
2014-06-03 13:56 - 2014-06-03 13:56 - 0138840 ____R () C:\Program Files\PaintDotNet.Strings.3.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0171796 ____R () C:\Program Files\PaintDotNet.Strings.3.RU.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0135198 ____R () C:\Program Files\PaintDotNet.Strings.3.ZH-CN.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0137582 ____R () C:\Program Files\PaintDotNet.Strings.3.zh-TW.resources
2014-07-22 15:14 - 2014-07-22 15:14 - 0563264 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.SystemLayer.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1058368 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0968256 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0767488 _____ () C:\Program Files\PaintDotNet.SystemLayer.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0014400 _____ (dotPDN LLC) C:\Program Files\PdnRepair.exe
2014-06-27 15:37 - 2014-06-27 15:37 - 0000235 _____ () C:\Program Files\PdnRepair.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\PdnRepair.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0030784 _____ (dotPDN LLC) C:\Program Files\SetupNgen.exe
2010-04-21 00:57 - 2010-04-21 00:57 - 0000254 _____ () C:\Program Files\SetupNgen.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0030208 _____ () C:\Program Files\SetupNgen.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0026688 _____ () C:\Program Files\ShellExtension_x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0023616 _____ () C:\Program Files\ShellExtension_x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0015936 _____ (dotPDN LLC) C:\Program Files\UpdateMonitor.exe
2014-06-28 10:29 - 2014-06-28 10:29 - 0000235 _____ () C:\Program Files\UpdateMonitor.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\UpdateMonitor.pdb
2015-01-28 15:00 - 2015-01-28 15:00 - 0003893 _____ () C:\Users\Rhea\AppData\Local\recently-used.xbel
2014-03-06 23:26 - 2014-03-06 23:26 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-23 01:31
==================== Ende von FRST.txt ============================
Code:
ATTFilter [i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Management Console
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Media Player
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Paint
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Wordpad
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows.OpenWith
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows Explorer
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Cookie
[+] 16-05-23 09:15:08 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:08 Moving into quarantine Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:08 Moving into quarantine Thunderbird (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Thunderbird (PE_C_PUBLIC (default))Cookies
[i] 16-05-23 09:15:09
[i] 16-05-23 09:15:09 Product Cache
[+] 16-05-23 09:15:09 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cache
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cache
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Management Console
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Media Player
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Paint
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Wordpad
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows.OpenWith
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows Explorer
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Cookie
[+] 16-05-23 09:15:13 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:13 Moving into quarantine Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Moving into quarantine Thunderbird (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Thunderbird (PE_C_PUBLIC (default))Cookies
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Cache
[+] 16-05-23 09:15:13 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cache
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cache
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Summary
[i] 16-05-23 09:15:13 Errors while cleaning 0
[i] 16-05-23 09:15:13 Files moved into quarantine 13
[i] 16-05-23 09:15:13 Files successfully cleaned 13
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Summary
[i] 16-05-23 09:15:13 Errors while cleaning 0
[i] 16-05-23 09:15:13 Files moved into quarantine 13
[i] 16-05-23 09:15:13 Files successfully cleaned 13
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 23.05.2016 Suchlaufzeit: 23:18 Protokolldatei: malwarebytes230516.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2016.05.23.06 Rootkit-Datenbank: v2016.05.20.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Rhea Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 294149 Abgelaufene Zeit: 21 Min., 41 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Geändert von mamaimapril (27.05.2016 um 18:15 Uhr) |
|
27.05.2016, 22:08
| #2 | |
| /// TB-Ausbilder   | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter. Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3
Bitte poste mit deiner nächsten Antwort
|
|
28.05.2016, 00:20
| #3 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Hallo, Matthias,
__________________schön, dass Du Dir Zeit nimmst.  Hier die Dateien: Code:
ATTFilter # AdwCleaner v5.118 - Bericht erstellt am 28/05/2016 um 00:54:27
# Aktualisiert am 23/05/2016 von Xplode
# Datenbank : 2016-05-26.2 [Server]
# Betriebssystem : Windows 8.1 (X64)
# Benutzername : Rhea - MNEMOSYNE
# Gestartet von : C:\Users\Rhea\Desktop\adwcleaner_5.118.exe
# Option : Suchlauf
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
Ordner gefunden : C:\StormAlert
Ordner gefunden : C:\Users\Rhea\AppData\Local\StartPoint
Ordner gefunden : C:\Users\Rhea\AppData\Local\StormAlert
***** [ Dateien ] *****
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel gefunden : HKCU\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
Schlüssel gefunden : HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel gefunden : HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
Schlüssel gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Wert gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
***** [ Internetbrowser ] *****
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.alias", "do-search");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.iconURL", "hxxp://do-search.com/favicon.ico");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.ptid", "corna");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.uid", "WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("extensions.quick_start.enable_search1", false);
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
C:\AdwCleaner\AdwCleaner[R0].txt - [2161 Bytes] - [17/12/2014 17:39:20]
C:\AdwCleaner\AdwCleaner[R1].txt - [2221 Bytes] - [17/12/2014 23:25:02]
C:\AdwCleaner\AdwCleaner[R2].txt - [1535 Bytes] - [18/12/2014 15:12:15]
C:\AdwCleaner\AdwCleaner[R3].txt - [1029 Bytes] - [19/12/2014 00:56:59]
C:\AdwCleaner\AdwCleaner[R4].txt - [1117 Bytes] - [19/12/2014 01:09:48]
C:\AdwCleaner\AdwCleaner[S0].txt - [2249 Bytes] - [17/12/2014 23:35:11]
C:\AdwCleaner\AdwCleaner[S1].txt - [4533 Bytes] - [19/12/2014 01:02:07]
C:\AdwCleaner\AdwCleaner[S2].txt - [3366 Bytes] - [28/05/2016 00:54:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [3439 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 8.1 x64
Ran by Rhea (Administrator) on 28.05.2016 at 1:04:57,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 3
Successfully deleted: C:\ProgramData\fb133a470b78426fb88c5382644f7185 (Folder)
Successfully deleted: C:\Users\Rhea\AppData\Local\startpoint (Folder)
Successfully deleted: C:\WINDOWS\wininit.ini (File)
Deleted the following from C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js
user_pref(browser.search.searchengine.alias, do-search);
user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.iconURL, hxxp://do-search.com/favicon.ico);
user_pref(browser.search.searchengine.ptid, corna);
user_pref(browser.search.searchengine.uid, WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774);
user_pref(extensions.quick_start.enable_search1, false);
user_pref(extensions.quick_start.sd.closeWindowWithLastTab_prev_state, false);
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.05.2016 at 1:06:55,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-05-2016
durchgeführt von Rhea (2016-05-28 01:27:38)
Gestartet von C:\Users\Rhea\Desktop
Windows 8.1 (Update) (X64) (2014-05-23 00:02:59)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3879709871-1962586687-2025067079-500 - Administrator - Disabled)
Gast (S-1-5-21-3879709871-1962586687-2025067079-501 - Limited - Disabled)
Rhea (S-1-5-21-3879709871-1962586687-2025067079-1001 - Administrator - Enabled) => C:\Users\Rhea
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.35 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0935-000001000000}) (Version: 9.35.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.7.0 - Conexant)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.33 - Lenovo)
Energy Manager (x32 Version: 1.0.0.33 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.50 - FileZilla Project)
Garmin BaseCamp (HKLM-x32\...\{B0BED0BB-E1C4-49AA-840F-7CA052ADF5EB}) (Version: 4.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GMX MailCheck (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.6.1 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 4.0.1.0 - 1&1 Mail & Media GmbH)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{E7E2BEA6-ECCE-4306-9486-A08781BE0AD0}) (Version: 2.0.0.1104 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.0.1104 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.0.13.12271 - Lenovo)
Lenovo Yoga PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.1.9.5 - Lenovo)
Lenovo Yoga PhoneCompanion (x32 Version: 1.1.9.5 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Mozilla Thunderbird 38.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.6.0 (x86 de)) (Version: 38.6.0 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PHOTOfunSTUDIO 9.6 PE (HKLM-x32\...\{7113ACE0-A2FA-463B-969A-E3FD7BF42573}) (Version: 9.06.710.1031 - Panasonic Corporation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.310 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.4.7 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.60 (17.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.81.00(25.05.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series (HKLM-x32\...\Samsung M2070 Series) (Version: 1.22 (07.09.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series XPS (Windows 8) (HKLM-x32\...\Samsung M2070 Series XPS (Windows 8)) (Version: 3.03.08.00:05 - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.11.28 (10.03.2015) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.01.12 (15.10.2014) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Assistant (HKLM-x32\...\Samsung Scan Assistant) (Version: 1.05.07 (20.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.25 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.06.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SILKYPIX Developer Studio 4.2 SE (HKLM-x32\...\InstallShield_{8B9D37A0-F77B-41DD-932A-CE01DEC1ADAA}) (Version: 4 - Ichikawa Soft Laboratory)
SILKYPIX Developer Studio 4.2 SE (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.6 - Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
Yoga Picks (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.013.1202 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {48F86BC9-1A37-4268-8DC9-4B902CAEC945} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {4D1C6EFB-FADF-4188-9DAE-072F214E05B7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-22] (Adobe Systems Incorporated)
Task: {721CA287-0ACF-41C2-A15A-35A9A2785A33} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {7520915A-6376-4F3A-9F78-6895858C2E24} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {80EFEDA3-E3E4-451A-81B7-A19891B23FDA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {CFE11131-73E0-419A-BE2D-C3A87FC84D8F} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-10-08] (1&1 Mail & Media GmbH)
Task: {D8C74952-C759-495C-BAED-612B80646889} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {F69EE45E-80DB-40F7-B912-B46E9C2F1791} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11517530520.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd10c1016 -pinnedTimeHigh 0x01d0d295 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/ende/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11689991990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd3990412 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000056 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/82/bebalanced-k%C3%B6rper
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12072113890.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0327686a -pinnedTimeHigh 0x01d0f4b0 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000017 hxxp://www.clipfish.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12425247930.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xf60c1a3b -pinnedTimeHigh 0x01cfbe56 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/frde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13304856320.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0de30816 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://www.unwetterzentrale.de/uwz/temperatur.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13506273490.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x245d8140 -pinnedTimeHigh 0x01d0fb60 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001e hxxp://woerterbuchnetz.de/DWB/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-14704389310.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x709605fc -pinnedTimeHigh 0x01d07bb4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000029 hxxp://localhost/joomla341/administrator/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-15829586810.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x8dac8991 -pinnedTimeHigh 0x01d0f876 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000015 hxxp://www.amazon.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-16228374220.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xdd5a7938 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000050 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/83/bebalanced-geist
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-17714738290.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa06bf05f -pinnedTimeHigh 0x01cfbdf1 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000001e hxxp://www.gpsies.com/login.do
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-18349738120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x012fa14d -pinnedTimeHigh 0x01d06bbc -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000042 hxxp://www.niederschlagsradar.de/niederschlagsprognose.aspx?type=1
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1856752590.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x9e55eab1 -pinnedTimeHigh 0x01d06bcf -securityFlags 0x00000000 -tileType 0x00000002 -url 0x0000001a hxxp://www.codecheck.info/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1930419650.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x16618286 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000011 hxxp://fritz.box/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20172485120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x1a75fa60 -pinnedTimeHigh 0x01cfbc92 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://www.bahn.de/p/view/index.shtml
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20504568990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xebcbbc70 -pinnedTimeHigh 0x01cfbc91 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000003b hxxp://www.boeser-wolf.schule.de/concours/2014/accueil.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-5511536870.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa5d41f09 -pinnedTimeHigh 0x01d138b2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/esde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-6764561640.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xc0dd7b7c -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000051 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/80/bebalanced-basics
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\13362524720.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfdbd1b9c -pinnedTimeHigh 0x01cfc2d2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://wetterstationen.meteomedia.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\14722268070.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0374d018 -pinnedTimeHigh 0x01d138f7 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000026 hxxp://www.duden.de/schwierige-woerter
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16003941200.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x029e0744 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000017 hxxp://www.sat24.com/eu
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16371692260.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x6ede0d80 -pinnedTimeHigh 0x01d12204 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000013 hxxp://www.faz.net/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19320121740.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x4f006974 -pinnedTimeHigh 0x01d0d42f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000028 hxxps://www.aerzte-finanz.de/praxispilot
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19571323130.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x08753f27 -pinnedTimeHigh 0x01d0b0b6 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000002d hxxp://online.rote-liste.de/suche/ferro-sanol
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19858872700.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe480d8c3 -pinnedTimeHigh 0x01d06bc9 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003c hxxp://www.hautschutzengel.de/bedenkliche-inhaltsstoffe.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\21415739090.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe924f5b3 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000059 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/84/bebalanced-sch%C3%B6nheit
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\330252100.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x40fe2528 -pinnedTimeHigh 0x01d07ba4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://localhost/joomla341/administrator/index.php
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4300483340.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xcc6d0835 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000053 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/81/bebalanced-workouts
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4699799270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x2a286297 -pinnedTimeHigh 0x01cfe086 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000041 hxxp://fahrplanauskunft.vrn.de/vrn/XSLT_TRIP_REQUEST2?language=de
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4736959030.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x693ce4b5 -pinnedTimeHigh 0x01d06bc1 -securityFlags 0x00000000 -tileType 0x00000003 -url 0x000000a5 hxxp://scholar.google.com/scholar?hl=en&q=%22101-86-0%22+OR+%22hexyl+cinnamaldehyde%22+OR+%2
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\6473758050.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xff1fdcd2 -pinnedTimeHigh 0x01cfe091 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000044 hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8167997760.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfb848207 -pinnedTimeHigh 0x01d0fea8 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001c hxxp://www.dirksbiokiste.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8302254560.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfce9884c -pinnedTimeHigh 0x01d0fb5f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001b hxxp://dwb.uni-trier.de/de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8511463020.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe44b0b80 -pinnedTimeHigh 0x01d12ea3 -securityFlags 0x00000000 -tileType 0x00000002 -url 0x00000041 hxxps://www.efiliale.de/efiliale/internetmarke/productDetails.jsp
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\System32\ssm4mlm.dll
2015-05-22 19:34 - 2014-04-16 10:22 - 00029184 _____ () C:\WINDOWS\System32\usp02l.dll
2014-03-07 00:05 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N () C:\WINDOWS\SysWOW64\spdsvc.exe
2015-05-22 19:34 - 2014-11-26 13:07 - 00118576 _____ () C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00062224 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-03-07 00:00 - 2013-11-18 17:40 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-05-22 19:34 - 2013-10-04 06:53 - 00734720 _____ () C:\WINDOWS\system32\SnMinDrv.dll
2015-05-22 18:05 - 2015-06-10 08:18 - 00087552 ____N () C:\WINDOWS\system32\SSDEVM64.DLL
2014-03-07 00:06 - 2014-03-07 00:06 - 00815104 _____ () C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
2014-12-02 13:52 - 2015-06-11 15:58 - 01604096 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\ssm4mdu.dll
2015-10-28 10:32 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-28 10:32 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-28 10:32 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-04-22 13:00 - 2014-04-22 13:00 - 00988160 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxml2.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-03-22 19:06 - 00450771 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rhea\Pictures\dendrobium.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A1565219-9C4A-477E-B087-633B3F01E71E}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{27C039CA-A127-4E1D-B1D3-CFEB670B44C4}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{52CA7F06-4BB9-4795-8066-9B58632D957C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{A68DF61A-3CEB-457C-A455-E979D0DFD9D9}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{3BA7C7BB-201C-4578-8032-226B84A5187E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{D77998D3-8628-4C19-B4A4-AF6FD6322E17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{53831517-DB8D-477E-A9BA-0C3A6D4F67AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1061C061-F384-43B0-A0D9-6DDF4EE6503F}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{7D299E78-91AB-4FFE-A9D0-96D0355417B2}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{1AF7B847-EFE8-41FB-8695-62F373AFC563}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{68C4E61F-D08F-4ECF-BDF9-34E20341F5B6}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{B954C488-1AA4-4941-8C2B-67D5286A963E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{E1072E6A-6360-495F-926E-F632C4A9689B}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{2F8C4FC1-9C82-4726-8649-49E2C93B9D8E}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{AF6153E9-14EE-4199-BED9-3D14AB492CF1}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{D4FA5DEE-C506-4A04-935D-390F5C6079FB}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{F1A3B9EF-D5FB-4574-9BEB-96ECBB0D684B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{D921552C-CE68-403D-9DBE-CAC966A95EE2}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon64.exe
FirewallRules: [{4EA57459-AD30-41FA-9486-39ECF62DD501}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon.exe
FirewallRules: [{CA400C7C-FCAD-4924-A278-73C732755889}] => (Allow) C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxMon64.exe
FirewallRules: [{0DB4AB93-0BF1-452D-B832-A710ACAE9614}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{0A36E50D-B3B9-4F9E-89E2-F7D348BB11A2}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{B01021EE-1A36-4775-B364-BBFD21F779CC}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [{6AE25776-262D-4156-A3AD-06CEFDE05C0E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{E1687298-987D-4B20-9A26-B60751527F08}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{ED9943F9-DE46-46E9-925F-100E5091517E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{8A2BA25A-496F-4DCC-A5C7-C19393A3D961}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{62296BC3-29A2-4E43-A5B9-FC5F4AFF9F77}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{AA356EF1-DC9A-4E7C-9867-11E0FD6ADEA3}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{92F8AF9C-8320-4DA0-9BD8-8385FCE371E0}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{ACDC45D2-E539-4A5C-88F5-D552A85E4715}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{5101E3CE-13FC-48A1-B5C4-7AEFDA6EE3B9}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{C4AADB98-8170-4343-BE13-431B9916C69F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{FADE533B-82AD-4F77-BE3C-8EFC1FCF83BE}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{90066ABE-2A39-4368-906B-678D875AC021}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{B325C3E0-A133-4252-8525-E421CB05311C}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{4D6BB0B0-11D9-45EB-BFF1-83D9D0931CEE}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
25-03-2016 22:43:12 Windows Update
22-05-2016 23:47:21 Windows Update
26-05-2016 21:34:56 Windows Update
28-05-2016 01:05:01 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/28/2016 01:36:56 AM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/28/2016 01:31:30 AM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:25:13 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:24:26 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:22:25 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:14:45 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:05:39 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 08:43:34 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 08:31:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1d94
Startzeit: 01d1b845ef463274
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\system32\backgroundTaskHost.exe
Berichts-ID: 33054ee8-2439-11e6-82fa-afc2c2513d9f
Vollständiger Name des fehlerhaften Pakets: Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexSports
Error: (05/27/2016 08:31:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Mnemosyne)
Description: Bei der Aktivierung der App „Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (05/27/2016 10:05:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SensrSvc erreicht.
Error: (05/27/2016 07:21:48 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2016 07:21:18 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2016 09:48:18 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Error: (05/27/2016 09:42:17 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Error: (05/25/2016 07:26:22 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "Samsung Printer Dianostics Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/25/2016 06:29:48 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/25/2016 06:29:32 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/24/2016 04:24:54 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB2976978)
Error: (05/24/2016 04:24:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3035583)
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Prozentuale Nutzung des RAM: 51%
Installierter physikalischer RAM: 3979.22 MB
Verfügbarer physikalischer RAM: 1936.52 MB
Summe virtueller Speicher: 4683.22 MB
Verfügbarer virtueller Speicher: 2592.03 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.74 GB) (Free:343.25 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.99 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 9E01DD02)
Partition: GPT.
==================== Ende von Addition.txt ============================
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-05-2016
durchgeführt von Rhea (Administrator) auf MNEMOSYNE (28-05-2016 01:23:57)
Gestartet von C:\Users\Rhea\Desktop
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
() C:\Windows\SysWOW64\spdsvc.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
() C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
() C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_242.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_242.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780400 2013-10-28] (Synaptics Incorporated)
HKLM\...\Run: [Yoga PhoneCompanion] => C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe [844304 2014-03-07] (Lenovo)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-03-07] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM-x32\...\Run: [Yoga Picks] => C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe [119824 2013-12-02] (Lenovo)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2457560 2015-03-19] (FileZilla Project)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [2171456 2015-12-17] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23745808 2016-05-07] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-11-15] (Atheros Communications)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [BingSvc] => C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-01-02] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [EEDSpeedLauncher] => rundll32.exe C:\WINDOWS\system32\eed_ec.dll,SpeedLauncher
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [RESTART_STICKY_NOTES] => C:\WINDOWS\system32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [589312 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 9.6 PE.lnk [2016-05-23]
ShortcutTarget: PHOTOfunSTUDIO 9.6 PE.lnk -> C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2016-05-23]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{47953B4F-4698-4BE4-8629-D04F23915DC9}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{927CA755-A3D5-411C-BDE0-BDE30D80941F}: [DhcpNameServer] 150.201.1.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.shopssl.de;www1.wdr.de
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.msn.com/de-de/?pc=SL5M&ocid=SL5MDHP&osmkt=de-de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> DefaultScope {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {4E2A6A0E-B18C-469F-BC62-EAFB366818A5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {79EE8967-C73E-45F3-9A1A-E79B6BA5E802} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {C6966AB3-7BDE-4182-86B6-DD1910E1B58A} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-25] (Oracle Corporation)
BHO-x32: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-25] (Oracle Corporation)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser//?type=hp&ts=1429294429&from=corna&uid=WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774
about:preferences
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\bing-.xml [2016-01-01]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-images.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-maps.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\heise-netze-spam-listen-abfrage.xml [2016-02-19]
FF Extension: Bing Search - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-01-01]
FF Extension: Adblock Plus - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-24]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [318592 2013-11-15] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [779736 2015-03-19] (FileZilla Project)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-03-07] (Lenovo)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2013-11-04] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe [285712 2014-03-07] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionVap.exe [304144 2014-03-07] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Samsung Network Fax Server; C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxServer64.exe [801472 2015-03-10] (Samsung Electronics Co., Ltd.)
R2 Samsung Printer Dianostics Service; C:\WINDOWS\SysWOW64\\spdsvc.exe [498488 2016-05-01] ()
R2 SamsungUPDUtilSvc; C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe [118576 2014-11-26] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-03-07] (Lenovo)
R2 YogaPicks.AppService; C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe [19440 2013-11-18] ()
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-11-15] (Atheros) [Datei ist nicht signiert]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-11-15] (Qualcomm Atheros)
R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-28] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 rtsuvc; \SystemRoot\system32\DRIVERS\rtsuvc.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-28 01:23 - 2016-05-28 01:25 - 00023743 _____ C:\Users\Rhea\Desktop\FRST.txt
2016-05-28 01:06 - 2016-05-28 01:06 - 00001367 _____ C:\Users\Rhea\Desktop\JRT.txt
2016-05-28 00:38 - 2016-05-28 00:38 - 03678272 _____ C:\Users\Rhea\Desktop\adwcleaner_5.118.exe
2016-05-28 00:35 - 2016-05-28 00:35 - 01610816 _____ (Malwarebytes) C:\Users\Rhea\Desktop\JRT.exe
2016-05-27 18:08 - 2016-05-27 18:08 - 00000000 ____D C:\Users\Rhea\Documents\ProcAlyzer Dumps
2016-05-25 19:26 - 2016-05-25 19:25 - 02078208 ____N C:\WINDOWS\SysWOW64\DlgSearchEngine.dll
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N C:\WINDOWS\SysWOW64\spdsvc.exe
2016-05-25 19:26 - 2015-12-04 10:03 - 00017831 ____N C:\WINDOWS\SysWOW64\spddata.xml
2016-05-25 19:24 - 2016-05-25 19:24 - 00000000 ____D C:\Program Files\Common Files\Common Desktop Agent
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\system32\ssm4mlm.dll
2016-05-25 19:09 - 2016-05-25 19:09 - 04357416 _____ C:\Users\Rhea\Downloads\SamsungPrinterInstaller.exe
2016-05-24 20:32 - 2016-05-25 20:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-05-24 15:07 - 2016-05-24 15:07 - 00130612 _____ C:\Users\Rhea\Desktop\Abholcoupon_fuer_Koffer_zur_Geburt.pdf
2016-05-24 00:11 - 2016-05-24 00:17 - 00059771 _____ C:\Users\Rhea\Downloads\Addition.txt
2016-05-24 00:09 - 2016-05-24 00:17 - 00048791 _____ C:\Users\Rhea\Downloads\FRST.txt
2016-05-23 23:42 - 2016-05-23 23:42 - 00001210 _____ C:\Users\Rhea\Desktop\malwarebytes230516.txt
2016-05-23 23:17 - 2016-05-25 18:29 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-23 23:16 - 2016-05-23 23:45 - 00001123 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-23 23:15 - 2016-05-23 23:15 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64 (1).exe
2016-05-23 23:14 - 2016-05-23 23:14 - 02383360 _____ (Farbar) C:\Users\Rhea\Desktop\FRST64.exe
2016-05-23 23:11 - 2016-05-23 23:15 - 22851472 _____ (Malwarebytes ) C:\Users\Rhea\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-23 00:48 - 2016-04-04 08:35 - 00046768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-23 00:48 - 2016-04-02 15:26 - 01386496 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-23 00:48 - 2016-04-02 15:26 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-05-23 00:48 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-05-23 00:48 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-23 00:48 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2016-05-23 00:48 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2016-05-23 00:48 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2016-05-23 00:48 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2016-05-23 00:48 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2016-05-23 00:48 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2016-05-23 00:48 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
2016-05-23 00:48 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-05-23 00:48 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-05-23 00:48 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-05-23 00:47 - 2016-03-14 18:50 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-05-23 00:47 - 2016-03-12 02:49 - 02466136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-05-23 00:47 - 2016-03-12 02:47 - 00160160 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-12 02:47 - 00121912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-10 21:17 - 01133752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:48 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:43 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-05-23 00:47 - 2016-03-10 19:03 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-05-23 00:47 - 2016-03-10 18:52 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-05-23 00:47 - 2016-03-10 18:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00413696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-05-23 00:47 - 2016-03-05 19:44 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-23 00:47 - 2016-03-05 19:04 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-23 00:47 - 2016-02-27 20:28 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-05-23 00:47 - 2016-02-27 19:57 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 19:19 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 18:32 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-05-23 00:47 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-05-23 00:47 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-05-23 00:47 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-05-23 00:47 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-05-23 00:47 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-05-23 00:47 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-05-23 00:47 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-05-23 00:47 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2016-05-23 00:47 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-23 00:47 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-05-23 00:47 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-05-23 00:47 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-05-23 00:47 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-05-23 00:47 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-05-23 00:47 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-05-23 00:47 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-05-23 00:47 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe
2016-05-23 00:47 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2016-05-23 00:47 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2016-05-23 00:47 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2016-05-23 00:47 - 2016-01-21 00:40 - 00099672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys
2016-05-23 00:47 - 2014-11-08 04:38 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-23 00:47 - 2014-11-08 04:17 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2016-05-23 00:46 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys
2016-05-22 23:17 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-22 23:17 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-22 23:17 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-22 23:17 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-22 23:17 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-22 23:17 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-22 23:17 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-05-22 23:17 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-22 23:17 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-05-22 23:16 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-22 23:16 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-22 23:16 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-05-22 23:16 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-22 23:16 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-05-22 23:16 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-05-22 23:16 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-22 23:16 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-05-22 23:16 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-05-22 23:15 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-05-22 23:15 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-05-22 23:15 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-05-22 23:15 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-05-22 23:15 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-22 23:15 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-05-22 23:15 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-22 23:15 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-22 23:15 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-22 23:15 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-05-22 23:15 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-05-22 23:14 - 2016-04-11 08:21 - 00074584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2016-05-22 23:14 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-22 23:14 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-22 23:14 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-05-22 23:14 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-22 23:14 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-22 23:14 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-22 23:14 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-22 23:14 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-22 23:14 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-05-22 23:14 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-05-22 23:14 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-05-22 23:14 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-05-22 23:14 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-22 23:14 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-05-22 16:37 - 2016-05-22 16:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-28 01:23 - 2014-12-17 19:53 - 00000000 ____D C:\FRST
2016-05-28 01:18 - 2014-12-17 17:39 - 00000000 ____D C:\AdwCleaner
2016-05-28 01:13 - 2016-02-17 12:08 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-05-28 00:48 - 2016-03-22 17:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-27 20:33 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-05-27 18:14 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-27 11:13 - 2016-02-17 12:08 - 00001226 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-05-27 11:05 - 2016-02-17 12:12 - 00000000 ___RD C:\Users\Rhea\Dropbox
2016-05-27 11:02 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-27 11:01 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-05-27 11:01 - 2013-08-22 15:25 - 01835008 ___SH C:\WINDOWS\system32\config\BBI
2016-05-27 10:58 - 2015-04-15 13:33 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-05-25 22:42 - 2015-08-30 00:10 - 00000000 ____D C:\Users\Rhea\AppData\Local\WEB2Print
2016-05-25 21:39 - 2014-05-23 00:25 - 00000000 ____D C:\Users\Rhea\AppData\Local\CrashDumps
2016-05-25 20:02 - 2014-06-26 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-25 19:44 - 2014-05-23 02:08 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3879709871-1962586687-2025067079-1001
2016-05-25 19:26 - 2015-05-22 18:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2016-05-25 19:24 - 2015-05-22 17:02 - 00000000 ____D C:\ProgramData\Samsung
2016-05-25 19:23 - 2015-05-22 17:02 - 00000000 ____D C:\Program Files (x86)\SamsungPrinterLiveUpdateInstaller
2016-05-25 18:20 - 2014-03-07 07:41 - 00767130 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-25 18:20 - 2014-03-07 07:41 - 00160216 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-25 18:20 - 2013-10-07 20:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-25 17:30 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-05-23 23:45 - 2016-03-08 21:27 - 00001159 _____ C:\Users\Rhea\Desktop\GM5 Bedienungsanleitung.lnk
2016-05-23 23:45 - 2016-02-24 15:44 - 00001376 _____ C:\Users\Rhea\Desktop\todo - Verknüpfung.lnk
2016-05-23 23:45 - 2016-02-16 12:03 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-23 23:45 - 2016-02-14 20:21 - 00001695 _____ C:\Users\Rhea\Desktop\Lärmprotokoll 2 2016 - Verknüpfung.lnk
2016-05-23 23:45 - 2015-10-28 10:32 - 00001418 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-23 23:45 - 2015-09-05 13:14 - 00000982 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-05-23 23:45 - 2014-11-04 22:37 - 00001186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-23 23:45 - 2014-10-07 14:25 - 00001744 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eigene Musik.lnk
2016-05-23 23:45 - 2014-10-05 15:46 - 00000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-05-23 23:45 - 2014-10-05 11:53 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2016-05-23 23:45 - 2014-10-03 14:46 - 00000752 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bilder.lnk
2016-05-23 23:45 - 2014-08-22 22:43 - 00000763 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2016-05-23 23:45 - 2014-07-30 23:35 - 00001364 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RouteConverterWindows.lnk
2016-05-23 23:45 - 2014-06-26 11:49 - 00002125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-23 23:45 - 2014-05-23 02:03 - 00001465 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-23 23:45 - 2014-03-07 00:06 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartVoiceToast.lnk
2016-05-23 23:45 - 2014-03-06 23:55 - 00002007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-05-23 23:44 - 2013-08-22 17:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2016-05-23 14:01 - 2013-08-22 16:44 - 00371640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-23 13:53 - 2013-08-22 21:12 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-23 09:42 - 2014-06-13 00:55 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-23 09:42 - 2014-06-13 00:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-23 09:28 - 2014-05-23 02:03 - 00000000 ____D C:\Users\Rhea
2016-05-23 00:18 - 2016-02-16 12:04 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-23 00:03 - 2014-12-16 18:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-22 22:53 - 2016-01-13 00:57 - 00177488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-05-22 16:48 - 2016-03-23 19:48 - 19942080 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-05-22 16:48 - 2016-03-22 17:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-22 16:37 - 2016-02-17 12:08 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-05-22 16:32 - 2016-02-17 12:08 - 00000000 ____D C:\Users\Rhea\AppData\Local\Dropbox
2016-05-11 22:08 - 2015-03-11 23:30 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 22:08 - 2015-03-11 23:30 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-11-27 00:53 - 2005-11-27 00:53 - 0049152 _____ ( ) C:\Program Files\Interop.WIA.dll
2013-08-25 18:57 - 2013-08-25 18:57 - 0001968 _____ () C:\Program Files\License.txt
2014-07-22 15:14 - 2014-07-22 15:14 - 0828992 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Base.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 3087872 _____ () C:\Program Files\PaintDotNet.Base.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0562752 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Core.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1826304 _____ () C:\Program Files\PaintDotNet.Core.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0090688 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Data.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0265728 _____ () C:\Program Files\PaintDotNet.Data.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0195648 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Effects.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0495104 _____ () C:\Program Files\PaintDotNet.Effects.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 1766976 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.exe
2014-06-27 14:41 - 2014-06-27 14:41 - 0000429 _____ () C:\Program Files\PaintDotNet.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0337472 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Framework.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1019392 _____ () C:\Program Files\PaintDotNet.Framework.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 4711936 _____ () C:\Program Files\PaintDotNet.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0416832 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Resources.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0050688 _____ () C:\Program Files\PaintDotNet.Resources.pdb
2014-06-23 11:10 - 2014-06-23 11:10 - 0145066 ____R () C:\Program Files\PaintDotNet.Strings.3.cs.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0141037 ____R () C:\Program Files\PaintDotNet.Strings.3.da.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0147174 ____R () C:\Program Files\PaintDotNet.Strings.3.DE.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0146230 ____R () C:\Program Files\PaintDotNet.Strings.3.ES.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0158177 ____R () C:\Program Files\PaintDotNet.Strings.3.fa.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0140166 ____R () C:\Program Files\PaintDotNet.Strings.3.fi.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148878 ____R () C:\Program Files\PaintDotNet.Strings.3.FR.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0188674 ____R () C:\Program Files\PaintDotNet.Strings.3.hi.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0145645 ____R () C:\Program Files\PaintDotNet.Strings.3.hu.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0144519 ____R () C:\Program Files\PaintDotNet.Strings.3.it.resources
2014-06-20 16:13 - 2014-06-20 16:13 - 0155356 ____R () C:\Program Files\PaintDotNet.Strings.3.JA.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148596 ____R () C:\Program Files\PaintDotNet.Strings.3.KO.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0147437 ____R () C:\Program Files\PaintDotNet.Strings.3.lt.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0142834 ____R () C:\Program Files\PaintDotNet.Strings.3.nl.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0143720 ____R () C:\Program Files\PaintDotNet.Strings.3.pl.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0145666 ____R () C:\Program Files\PaintDotNet.Strings.3.PT-BR.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0145325 ____R () C:\Program Files\PaintDotNet.Strings.3.pt-PT.resources
2014-06-03 13:56 - 2014-06-03 13:56 - 0138840 ____R () C:\Program Files\PaintDotNet.Strings.3.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0171796 ____R () C:\Program Files\PaintDotNet.Strings.3.RU.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0135198 ____R () C:\Program Files\PaintDotNet.Strings.3.ZH-CN.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0137582 ____R () C:\Program Files\PaintDotNet.Strings.3.zh-TW.resources
2014-07-22 15:14 - 2014-07-22 15:14 - 0563264 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.SystemLayer.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1058368 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0968256 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0767488 _____ () C:\Program Files\PaintDotNet.SystemLayer.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0014400 _____ (dotPDN LLC) C:\Program Files\PdnRepair.exe
2014-06-27 15:37 - 2014-06-27 15:37 - 0000235 _____ () C:\Program Files\PdnRepair.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\PdnRepair.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0030784 _____ (dotPDN LLC) C:\Program Files\SetupNgen.exe
2010-04-21 00:57 - 2010-04-21 00:57 - 0000254 _____ () C:\Program Files\SetupNgen.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0030208 _____ () C:\Program Files\SetupNgen.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0026688 _____ () C:\Program Files\ShellExtension_x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0023616 _____ () C:\Program Files\ShellExtension_x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0015936 _____ (dotPDN LLC) C:\Program Files\UpdateMonitor.exe
2014-06-28 10:29 - 2014-06-28 10:29 - 0000235 _____ () C:\Program Files\UpdateMonitor.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\UpdateMonitor.pdb
2015-01-28 15:00 - 2015-01-28 15:00 - 0003893 _____ () C:\Users\Rhea\AppData\Local\recently-used.xbel
2014-03-06 23:26 - 2014-03-06 23:26 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\Rhea\AppData\Local\Temp\libeay32.dll
C:\Users\Rhea\AppData\Local\Temp\msvcr120.dll
C:\Users\Rhea\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-23 01:31
==================== Ende von FRST.txt ============================
- beim Adwarecleaner hat der Rechner nicht neu gestartet - beim JRT habe ich den Virenscanner nicht deaktiviert, soll ich den Prozess ab Schritt 2 also wiederholen? Danke vorab. Noch zum Schluss eine Bitte: Könntest Du bei papaimapril schauen (Faden: http://www.trojaner-board.de/179086-...infektion.html ), ob wir hier genauso wie bei mir vorgehen sollten? Besten Dank! Geändert von mamaimapril (28.05.2016 um 00:41 Uhr) |
|
28.05.2016, 11:01
| #4 |
| /// TB-Ausbilder | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Servus, wir entfernen die letzten Reste und kontrollieren nochmal alles.  Hinweis: Der Suchlauf mit ESET kann länger dauern. Schritt 1 Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann. Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
Schritt 2 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 3 ESET Online Scanner
Schritt 4 Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
Schritt 5
Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?Bitte poste mit deiner nächsten Antwort
|
|
28.05.2016, 21:55
| #5 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Hallo, Matthias, ich habe zwei Probleme mit dem Durchführen der von Dir vorgeschlagenen Schritte: 1. die Firewall/der Virenscanner Wie du oben siehst, ist Spybot installiert (Freeware-Version). Meines Wissens ist hier kein Echtzeit-Schutz vorhanden, daher wäre bei diesem Programm nichts zu deaktivieren? Ein Beenden der Windows-Firewall plus Neustart des Rechners sollte daher wohl genügen? 2. zoek.exe Ich habe das zoek-Script nun 2,5 Stunden laufen lassen ohne dass ich eine Logdatei gesehen hätte, dann den Rechner neu gestartet und immer noch nix. War das etwa nicht genug Zeit bzw. was meinst Du mit dem Satz "etwas Zeit in Anspruch nehmen"? Danke nochmal für Deine Mühe! (<-ich kann es nicht oft genug sagen). Abendliche Grüsse von der Floddermama, die jetzt erst für den heutigen Tag in der Dusche war, sich kämmte und endlich mal etwas zu essen bekam.  |
|
30.05.2016, 05:55
| #6 |
| /// TB-Ausbilder | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Servus, zu 1) Windows Defender deaktivieren, sonst nichts. zu 2) Wenns nicht geht, dass mach mit dem nächsten Schritt weiter. |
|
30.05.2016, 14:38
| #7 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Hallo, Matthias, ich habe auch einfach mal mutig weitergemacht, und dabei erstaunt festgestellt, dass Du hier eine riesige Kompanie von Suchtrupps auf meinen Speicher gehetzt hast. Sie wurden fündig, Guckstu: Code:
ATTFilter Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Rhea on 29.05.2016 at 17:58:29,96.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Rhea\Desktop\zoek.exe [Scan all users] [Script inserted]
===== Runcheck 19:12:13,73 =====
--- Create Environment Variables 19:12:15,43
--- Checking Input 19:12:39,81
--- Emptyclsid 19:13:17,14
--- Firefox Fix 19:13:25,17
--- Firefox Extensions 19:13:27,98
Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:29-05-2016 02
durchgeführt von Rhea (2016-05-29 22:46:18) Run:3
Gestartet von C:\Users\Rhea\Desktop
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
start
CloseProcesses:
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************
Prozess erfolgreich geschlossen.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Wert erfolgreich entfernt
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Wert erfolgreich entfernt
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
========= Ende von RemoveProxy: =========
========= ipconfig /flushdns =========
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
========= Ende von CMD: =========
========= netsh winsock reset =========
Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlieáen.
========= Ende von CMD: =========
EmptyTemp: => 1.2 GB temporäre Dateien entfernt.
Das System musste neu gestartet werden.
==== Ende von Fixlog 22:48:04 ====
Code:
ATTFilter ÿþC#:#\#F#R#S#T#\#Q#u#a#r#a#n#t#i#n#e#\#C#\#$#R#e#c#y#c#l#e#.#B#i#n#\#S#-#1#-#5#-#2#1#-#3#8#7#9#7#0#9#8#7#1#-#1#9#6#2#5#8#6#6#8#7#-#2#0#2#5#0#6#7#0#7#9#-#1#0#0#1#\#$#R#H#P#I#9#8#R#.#z#i#p# #W#i#n#3#2#/#S#o#m#o#t#o#.#Q# #e#v#t#l#.# #u#n#e#r#w#ü#n#s#c#h#t#e# #A#n#w#e#n#d#u#n#g#
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d1888d012a0eeb4b9d75f37c1bf41763
# engine=21647
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-20 07:27:19
# local_time=2014-12-20 08:27:19 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 180813 9407958 0 0
# scanned=228732
# found=8
# cleaned=0
# scan_time=6404
sh=F346D91A2E5F5FBEFF8F19023463F079E6E89B7A ft=0 fh=0000000000000000 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$RHPI98R.zip"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$RXWRHVI.exe"
sh=A1247F02D08733A0B4746A940B6C144326B4673E ft=1 fh=7a9f9b4b0c8d09ac vn="Variante von Win32/Toolbar.Montiera.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$R12VYTP\1.3.17.3\startpoint.exe"
sh=68FC8BB80F387D030B7683E15E3681AAFDCBF6F4 ft=1 fh=8729ec73b3c6124c vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\ProgramData\uveZGBag\dat\janZajB.dll"
sh=68FC8BB80F387D030B7683E15E3681AAFDCBF6F4 ft=1 fh=8729ec73b3c6124c vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\Users\All Users\uveZGBag\dat\janZajB.dll"
sh=F346D91A2E5F5FBEFF8F19023463F079E6E89B7A ft=0 fh=0000000000000000 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Rhea\Downloads\streamtransport_1.1.6.2.zip"
sh=075478ED256C74207FB1540F41BE4934B47D549B ft=1 fh=5a1a58d6a5023955 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Rhea\Downloads\streamtransport_1.1.6.2\streamtransport_chrome_setup1.1.6.2.exe"
sh=E18B5242B0C893DF09E34A9E89DE551503F31591 ft=1 fh=5a1a58d6d884f372 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Rhea\Downloads\streamtransport_1.1.6.2\Streamtransport IE10\streamtransport_setup.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=d1888d012a0eeb4b9d75f37c1bf41763
# end=init
# utc_time=2016-05-29 08:54:12
# local_time=2016-05-29 10:54:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 29627
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=d1888d012a0eeb4b9d75f37c1bf41763
# end=updated
# utc_time=2016-05-29 09:02:29
# local_time=2016-05-29 11:02:29 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=d1888d012a0eeb4b9d75f37c1bf41763
# engine=29627
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-05-30 12:50:15
# local_time=2016-05-30 02:50:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 24577570 47056998 0 0
# scanned=291006
# found=8
# cleaned=0
# scan_time=13665
sh=F346D91A2E5F5FBEFF8F19023463F079E6E89B7A ft=0 fh=0000000000000000 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$RHPI98R.zip"
sh=D873775A3CDE71B3F3946581FD57F47694BBB47B ft=1 fh=65fe9abcf2861381 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$RVECKDB.exe"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$RXWRHVI.exe"
sh=A1247F02D08733A0B4746A940B6C144326B4673E ft=1 fh=7a9f9b4b0c8d09ac vn="Variante von Win32/Toolbar.Montiera.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\$Recycle.Bin\S-1-5-21-3879709871-1962586687-2025067079-1001\$R12VYTP\1.3.17.3\startpoint.exe"
sh=68FC8BB80F387D030B7683E15E3681AAFDCBF6F4 ft=1 fh=8729ec73b3c6124c vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\uveZGBag\dat\janZajB.dll"
sh=435F1B43102D2AF3D945BE3B7F24A8E683CAB404 ft=1 fh=fb4b20cce4cff340 vn="Variante von Win32/InstallCore.ACZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Rhea\Downloads\Anwendungen\Joomla und Co\FileZilla_3.10.3_win64-setup.exe"
sh=C9749368ED2EF82A775153F2E1FC0CD0C67578EC ft=1 fh=e1e3a394e0ae70a0 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\SpyBot Search Destroy - CHIP-Installer.exe"
sh=E463ACFE9829A72AB2E222BAFADB1C3F7BD6785B ft=1 fh=c71c001116150659 vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\MRT\3AC662F4-BBD5-4771-B2A0-164912094D5D\FilesStash\06FE14A2-8E84-76F5-AC79-CBE7E9C98276"
Code:
ATTFilter HitmanPro 3.7.14.265
www.hitmanpro.com
Computer name . . . . : MNEMOSYNE
Windows . . . . . . . : 6.3.0.9600.X64/4
User name . . . . . . : Mnemosyne\Rhea
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2016-05-30 13:10:47
Scan mode . . . . . . : Normal
Scan duration . . . . : 8m 41s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 2
Traces . . . . . . . : 17
Objects scanned . . . : 2.092.136
Files scanned . . . . : 40.731
Remnants scanned . . : 511.138 files / 1.540.267 keys
Malware _____________________________________________________________________
C:\Users\Rhea\Downloads\Anwendungen\Joomla und Co\FileZilla_3.10.3_win64-setup.exe
Size . . . . . . . : 776.096 bytes
Age . . . . . . . : 408.7 days (2015-04-17 20:13:04)
Entropy . . . . . : 7.9
SHA-256 . . . . . : 680F07948ACA06A088CF154E35CC68E3625ED86D62DF647542E968B751CFBC52
Product . . . . . : Web Software
Publisher . . . . : Internet
Description . . . : Web Software Setup
Version . . . . . : 2.8.1.5
RSA Key Size . . . : 2048
LanguageID . . . . : 0
Authenticode . . . : Valid
> HitmanPro . . . . : App/InstCore-DI
Fuzzy . . . . . . : 101.0
C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\SpyBot Search Destroy - CHIP-Installer.exe
Size . . . . . . . : 1.177.424 bytes
Age . . . . . . . : 530.8 days (2014-12-16 18:40:12)
Entropy . . . . . : 7.0
SHA-256 . . . . . : 7661D07DCFBD524FC0C469B113621B50D374CFD4C422490CA1C78A289BF31A99
Needs elevation . : Yes
RSA Key Size . . . : 2048
Authenticode . . . : Valid
> Kaspersky . . . . : not-a-virus:RiskTool.Win32.Ocna.gen
Fuzzy . . . . . . : 99.0
Suspicious files ____________________________________________________________
C:\Users\Rhea\Desktop\FRST-OlderVersion\FRST64.exe
Size . . . . . . . : 2.383.360 bytes
Age . . . . . . . : 6.6 days (2016-05-23 23:14:18)
Entropy . . . . . : 7.6
SHA-256 . . . . . : AFD31ECDDB36BA07C31D5776612F100521B24847CA3C54844F645B773B17CD24
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
C:\Users\Rhea\Desktop\FRST64.exe
Size . . . . . . . : 2.383.872 bytes
Age . . . . . . . : 0.6 days (2016-05-29 22:44:02)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 24462942CD66577CFBFCE5B0915089C5F23BAAA568C34D13A837EBA714450D66
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
Forensic Cluster
-0.3s C:\Users\Rhea\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4F8D4D4F8A055DA96F5FDDC885E626A4
-0.3s C:\Users\Rhea\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4F8D4D4F8A055DA96F5FDDC885E626A4
0.0s C:\Users\Rhea\Desktop\FRST64.exe
1.5s C:\Users\Rhea\Desktop\FRST-OlderVersion\
C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\FRST64.exe
Size . . . . . . . : 2.085.888 bytes
Age . . . . . . . : 529.7 days (2014-12-17 19:49:36)
Entropy . . . . . : 7.5
SHA-256 . . . . . : 6BA40461E9C8E75357899143AABD734B3E0EB436D67B6F5338AEFFEB9F3BF323
Needs elevation . : Yes
Fuzzy . . . . . . : 22.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
C:\Users\Rhea\Downloads\FRST64 (1).exe
Size . . . . . . . : 2.383.360 bytes
Age . . . . . . . : 6.6 days (2016-05-23 23:15:17)
Entropy . . . . . : 7.6
SHA-256 . . . . . : AFD31ECDDB36BA07C31D5776612F100521B24847CA3C54844F645B773B17CD24
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
Potential Unwanted Programs _________________________________________________
HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
HKLM\SOFTWARE\Classes\Interface\{2DE6463C-048A-4117-84FF-FE503B6EAE3C}\ (Allin1Convert)
HKLM\SOFTWARE\Classes\Interface\{8B4DBC04-437F-40C0-9ACC-7BB85B0B7865}\ (Allin1Convert)
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f9131ea5-c2e2-4bcf-b0f3-b2d7ed6edc76}\ (Allin1Convert)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}\ (ConsumerInput)
FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:29-05-2016 02
durchgeführt von Rhea (Administrator) auf MNEMOSYNE (30-05-2016 13:25:30)
Gestartet von C:\Users\Rhea\Desktop
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
() C:\Windows\SysWOW64\spdsvc.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
() C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(© 2015 Microsoft Corporation) C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
() C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780400 2013-10-28] (Synaptics Incorporated)
HKLM\...\Run: [Yoga PhoneCompanion] => C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe [844304 2014-03-07] (Lenovo)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-03-07] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM-x32\...\Run: [Yoga Picks] => C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe [119824 2013-12-02] (Lenovo)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2457560 2015-03-19] (FileZilla Project)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [2171456 2015-12-17] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23745808 2016-05-07] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-11-15] (Atheros Communications)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [BingSvc] => C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-01-02] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [EEDSpeedLauncher] => rundll32.exe C:\WINDOWS\system32\eed_ec.dll,SpeedLauncher
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [RESTART_STICKY_NOTES] => C:\WINDOWS\system32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [589312 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 9.6 PE.lnk [2016-05-23]
ShortcutTarget: PHOTOfunSTUDIO 9.6 PE.lnk -> C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2016-05-23]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{47953B4F-4698-4BE4-8629-D04F23915DC9}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{927CA755-A3D5-411C-BDE0-BDE30D80941F}: [DhcpNameServer] 150.201.1.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.shopssl.de;www1.wdr.de
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.msn.com/de-de/?pc=SL5M&ocid=SL5MDHP&osmkt=de-de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> DefaultScope {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {4E2A6A0E-B18C-469F-BC62-EAFB366818A5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {79EE8967-C73E-45F3-9A1A-E79B6BA5E802} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {C6966AB3-7BDE-4182-86B6-DD1910E1B58A} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-25] (Oracle Corporation)
BHO-x32: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-25] (Oracle Corporation)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default
FF NewTab: about:newtab
FF SearchEngineOrder.3: Bing
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\bing-.xml [2016-01-01]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-images.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-maps.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\heise-netze-spam-listen-abfrage.xml [2016-02-19]
FF Extension: Bing Search - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-01-01]
FF Extension: Adblock Plus - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-24]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [318592 2013-11-15] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [779736 2015-03-19] (FileZilla Project)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-03-07] (Lenovo)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2013-11-04] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe [285712 2014-03-07] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionVap.exe [304144 2014-03-07] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Samsung Network Fax Server; C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxServer64.exe [801472 2015-03-10] (Samsung Electronics Co., Ltd.)
R2 Samsung Printer Dianostics Service; C:\WINDOWS\SysWOW64\\spdsvc.exe [498488 2016-05-01] ()
R2 SamsungUPDUtilSvc; C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe [118576 2014-11-26] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-03-07] (Lenovo)
R2 YogaPicks.AppService; C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe [19440 2013-11-18] ()
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-11-15] (Atheros) [Datei ist nicht signiert]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-11-15] (Qualcomm Atheros)
R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-28] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 rtsuvc; \SystemRoot\system32\DRIVERS\rtsuvc.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-30 13:24 - 2016-05-30 13:24 - 00000000 ____D C:\Users\Rhea\Desktop\frst1
2016-05-30 13:09 - 2016-05-30 13:24 - 00000000 ____D C:\ProgramData\HitmanPro
2016-05-30 12:53 - 2016-05-30 12:53 - 00002444 _____ C:\Users\Rhea\Desktop\eset.txt
2016-05-29 22:46 - 2016-05-29 22:48 - 00002057 _____ C:\Users\Rhea\Desktop\Fixlog.txt
2016-05-29 22:44 - 2016-05-29 22:44 - 00000000 ____D C:\Users\Rhea\Desktop\FRST-OlderVersion
2016-05-29 22:14 - 2016-05-29 22:14 - 00012388 _____ C:\Users\Rhea\Desktop\zoek.odt
2016-05-29 17:58 - 2016-05-29 19:13 - 00000473 _____ C:\runcheck.txt
2016-05-28 22:33 - 2016-05-28 22:36 - 00000000 ____D C:\Users\Rhea\Desktop\retouren
2016-05-28 18:13 - 2016-05-28 18:13 - 00000000 ____D C:\zoek_backup
2016-05-28 16:45 - 2016-05-28 16:45 - 11438608 _____ (SurfRight B.V.) C:\Users\Rhea\Desktop\HitmanPro_x64.exe
2016-05-28 16:44 - 2016-05-28 16:44 - 02870984 _____ (ESET) C:\Users\Rhea\Desktop\esetsmartinstaller_deu.exe
2016-05-28 16:36 - 2016-05-28 16:36 - 01309184 _____ C:\Users\Rhea\Desktop\zoek.exe
2016-05-28 01:27 - 2016-05-28 01:38 - 00051472 _____ C:\Users\Rhea\Desktop\Addition.txt
2016-05-28 01:23 - 2016-05-30 13:26 - 00024529 _____ C:\Users\Rhea\Desktop\FRST.txt
2016-05-28 01:06 - 2016-05-28 01:06 - 00001367 _____ C:\Users\Rhea\Desktop\JRT.txt
2016-05-28 00:38 - 2016-05-28 00:38 - 03678272 _____ C:\Users\Rhea\Desktop\adwcleaner_5.118.exe
2016-05-28 00:35 - 2016-05-28 00:35 - 01610816 _____ (Malwarebytes) C:\Users\Rhea\Desktop\JRT.exe
2016-05-27 18:08 - 2016-05-27 18:08 - 00000000 ____D C:\Users\Rhea\Documents\ProcAlyzer Dumps
2016-05-25 19:26 - 2016-05-25 19:25 - 02078208 ____N C:\WINDOWS\SysWOW64\DlgSearchEngine.dll
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N C:\WINDOWS\SysWOW64\spdsvc.exe
2016-05-25 19:26 - 2015-12-04 10:03 - 00017831 ____N C:\WINDOWS\SysWOW64\spddata.xml
2016-05-25 19:24 - 2016-05-25 19:24 - 00000000 ____D C:\Program Files\Common Files\Common Desktop Agent
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\system32\ssm4mlm.dll
2016-05-25 19:09 - 2016-05-25 19:09 - 04357416 _____ C:\Users\Rhea\Downloads\SamsungPrinterInstaller.exe
2016-05-24 20:32 - 2016-05-25 20:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-05-24 00:11 - 2016-05-24 00:17 - 00059771 _____ C:\Users\Rhea\Downloads\Addition.txt
2016-05-24 00:09 - 2016-05-24 00:17 - 00048791 _____ C:\Users\Rhea\Downloads\FRST.txt
2016-05-23 23:42 - 2016-05-23 23:42 - 00001210 _____ C:\Users\Rhea\Desktop\malwarebytes230516.txt
2016-05-23 23:17 - 2016-05-25 18:29 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-23 23:16 - 2016-05-23 23:45 - 00001123 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-23 23:15 - 2016-05-23 23:15 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64 (1).exe
2016-05-23 23:14 - 2016-05-29 22:44 - 02383872 _____ (Farbar) C:\Users\Rhea\Desktop\FRST64.exe
2016-05-23 23:11 - 2016-05-23 23:15 - 22851472 _____ (Malwarebytes ) C:\Users\Rhea\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-23 00:48 - 2016-04-04 08:35 - 00046768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-23 00:48 - 2016-04-02 15:26 - 01386496 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-23 00:48 - 2016-04-02 15:26 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-05-23 00:48 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-05-23 00:48 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-23 00:48 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2016-05-23 00:48 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2016-05-23 00:48 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2016-05-23 00:48 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2016-05-23 00:48 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2016-05-23 00:48 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2016-05-23 00:48 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
2016-05-23 00:48 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-05-23 00:48 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-05-23 00:48 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-05-23 00:47 - 2016-03-14 18:50 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-05-23 00:47 - 2016-03-12 02:49 - 02466136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-05-23 00:47 - 2016-03-12 02:47 - 00160160 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-12 02:47 - 00121912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-10 21:17 - 01133752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:48 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:43 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-05-23 00:47 - 2016-03-10 19:03 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-05-23 00:47 - 2016-03-10 18:52 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-05-23 00:47 - 2016-03-10 18:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00413696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-05-23 00:47 - 2016-03-05 19:44 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-23 00:47 - 2016-03-05 19:04 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-23 00:47 - 2016-02-27 20:28 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-05-23 00:47 - 2016-02-27 19:57 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 19:19 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 18:32 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-05-23 00:47 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-05-23 00:47 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-05-23 00:47 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-05-23 00:47 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-05-23 00:47 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-05-23 00:47 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-05-23 00:47 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-05-23 00:47 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2016-05-23 00:47 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-23 00:47 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-05-23 00:47 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-05-23 00:47 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-05-23 00:47 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-05-23 00:47 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-05-23 00:47 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-05-23 00:47 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-05-23 00:47 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe
2016-05-23 00:47 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2016-05-23 00:47 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2016-05-23 00:47 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2016-05-23 00:47 - 2016-01-21 00:40 - 00099672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys
2016-05-23 00:47 - 2014-11-08 04:38 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-23 00:47 - 2014-11-08 04:17 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2016-05-23 00:46 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys
2016-05-22 23:17 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-22 23:17 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-22 23:17 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-22 23:17 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-22 23:17 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-22 23:17 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-22 23:17 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-05-22 23:17 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-22 23:17 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-05-22 23:16 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-22 23:16 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-22 23:16 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-05-22 23:16 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-22 23:16 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-05-22 23:16 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-05-22 23:16 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-22 23:16 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-05-22 23:16 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-05-22 23:15 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-05-22 23:15 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-05-22 23:15 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-05-22 23:15 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-05-22 23:15 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-22 23:15 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-05-22 23:15 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-22 23:15 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-22 23:15 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-22 23:15 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-05-22 23:15 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-05-22 23:14 - 2016-04-11 08:21 - 00074584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2016-05-22 23:14 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-22 23:14 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-22 23:14 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-05-22 23:14 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-22 23:14 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-22 23:14 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-22 23:14 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-22 23:14 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-22 23:14 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-05-22 23:14 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-05-22 23:14 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-05-22 23:14 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-05-22 23:14 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-22 23:14 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-05-22 16:37 - 2016-05-22 16:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-30 13:25 - 2014-12-17 19:53 - 00000000 ____D C:\FRST
2016-05-30 13:13 - 2016-02-17 12:08 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-05-30 12:48 - 2016-03-22 17:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-30 11:13 - 2016-02-17 12:08 - 00001226 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-05-30 01:21 - 2016-01-08 23:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-05-29 22:52 - 2016-02-17 12:12 - 00000000 ___RD C:\Users\Rhea\Dropbox
2016-05-29 22:49 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-29 22:48 - 2013-08-22 15:25 - 04194304 ___SH C:\WINDOWS\system32\config\BBI
2016-05-28 22:39 - 2015-12-06 19:51 - 00000000 ____D C:\Users\Rhea\Documents\geschäftlich 2016
2016-05-28 22:36 - 2014-07-08 13:40 - 00000000 ____D C:\Users\Rhea\Documents\gps Daten
2016-05-28 22:33 - 2014-05-25 14:11 - 00000000 ____D C:\Users\Rhea\Documents\privat
2016-05-28 16:26 - 2015-04-15 13:33 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-28 16:26 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-28 01:27 - 2014-12-17 17:39 - 00000000 ____D C:\AdwCleaner
2016-05-27 20:33 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-05-27 11:01 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-05-25 22:42 - 2015-08-30 00:10 - 00000000 ____D C:\Users\Rhea\AppData\Local\WEB2Print
2016-05-25 21:39 - 2014-05-23 00:25 - 00000000 ____D C:\Users\Rhea\AppData\Local\CrashDumps
2016-05-25 20:02 - 2014-06-26 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-25 19:44 - 2014-05-23 02:08 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3879709871-1962586687-2025067079-1001
2016-05-25 19:26 - 2015-05-22 18:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2016-05-25 19:24 - 2015-05-22 17:02 - 00000000 ____D C:\ProgramData\Samsung
2016-05-25 19:23 - 2015-05-22 17:02 - 00000000 ____D C:\Program Files (x86)\SamsungPrinterLiveUpdateInstaller
2016-05-25 18:20 - 2014-03-07 07:41 - 00767130 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-25 18:20 - 2014-03-07 07:41 - 00160216 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-25 18:20 - 2013-10-07 20:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-25 17:30 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-05-23 23:45 - 2016-02-16 12:03 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-23 23:45 - 2015-10-28 10:32 - 00001418 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-23 23:45 - 2015-09-05 13:14 - 00000982 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-05-23 23:45 - 2014-11-04 22:37 - 00001186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-23 23:45 - 2014-10-07 14:25 - 00001744 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eigene Musik.lnk
2016-05-23 23:45 - 2014-10-05 15:46 - 00000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-05-23 23:45 - 2014-10-05 11:53 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2016-05-23 23:45 - 2014-10-03 14:46 - 00000752 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bilder.lnk
2016-05-23 23:45 - 2014-08-22 22:43 - 00000763 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2016-05-23 23:45 - 2014-07-30 23:35 - 00001364 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RouteConverterWindows.lnk
2016-05-23 23:45 - 2014-06-26 11:49 - 00002125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-23 23:45 - 2014-05-23 02:03 - 00001465 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-23 23:45 - 2014-03-07 00:06 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartVoiceToast.lnk
2016-05-23 23:45 - 2014-03-06 23:55 - 00002007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-05-23 23:44 - 2013-08-22 17:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2016-05-23 14:01 - 2013-08-22 16:44 - 00371640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-23 13:53 - 2013-08-22 21:12 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-23 09:42 - 2014-06-13 00:55 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-23 09:42 - 2014-06-13 00:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-23 09:28 - 2014-05-23 02:03 - 00000000 ____D C:\Users\Rhea
2016-05-23 00:18 - 2016-02-16 12:04 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-23 00:03 - 2014-12-16 18:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-22 22:53 - 2016-01-13 00:57 - 00177488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-05-22 16:48 - 2016-03-23 19:48 - 19942080 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-05-22 16:48 - 2016-03-22 17:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-22 16:37 - 2016-02-17 12:08 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-05-22 16:32 - 2016-02-17 12:08 - 00000000 ____D C:\Users\Rhea\AppData\Local\Dropbox
2016-05-11 22:08 - 2015-03-11 23:30 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 22:08 - 2015-03-11 23:30 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-11-27 00:53 - 2005-11-27 00:53 - 0049152 _____ ( ) C:\Program Files\Interop.WIA.dll
2013-08-25 18:57 - 2013-08-25 18:57 - 0001968 _____ () C:\Program Files\License.txt
2014-07-22 15:14 - 2014-07-22 15:14 - 0828992 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Base.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 3087872 _____ () C:\Program Files\PaintDotNet.Base.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0562752 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Core.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1826304 _____ () C:\Program Files\PaintDotNet.Core.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0090688 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Data.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0265728 _____ () C:\Program Files\PaintDotNet.Data.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0195648 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Effects.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0495104 _____ () C:\Program Files\PaintDotNet.Effects.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 1766976 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.exe
2014-06-27 14:41 - 2014-06-27 14:41 - 0000429 _____ () C:\Program Files\PaintDotNet.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0337472 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Framework.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1019392 _____ () C:\Program Files\PaintDotNet.Framework.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 4711936 _____ () C:\Program Files\PaintDotNet.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0416832 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Resources.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0050688 _____ () C:\Program Files\PaintDotNet.Resources.pdb
2014-06-23 11:10 - 2014-06-23 11:10 - 0145066 ____R () C:\Program Files\PaintDotNet.Strings.3.cs.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0141037 ____R () C:\Program Files\PaintDotNet.Strings.3.da.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0147174 ____R () C:\Program Files\PaintDotNet.Strings.3.DE.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0146230 ____R () C:\Program Files\PaintDotNet.Strings.3.ES.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0158177 ____R () C:\Program Files\PaintDotNet.Strings.3.fa.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0140166 ____R () C:\Program Files\PaintDotNet.Strings.3.fi.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148878 ____R () C:\Program Files\PaintDotNet.Strings.3.FR.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0188674 ____R () C:\Program Files\PaintDotNet.Strings.3.hi.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0145645 ____R () C:\Program Files\PaintDotNet.Strings.3.hu.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0144519 ____R () C:\Program Files\PaintDotNet.Strings.3.it.resources
2014-06-20 16:13 - 2014-06-20 16:13 - 0155356 ____R () C:\Program Files\PaintDotNet.Strings.3.JA.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148596 ____R () C:\Program Files\PaintDotNet.Strings.3.KO.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0147437 ____R () C:\Program Files\PaintDotNet.Strings.3.lt.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0142834 ____R () C:\Program Files\PaintDotNet.Strings.3.nl.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0143720 ____R () C:\Program Files\PaintDotNet.Strings.3.pl.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0145666 ____R () C:\Program Files\PaintDotNet.Strings.3.PT-BR.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0145325 ____R () C:\Program Files\PaintDotNet.Strings.3.pt-PT.resources
2014-06-03 13:56 - 2014-06-03 13:56 - 0138840 ____R () C:\Program Files\PaintDotNet.Strings.3.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0171796 ____R () C:\Program Files\PaintDotNet.Strings.3.RU.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0135198 ____R () C:\Program Files\PaintDotNet.Strings.3.ZH-CN.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0137582 ____R () C:\Program Files\PaintDotNet.Strings.3.zh-TW.resources
2014-07-22 15:14 - 2014-07-22 15:14 - 0563264 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.SystemLayer.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1058368 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0968256 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0767488 _____ () C:\Program Files\PaintDotNet.SystemLayer.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0014400 _____ (dotPDN LLC) C:\Program Files\PdnRepair.exe
2014-06-27 15:37 - 2014-06-27 15:37 - 0000235 _____ () C:\Program Files\PdnRepair.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\PdnRepair.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0030784 _____ (dotPDN LLC) C:\Program Files\SetupNgen.exe
2010-04-21 00:57 - 2010-04-21 00:57 - 0000254 _____ () C:\Program Files\SetupNgen.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0030208 _____ () C:\Program Files\SetupNgen.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0026688 _____ () C:\Program Files\ShellExtension_x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0023616 _____ () C:\Program Files\ShellExtension_x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0015936 _____ (dotPDN LLC) C:\Program Files\UpdateMonitor.exe
2014-06-28 10:29 - 2014-06-28 10:29 - 0000235 _____ () C:\Program Files\UpdateMonitor.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\UpdateMonitor.pdb
2015-01-28 15:00 - 2015-01-28 15:00 - 0003893 _____ () C:\Users\Rhea\AppData\Local\recently-used.xbel
2014-03-06 23:26 - 2014-03-06 23:26 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-28 16:25
==================== Ende von FRST.txt ============================
|
|
30.05.2016, 14:39
| #8 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFoxCode:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:29-05-2016 02
durchgeführt von Rhea (2016-05-30 13:28:50)
Gestartet von C:\Users\Rhea\Desktop
Windows 8.1 (Update) (X64) (2014-05-23 00:02:59)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3879709871-1962586687-2025067079-500 - Administrator - Disabled)
Gast (S-1-5-21-3879709871-1962586687-2025067079-501 - Limited - Disabled)
Rhea (S-1-5-21-3879709871-1962586687-2025067079-1001 - Administrator - Enabled) => C:\Users\Rhea
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.35 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0935-000001000000}) (Version: 9.35.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.7.0 - Conexant)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.33 - Lenovo)
Energy Manager (x32 Version: 1.0.0.33 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.50 - FileZilla Project)
Garmin BaseCamp (HKLM-x32\...\{B0BED0BB-E1C4-49AA-840F-7CA052ADF5EB}) (Version: 4.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GMX MailCheck (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.6.1 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 4.0.1.0 - 1&1 Mail & Media GmbH)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{E7E2BEA6-ECCE-4306-9486-A08781BE0AD0}) (Version: 2.0.0.1104 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.0.1104 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.0.13.12271 - Lenovo)
Lenovo Yoga PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.1.9.5 - Lenovo)
Lenovo Yoga PhoneCompanion (x32 Version: 1.1.9.5 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Mozilla Thunderbird 38.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.6.0 (x86 de)) (Version: 38.6.0 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PHOTOfunSTUDIO 9.6 PE (HKLM-x32\...\{7113ACE0-A2FA-463B-969A-E3FD7BF42573}) (Version: 9.06.710.1031 - Panasonic Corporation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.310 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.4.7 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.60 (17.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.81.00(25.05.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series (HKLM-x32\...\Samsung M2070 Series) (Version: 1.22 (07.09.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series XPS (Windows 8) (HKLM-x32\...\Samsung M2070 Series XPS (Windows 8)) (Version: 3.03.08.00:05 - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.11.28 (10.03.2015) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.01.12 (15.10.2014) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Assistant (HKLM-x32\...\Samsung Scan Assistant) (Version: 1.05.07 (20.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.25 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.06.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SILKYPIX Developer Studio 4.2 SE (HKLM-x32\...\InstallShield_{8B9D37A0-F77B-41DD-932A-CE01DEC1ADAA}) (Version: 4 - Ichikawa Soft Laboratory)
SILKYPIX Developer Studio 4.2 SE (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.6 - Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
Yoga Picks (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.013.1202 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {48F86BC9-1A37-4268-8DC9-4B902CAEC945} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {4D1C6EFB-FADF-4188-9DAE-072F214E05B7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-22] (Adobe Systems Incorporated)
Task: {721CA287-0ACF-41C2-A15A-35A9A2785A33} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {7520915A-6376-4F3A-9F78-6895858C2E24} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {80EFEDA3-E3E4-451A-81B7-A19891B23FDA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {CFE11131-73E0-419A-BE2D-C3A87FC84D8F} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-10-08] (1&1 Mail & Media GmbH)
Task: {D8C74952-C759-495C-BAED-612B80646889} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {F69EE45E-80DB-40F7-B912-B46E9C2F1791} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11517530520.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd10c1016 -pinnedTimeHigh 0x01d0d295 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/ende/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11689991990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd3990412 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000056 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/82/bebalanced-k%C3%B6rper
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12072113890.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0327686a -pinnedTimeHigh 0x01d0f4b0 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000017 hxxp://www.clipfish.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12425247930.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xf60c1a3b -pinnedTimeHigh 0x01cfbe56 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/frde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13304856320.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0de30816 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://www.unwetterzentrale.de/uwz/temperatur.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13506273490.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x245d8140 -pinnedTimeHigh 0x01d0fb60 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001e hxxp://woerterbuchnetz.de/DWB/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-14704389310.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x709605fc -pinnedTimeHigh 0x01d07bb4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000029 hxxp://localhost/joomla341/administrator/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-15829586810.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x8dac8991 -pinnedTimeHigh 0x01d0f876 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000015 hxxp://www.amazon.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-16228374220.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xdd5a7938 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000050 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/83/bebalanced-geist
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-17714738290.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa06bf05f -pinnedTimeHigh 0x01cfbdf1 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000001e hxxp://www.gpsies.com/login.do
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-18349738120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x012fa14d -pinnedTimeHigh 0x01d06bbc -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000042 hxxp://www.niederschlagsradar.de/niederschlagsprognose.aspx?type=1
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1856752590.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x9e55eab1 -pinnedTimeHigh 0x01d06bcf -securityFlags 0x00000000 -tileType 0x00000002 -url 0x0000001a hxxp://www.codecheck.info/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1930419650.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x16618286 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000011 hxxp://fritz.box/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20172485120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x1a75fa60 -pinnedTimeHigh 0x01cfbc92 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://www.bahn.de/p/view/index.shtml
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20504568990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xebcbbc70 -pinnedTimeHigh 0x01cfbc91 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000003b hxxp://www.boeser-wolf.schule.de/concours/2014/accueil.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-5511536870.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa5d41f09 -pinnedTimeHigh 0x01d138b2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/esde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-6764561640.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xc0dd7b7c -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000051 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/80/bebalanced-basics
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\13362524720.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfdbd1b9c -pinnedTimeHigh 0x01cfc2d2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://wetterstationen.meteomedia.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\14722268070.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0374d018 -pinnedTimeHigh 0x01d138f7 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000026 hxxp://www.duden.de/schwierige-woerter
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16003941200.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x029e0744 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000017 hxxp://www.sat24.com/eu
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16371692260.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x6ede0d80 -pinnedTimeHigh 0x01d12204 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000013 hxxp://www.faz.net/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19320121740.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x4f006974 -pinnedTimeHigh 0x01d0d42f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000028 hxxps://www.aerzte-finanz.de/praxispilot
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19571323130.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x08753f27 -pinnedTimeHigh 0x01d0b0b6 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000002d hxxp://online.rote-liste.de/suche/ferro-sanol
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19858872700.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe480d8c3 -pinnedTimeHigh 0x01d06bc9 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003c hxxp://www.hautschutzengel.de/bedenkliche-inhaltsstoffe.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\21415739090.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe924f5b3 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000059 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/84/bebalanced-sch%C3%B6nheit
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\330252100.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x40fe2528 -pinnedTimeHigh 0x01d07ba4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://localhost/joomla341/administrator/index.php
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4300483340.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xcc6d0835 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000053 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/81/bebalanced-workouts
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4699799270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x2a286297 -pinnedTimeHigh 0x01cfe086 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000041 hxxp://fahrplanauskunft.vrn.de/vrn/XSLT_TRIP_REQUEST2?language=de
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4736959030.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x693ce4b5 -pinnedTimeHigh 0x01d06bc1 -securityFlags 0x00000000 -tileType 0x00000003 -url 0x000000a5 hxxp://scholar.google.com/scholar?hl=en&q=%22101-86-0%22+OR+%22hexyl+cinnamaldehyde%22+OR+%2
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\6473758050.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xff1fdcd2 -pinnedTimeHigh 0x01cfe091 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000044 hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8167997760.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfb848207 -pinnedTimeHigh 0x01d0fea8 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001c hxxp://www.dirksbiokiste.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8302254560.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfce9884c -pinnedTimeHigh 0x01d0fb5f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001b hxxp://dwb.uni-trier.de/de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8511463020.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe44b0b80 -pinnedTimeHigh 0x01d12ea3 -securityFlags 0x00000000 -tileType 0x00000002 -url 0x00000041 hxxps://www.efiliale.de/efiliale/internetmarke/productDetails.jsp
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\System32\ssm4mlm.dll
2015-05-22 19:34 - 2014-04-16 10:22 - 00029184 _____ () C:\WINDOWS\System32\usp02l.dll
2014-03-07 00:05 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N () C:\WINDOWS\SysWOW64\spdsvc.exe
2015-05-22 19:34 - 2014-11-26 13:07 - 00118576 _____ () C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00062224 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-03-07 00:00 - 2013-11-18 17:40 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2013-11-15 04:01 - 2013-11-15 04:01 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-11-15 03:58 - 2013-11-15 03:58 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-11-15 04:04 - 2013-11-15 04:04 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00294672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-09-08 13:39 - 2014-09-08 13:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2014-09-08 13:38 - 2014-09-08 13:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-03-07 00:00 - 2013-12-02 19:09 - 00044560 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Util.dll
2016-05-28 16:26 - 2016-05-28 16:26 - 00207872 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.System\85dd654fe936df9e1997f386cd7d0e48\Windows.System.ni.dll
2016-05-29 19:02 - 2016-05-29 19:02 - 01259520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Networking\6b8dacc0b0a4eb2e651f3f6f5f46ed0c\Windows.Networking.ni.dll
2016-05-28 16:26 - 2016-05-28 16:26 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\e2e1cd64b91b7395a96ebcde35a63a1c\Windows.Foundation.ni.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00108304 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2015-05-22 19:34 - 2013-10-04 06:53 - 00734720 _____ () C:\WINDOWS\system32\SnMinDrv.dll
2015-05-22 18:05 - 2015-06-10 08:18 - 00087552 ____N () C:\WINDOWS\system32\SSDEVM64.DLL
2014-03-07 00:06 - 2014-03-07 00:06 - 00815104 _____ () C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
2015-10-28 10:32 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-28 10:32 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-28 10:32 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00102672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00101648 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2014-09-08 13:32 - 2014-09-08 13:32 - 00050688 _____ () C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-12-03 14:35 - 2014-06-04 11:21 - 00571904 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2014-12-03 14:35 - 2014-05-19 18:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00034768 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00093640 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00018376 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-05-22 16:37 - 2016-05-07 00:35 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00692688 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00121296 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021840 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00114640 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021832 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00117056 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134608 _____ () C:\Program Files (x86)\Dropbox\Client\_elementtree.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134088 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00240584 _____ () C:\Program Files (x86)\Dropbox\Client\jpegtran.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021824 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32._winffi_kernel32.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-05-22 16:37 - 2016-04-19 21:50 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-05-22 16:37 - 2016-05-07 00:34 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-05-22 16:37 - 2016-05-07 00:34 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01971504 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00132912 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00223544 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-01-08 23:18 - 2016-02-17 15:38 - 00153032 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2016-01-08 23:18 - 2016-02-17 15:38 - 00022472 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-03-22 19:06 - 00450771 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rhea\Pictures\dendrobium.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist deaktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A1565219-9C4A-477E-B087-633B3F01E71E}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{27C039CA-A127-4E1D-B1D3-CFEB670B44C4}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{52CA7F06-4BB9-4795-8066-9B58632D957C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{A68DF61A-3CEB-457C-A455-E979D0DFD9D9}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{3BA7C7BB-201C-4578-8032-226B84A5187E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{D77998D3-8628-4C19-B4A4-AF6FD6322E17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{53831517-DB8D-477E-A9BA-0C3A6D4F67AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1061C061-F384-43B0-A0D9-6DDF4EE6503F}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{7D299E78-91AB-4FFE-A9D0-96D0355417B2}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{1AF7B847-EFE8-41FB-8695-62F373AFC563}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{68C4E61F-D08F-4ECF-BDF9-34E20341F5B6}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{B954C488-1AA4-4941-8C2B-67D5286A963E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{E1072E6A-6360-495F-926E-F632C4A9689B}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{2F8C4FC1-9C82-4726-8649-49E2C93B9D8E}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{AF6153E9-14EE-4199-BED9-3D14AB492CF1}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{D4FA5DEE-C506-4A04-935D-390F5C6079FB}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{F1A3B9EF-D5FB-4574-9BEB-96ECBB0D684B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{D921552C-CE68-403D-9DBE-CAC966A95EE2}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon64.exe
FirewallRules: [{4EA57459-AD30-41FA-9486-39ECF62DD501}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon.exe
FirewallRules: [{CA400C7C-FCAD-4924-A278-73C732755889}] => (Allow) C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxMon64.exe
FirewallRules: [{0DB4AB93-0BF1-452D-B832-A710ACAE9614}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{0A36E50D-B3B9-4F9E-89E2-F7D348BB11A2}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{B01021EE-1A36-4775-B364-BBFD21F779CC}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [{6AE25776-262D-4156-A3AD-06CEFDE05C0E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{E1687298-987D-4B20-9A26-B60751527F08}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{ED9943F9-DE46-46E9-925F-100E5091517E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{8A2BA25A-496F-4DCC-A5C7-C19393A3D961}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{62296BC3-29A2-4E43-A5B9-FC5F4AFF9F77}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{AA356EF1-DC9A-4E7C-9867-11E0FD6ADEA3}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{92F8AF9C-8320-4DA0-9BD8-8385FCE371E0}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{ACDC45D2-E539-4A5C-88F5-D552A85E4715}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{5101E3CE-13FC-48A1-B5C4-7AEFDA6EE3B9}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{C4AADB98-8170-4343-BE13-431B9916C69F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{FADE533B-82AD-4F77-BE3C-8EFC1FCF83BE}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{90066ABE-2A39-4368-906B-678D875AC021}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{B325C3E0-A133-4252-8525-E421CB05311C}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{4D6BB0B0-11D9-45EB-BFF1-83D9D0931CEE}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
25-03-2016 22:43:12 Windows Update
22-05-2016 23:47:21 Windows Update
26-05-2016 21:34:56 Windows Update
28-05-2016 01:05:01 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/30/2016 01:07:17 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (05/29/2016 10:53:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (05/29/2016 10:53:25 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (05/29/2016 10:53:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (05/29/2016 10:53:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (05/29/2016 10:49:28 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/29/2016 10:49:28 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/29/2016 10:42:09 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/29/2016 10:33:33 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/29/2016 10:24:28 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: fbc
Startzeit: 01d1b9e751e1eaa7
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\system32\wwahost.exe
Berichts-ID: 46a6602d-25db-11e6-82fd-c3442d4ae9c0
Vollständiger Name des fehlerhaften Pakets: GJDigitalGmbH.BRIGITTE.deApp_1.1.0.29_neutral__kekzhddbb11ja
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Systemfehler:
=============
Error: (05/30/2016 04:22:39 AM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/30/2016 04:22:09 AM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/29/2016 10:59:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/29/2016 10:59:03 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Rhea\AppData\Local\Temp\ehdrv.sys
Error: (05/29/2016 10:59:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/29/2016 10:59:02 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Rhea\AppData\Local\Temp\ehdrv.sys
Error: (05/29/2016 10:59:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/29/2016 10:59:02 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Rhea\AppData\Local\Temp\ehdrv.sys
Error: (05/29/2016 10:46:50 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (05/29/2016 10:46:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ymc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Prozentuale Nutzung des RAM: 44%
Installierter physikalischer RAM: 3979.22 MB
Verfügbarer physikalischer RAM: 2197.78 MB
Summe virtueller Speicher: 4683.22 MB
Verfügbarer virtueller Speicher: 2667.79 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.74 GB) (Free:341.32 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.99 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 9E01DD02)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
30.05.2016, 14:43
| #9 |
| /// TB-Ausbilder | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Bitte noch meine Frage beantworten. |
|
30.05.2016, 14:43
| #10 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox das log von zoek wird nicht hübscher..., was Irregularitäten im Betrieb des Rechners angeht, scheinen sie beseitigt, während ich noch nicht viel Zeit hatte, ihn wirklich zu benutzen. Darf ich mich melden, falls doch noch auffällt? Danke dir! |
|
30.05.2016, 15:13
| #11 | |||||||||||
| /// TB-Ausbilder | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox Servus, Zitat:
Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\SpyBot Search Destroy - CHIP-Installer.exe
C:\Users\Rhea\Downloads\Anwendungen\Joomla und Co\FileZilla_3.10.3_win64-setup.exe
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{2DE6463C-048A-4117-84FF-FE503B6EAE3C}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{8B4DBC04-437F-40C0-9ACC-7BB85B0B7865}
DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f9131ea5-c2e2-4bcf-b0f3-b2d7ed6edc76}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird! Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.  Cleanup: Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:
Microsoft Security Essentials (MSE) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE entschieden hast, brauchst du nicht extra MSE zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür. Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  Adblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren. NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen:
Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst... und/oder das Forum mit einer kleinen Spende  unterstützen.  Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
30.05.2016, 21:46
| #12 |
| | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFoxCode:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:29-05-2016 02
durchgeführt von Rhea (2016-05-30 16:31:03) Run:4
Gestartet von C:\Users\Rhea\Desktop
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
start
CloseProcesses:
C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\SpyBot Search Destroy - CHIP-Installer.exe
C:\Users\Rhea\Downloads\Anwendungen\Joomla und Co\FileZilla_3.10.3_win64-setup.exe
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{2DE6463C-048A-4117-84FF-FE503B6EAE3C}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{8B4DBC04-437F-40C0-9ACC-7BB85B0B7865}
DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f9131ea5-c2e2-4bcf-b0f3-b2d7ed6edc76}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
DeleteKey: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
EmptyTemp:
end
*****************
Prozess erfolgreich geschlossen.
C:\Users\Rhea\Downloads\Anwendungen\Viren und Spyware\SpyBot Search Destroy - CHIP-Installer.exe => erfolgreich verschoben
C:\Users\Rhea\Downloads\Anwendungen\Joomla und Co\FileZilla_3.10.3_win64-setup.exe => erfolgreich verschoben
HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Classes\Interface\{2DE6463C-048A-4117-84FF-FE503B6EAE3C} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKLM\SOFTWARE\Classes\Interface\{2DE6463C-048A-4117-84FF-FE503B6EAE3C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Classes\Interface\{8B4DBC04-437F-40C0-9ACC-7BB85B0B7865} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKLM\SOFTWARE\Classes\Interface\{8B4DBC04-437F-40C0-9ACC-7BB85B0B7865} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f9131ea5-c2e2-4bcf-b0f3-b2d7ed6edc76} => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel nicht gefunden.
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\Wow6432Node\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4} => Schlüssel nicht gefunden.
EmptyTemp: => 19.3 MB temporäre Dateien entfernt.
Das System musste neu gestartet werden.
==== Ende von Fixlog 16:31:10 ====
 Ich finde auch die Informationen über die Vermeidung einer Neuinfektion sehr hilfreich.Ich hätte noch 2 Fragen und 1ne Bitte: -Ist die Kombi Spybot und Microsoft Security Essentials sinnvoll? -kann es sein, dass die chip-download.Infektion sehr alt ist und schon einmal umfassend bereinigt wurde sich aber zwischenzeitlich wieder neues Mistzeug aus dem Netz gezogen hat? -http://www.trojaner-board.de/179086-...infektion.html ist der Thread meines Mannes, der eine ähnlliche Symptomatik hat, wie ich. Hättest Du auch Zeit für ihn? Hallo, Matthias, es gibt leider doch noch Probleme, allerdings nun an anderen Orten als an den Internetbrowsern: -Rechner insgesamt merklich langsamer - Thunderbird "hängt" immer wieder, trotz Neustart. Fehlermeldung idem der initialen IE-Fehlermeldung (Auswahl: "Programm schliessen" vs. "erneut versuchen") zudem hat sich der "Senden" Icon verändert. - verschiedene Dateien (jpg) lassen sich erst nach Neustart öffnen. Fehlermeldung: "Sie können diese Dateien nicht als Administrator ausführen" - der Desktop hat iwie gelitten, da sind kaum noch Dateien drauf... ...mich dünkt, da könnten mir noch viel mehr Probleme auffallen, je länger ich den Rechner benutze. Geändert von mamaimapril (30.05.2016 um 22:03 Uhr) |
|
31.05.2016, 20:28
| #13 | |
| /// TB-Ausbilder | Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFoxZitat:
Nach den letzten Logdateien ist dein Rechner sauber. Was auf anderen Rechnern passiert, kann ich nicht beurteilen. Sollte es immer noch Probleme geben, dann kannst du immer noch die privaten Daten sichern und den Rechner neu aufsetzen. Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
| Themen zu Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox |
| abstürzen, cpu, desktop, device driver, dnsapi.dll, error, firefox, flash player, helper, home, homepage, hängen, iexplore.exe, installation, internet, internet explorer, problem, proxy, prozesse, registry, server, svchost.exe, taskmanager, usb, werbung, windows, wlan |
und 
und speichere die Logdatei auf Deinem Desktop.
