| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Browser Hijacker nova.rumbler.ru gefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.01.2017, 13:49
| #16 |
 |  Browser Hijacker nova.rumbler.ru gefangen FRST Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2017
durchgeführt von Sebastian (Administrator) auf MICASA (16-01-2017 13:43:30)
Gestartet von C:\Users\Sebastian\Desktop
Geladene Profile: Sebastian (Verfügbare Profile: Sebastian)
Platform: Windows 10 Home Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsAgent.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
() C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Sophos Limited) C:\Program Files\Sophos\Sophos Data Recorder\SDRService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
() C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe
(Sophos Limited) C:\Program Files\Sophos\Sophos System Protection\ssp.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsClient.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Electronic Arts) D:\Origin\OriginWebHelperService.exe
(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouseCore.exe
(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\System\3DG4me.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7805.42277.0_x64__8wekyb3d8bbwe\HxMail.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7805.42277.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.10221.0_x64__8wekyb3d8bbwe\Video.UI.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1612.3341.0_x64__8wekyb3d8bbwe\Calculator.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040792 2015-07-15] (Realtek Semiconductor)
HKLM\...\Run: [3DG4me] => C:\WINDOWS\System\3DG4me.exe [151552 2013-05-28] ()
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1480176 2016-10-06] (Sophos Limited)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [1207808 2016-12-09] (Cisco Systems, Inc.)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [Steam] => D:\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [GalaxyClient] => D:\GalaxyClient\GalaxyClient.exe [3971648 2017-01-15] (GOG.com)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [Spotify Web Helper] => C:\Users\Sebastian\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1524336 2016-04-12] (Spotify Ltd)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [uTorrent] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe [1979072 2017-01-13] (BitTorrent Inc.)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [icq.desktop] => C:\Users\Sebastian\AppData\Roaming\ICQ\bin\icq.exe [30170328 2016-04-05] ()
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [AirDroid 3] => C:\Program Files (x86)\AirDroid\AirDroid.exe [8608888 2016-12-13] (Sand Studio)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8810200 2016-06-10] (Piriform Ltd)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\sophos_detoured.dll [207864 2016-09-13] (Sophos Limited)
ShellIconOverlayIdentifiers: [ MagentaOverlayIconCheck] -> {c80109bf-013d-343d-a627-d2a5213efafc} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIconError] -> {bb6644a0-636d-3808-95f1-2e267c49e9c2} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIconSync] -> {72dbcbb5-55c9-36cd-a56d-bb2491861618} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIcon1] -> {8ec6dd7e-fece-30b6-a924-9f002415595d} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIcon2] -> {b0211a8e-58b3-3932-9689-32d644a0828a} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIcon3] -> {3465eba8-d186-3b9c-870b-0c418f7dd282} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MagentaOverlayIcon4] -> {6f195ec8-0779-3aa2-85b3-a43e7f3ef055} => c:\windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2016-03-06]
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)
Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip [2016-06-22] ()
Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagentaCLOUD.lnk [2016-04-08]
ShortcutTarget: MagentaCLOUD.lnk -> C:\Users\Sebastian\AppData\Roaming\Telekom\MagentaCloud\MagentaCloud.App.exe ()
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4846ce9a-c26b-4d21-8f6a-68ce95eab118}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{afe46b60-ff9b-4cc6-bd16-17b4cc2fa14c}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{cef7a83d-546a-42a1-9e7e-bf73509c81c0}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\Software\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-01-11] (Microsoft Corporation)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2016-03-06] (LastPass)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-01-11] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-01-11] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2016-01-07] (Oracle Corporation)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2016-03-06] (LastPass)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-01-11] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2016-01-07] (Oracle Corporation)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2016-03-06] (LastPass)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2016-03-06] (LastPass)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-11] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-11] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-11] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-11] (Microsoft Corporation)
FireFox:
========
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2016-03-06] (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Keine Datei]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2016-01-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2016-01-07] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2016-03-06] (LastPass)
FF Plugin-x32: @logitech.com/HarmonyRemote,version=1.0.0 -> C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll [2012-09-28] (Logitech Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-01-11] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-01-11] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-12-11] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-12-11] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-20] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-20] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1585825436-704687126-3158100386-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2017-01-09] ()
Chrome:
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxp://google.de/","hxxp://avg.nation.com/avgtbavg/search/home?cid={1E4F1280-4B18-46D1-9385-7068B2A90700}&mid=1f6a9e5389bc47d39c41d9a4ff3c6cf1-75473c4f0acddff29a510c8cda5f5cbfcb604a63&lang=de&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-05 15:36:15&v=17.0.1.12&pid=nation&sg=&sap=hp&cmpid=0913b","hxxp://homepage-web.com/?s=acer&m=start"
CHR Profile: C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default [2017-01-16]
CHR Extension: (Google Präsentationen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-30]
CHR Extension: (Google Docs) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-30]
CHR Extension: (Google Drive) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (Adblock Plus) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-26]
CHR Extension: (Google-Suche) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Adobe Acrobat) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-01-12]
CHR Extension: (Google Tabellen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-30]
CHR Extension: (Vysor) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gidgenkbbabolejbgbpnhbimgjbffefm [2017-01-11]
CHR Extension: (TinEye Reverse Image Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2016-08-27]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-01-09]
CHR Extension: (Privacy Palette) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjkcflkplhgpebknipkekjggglimnone [2015-06-30]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (MyHarmony Chrome Plugin) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\omaonpoimgkmbllpdihbnmgphjoipdhf [2016-01-03]
CHR Extension: (Fast search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2017-01-15]
CHR Extension: (Google Mail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-30]
CHR Extension: (Inbox by Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkclgpgponpjmpfokoepglboejdobkpl [2015-10-16]
CHR Extension: (Chrome Media Router) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-15]
CHR HKLM\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [omaonpoimgkmbllpdihbnmgphjoipdhf] - C:\Program Files (x86)\Logitech\Harmony Remote Driver\harmony_chrome.crx [2016-01-03]
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [463112 2014-07-31] ()
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1860616 2016-06-04] ()
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-10-03] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
S3 GalaxyClientService; D:\GalaxyClient\GalaxyClientService.exe [284224 2017-01-15] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6625856 2016-11-17] (GOG.com)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [464440 2017-01-06] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [464440 2017-01-06] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [459832 2016-12-11] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [427064 2017-01-06] (NVIDIA Corporation)
S3 Origin Client Service; D:\Origin\OriginClientService.exe [2119688 2016-12-07] (Electronic Arts)
R2 Origin Web Helper Service; D:\Origin\OriginWebHelperService.exe [2180624 2016-12-07] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-07-02] ()
R2 RemoteMouseService; C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe [18432 2016-06-25] () [Datei ist nicht signiert]
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [229672 2016-09-13] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [200064 2016-09-13] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [780432 2016-10-06] (Sophos Limited)
R2 Sophos MCS Agent; C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsAgent.exe [1379856 2016-09-04] (Sophos Limited)
R2 Sophos MCS Client; C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsClient.exe [1805368 2016-09-04] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [360040 2016-09-13] (Sophos Limited)
R2 SophosDataRecorderService; C:\Program Files\Sophos\Sophos Data Recorder\SDRService.exe [996240 2016-09-12] (Sophos Limited)
R2 sophossps; C:\Program Files\Sophos\Sophos System Protection\ssp.exe [5366040 2016-09-12] (Sophos Limited)
R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [475384 2016-09-13] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3644368 2016-09-13] (Sophos Limited)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2016-07-15] (ASRock Incorporation)
R0 AsrRamDisk; C:\WINDOWS\System32\drivers\AsrRamDisk.sys [40200 2013-08-02] (ASRock Inc.)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2015-10-04] (BitRaider)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 netr28ux; C:\WINDOWS\System32\drivers\netr28ux.sys [2224128 2016-07-16] (MediaTek Inc.)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_3f929cc119e3b994\nvlddmkm.sys [14200880 2016-12-12] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [29240 2017-01-06] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [47672 2017-01-06] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [59448 2017-01-06] (NVIDIA Corporation)
R1 SAVOnAccess; C:\WINDOWS\System32\DRIVERS\savonaccess.sys [201168 2016-09-13] (Sophos Limited)
S3 sdcfilter; C:\WINDOWS\system32\DRIVERS\sdcfilter.sys [38144 2016-09-13] (Sophos Limited)
S4 SophosBootDriver; C:\WINDOWS\system32\DRIVERS\SophosBootDriver.sys [27904 2016-09-13] (Sophos Limited)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 swi_callout; C:\WINDOWS\system32\DRIVERS\swi_callout.sys [47760 2016-09-13] (Sophos Limited)
S3 USBADVAU; C:\WINDOWS\system32\drivers\cm11264.sys [4121088 2012-11-29] (C-Media Electronics Inc)
S1 vflt; C:\WINDOWS\system32\DRIVERS\vfilter.sys [24064 2013-07-01] (Shrew Soft Inc) [Datei ist nicht signiert]
S3 vnet; C:\WINDOWS\System32\drivers\virtualnet.sys [17408 2013-07-01] (Shrew Soft Inc) [Datei ist nicht signiert]
S3 vpnva; C:\WINDOWS\System32\drivers\vpnva64-6.sys [52592 2015-12-23] (Cisco Systems, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-01-16 13:43 - 2017-01-16 13:43 - 00000000 ____D C:\Users\Sebastian\Desktop\FRST-OlderVersion
2017-01-16 08:18 - 2017-01-16 08:18 - 55056454 _____ C:\Users\Sebastian\Downloads\SFGBACC02001D_GBRegeblbuchS3_7aaf.pdf
2017-01-16 08:18 - 2017-01-16 08:18 - 10835662 _____ C:\Users\Sebastian\Downloads\GuildBall_FeldspielerkartenSaison3_949f.zip
2017-01-15 15:22 - 2017-01-15 15:22 - 00001265 _____ C:\Users\Sebastian\Desktop\JRT.txt
2017-01-15 15:10 - 2017-01-16 12:23 - 00000000 ____D C:\AdwCleaner
2017-01-15 15:09 - 2017-01-15 15:20 - 01663040 _____ (Malwarebytes) C:\Users\Sebastian\Desktop\JRT.exe
2017-01-15 15:04 - 2017-01-15 15:04 - 03988944 _____ C:\Users\Sebastian\Desktop\AdwCleaner_6.042.exe
2017-01-15 14:56 - 2017-01-15 15:11 - 00173842 _____ C:\TDSSKiller.3.1.0.12_15.01.2017_14.56.03_log.txt
2017-01-15 14:31 - 2017-01-15 14:55 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sebastian\Desktop\tdsskiller.exe
2017-01-15 14:26 - 2017-01-15 14:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-01-15 14:26 - 2017-01-15 14:30 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-01-15 14:26 - 2017-01-15 14:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-15 14:25 - 2017-01-15 14:55 - 00000000 ____D C:\Users\Sebastian\Desktop\mbar
2017-01-15 14:25 - 2017-01-15 14:25 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2017-01-15 14:22 - 2017-01-15 14:24 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Sebastian\Desktop\mbar-1.09.3.1001.exe
2017-01-15 13:36 - 2017-01-15 13:42 - 00077688 _____ C:\Users\Sebastian\Desktop\Addition.txt
2017-01-15 13:15 - 2017-01-16 13:44 - 00028984 _____ C:\Users\Sebastian\Desktop\FRST.txt
2017-01-15 13:15 - 2017-01-16 13:43 - 00000000 ____D C:\FRST
2017-01-15 13:12 - 2017-01-16 13:43 - 02419200 _____ (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2017-01-15 10:57 - 2017-01-15 10:57 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2017-01-15 10:57 - 2016-12-11 19:23 - 00134712 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2017-01-15 10:57 - 2016-09-09 19:25 - 00269600 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2017-01-15 10:57 - 2016-09-09 19:25 - 00261920 _____ C:\WINDOWS\system32\vulkan-1.dll
2017-01-15 10:57 - 2016-09-09 19:25 - 00110880 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2017-01-15 10:57 - 2016-09-09 19:24 - 00125216 _____ C:\WINDOWS\system32\vulkaninfo.exe
2017-01-15 10:54 - 2016-12-12 04:03 - 40125496 _____ C:\WINDOWS\system32\nvcompiler.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 35222976 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 34710584 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 28201408 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 10912744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvptxJitCompiler.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 10803880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 10353960 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 09158616 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 08913328 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 08761560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 02950200 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 02587704 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 01953336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6437633.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 01586744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6437633.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 01038392 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00974784 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00942528 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00894400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00802768 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00801560 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFThevc.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00683640 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvfatbinaryLoader.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00643928 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00642392 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFThevc.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00617696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmcumd.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00572888 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00438208 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00394888 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00388544 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00386104 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00347072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
2017-01-15 10:54 - 2016-12-12 04:03 - 00327408 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2017-01-15 10:44 - 2017-01-15 10:56 - 00000000 ____D C:\WINDOWS\LastGood
2017-01-15 10:44 - 2017-01-06 02:10 - 00158264 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2017-01-15 10:44 - 2017-01-06 02:10 - 00126008 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2017-01-15 10:44 - 2017-01-06 02:10 - 00059448 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvhci.sys
2017-01-15 10:44 - 2017-01-06 01:09 - 00001951 _____ C:\WINDOWS\NvTelemetryContainerRecovery.bat
2017-01-15 02:22 - 2016-11-09 16:52 - 08003880 _____ C:\Users\Sebastian\Desktop\tyranny_shortstories.pdf
2017-01-15 02:18 - 2017-01-15 03:53 - 117449122 _____ C:\Users\Sebastian\Downloads\tyranny_wallpapers.zip
2017-01-15 02:16 - 2017-01-15 02:21 - 06624854 _____ C:\Users\Sebastian\Downloads\tyranny_shortstories (2).zip
2017-01-14 22:21 - 2017-01-14 22:21 - 00000000 ____D C:\Users\Sebastian\.android
2017-01-14 22:15 - 2017-01-14 22:15 - 00000000 ____D C:\Users\Sebastian\Desktop\ADB
2017-01-13 20:45 - 2017-01-13 21:03 - 00000000 ____D C:\Users\Sebastian\AppData\LocalLow\uTorrent
2017-01-12 22:37 - 2017-01-12 22:37 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_WinUSB_01007.Wdf
2017-01-12 22:37 - 2017-01-12 22:37 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-01-12 13:11 - 2017-01-12 13:30 - 00019518 _____ C:\Users\Sebastian\Downloads\Kopie von 2017 BKT - Teilnehmerliste.xlsx
2017-01-11 17:12 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-01-11 17:12 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll
2017-01-11 17:12 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-01-11 17:12 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-01-11 17:12 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2017-01-11 17:12 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-01-11 17:12 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-01-11 17:12 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-11 17:12 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-11 17:12 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-11 17:12 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-11 17:12 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-01-11 17:12 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-01-11 17:12 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-01-11 17:12 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-11 17:12 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-11 17:12 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-01-11 17:12 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-01-11 17:12 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-01-11 17:12 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-01-11 17:12 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-11 17:12 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-01-11 17:12 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-11 17:12 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-11 17:12 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-01-11 17:12 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-01-11 17:12 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-01-11 17:12 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2017-01-11 17:12 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-01-11 17:12 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-01-11 17:12 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2017-01-11 17:12 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
2017-01-11 17:12 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-01-11 17:12 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-01-11 17:12 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-01-11 17:12 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2017-01-11 17:12 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2017-01-11 17:12 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2017-01-11 17:12 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-11 17:12 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-11 17:12 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-11 17:12 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2017-01-11 17:12 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2017-01-11 17:12 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-01-11 17:12 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-11 17:12 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-11 17:12 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-01-11 17:12 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-01-11 17:12 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-01-11 17:12 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2017-01-11 17:12 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2017-01-11 17:12 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-01-11 17:12 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-01-11 17:12 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2017-01-11 17:12 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-01-11 17:12 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2017-01-11 17:12 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-01-11 17:12 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-01-11 17:12 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-01-11 17:12 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-01-11 17:11 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-01-11 17:11 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-11 17:11 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-01-11 17:11 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-11 17:11 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-01-11 17:11 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-11 17:11 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-11 17:11 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2017-01-11 17:11 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-11 17:11 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2017-01-11 17:11 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-11 17:11 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-11 17:11 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-01-11 17:11 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-11 17:11 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2017-01-11 17:11 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-11 17:11 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-01-11 17:11 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-01-11 17:11 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-01-11 17:11 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-11 17:11 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-01-11 17:11 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-01-11 17:11 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-01-11 17:11 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-11 17:11 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-01-11 17:11 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2017-01-11 17:11 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-11 17:11 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-01-11 17:11 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-11 17:11 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-11 17:11 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-11 17:11 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-11 17:11 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2017-01-11 17:11 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-01-11 17:11 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-11 17:11 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-11 17:11 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-01-11 17:11 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-11 17:11 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-11 17:11 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-01-11 17:11 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-01-11 17:11 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2017-01-11 17:11 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-11 17:11 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2017-01-11 17:11 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-01-11 17:11 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-01-11 17:11 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-01-11 17:11 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-01-11 17:11 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-11 17:11 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-01-11 17:11 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-01-11 17:11 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-01-11 17:11 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-01-11 17:11 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-11 17:11 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-01-11 17:11 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-01-11 17:11 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-01-11 17:11 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-01-11 17:11 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-01-11 17:11 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-11 17:11 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2017-01-11 17:11 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-11 17:11 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-01-11 17:11 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2017-01-11 17:11 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2017-01-11 17:11 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-11 17:11 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-11 17:11 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-01-11 17:11 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-01-11 17:11 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-01-11 17:11 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2017-01-11 17:11 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2017-01-11 17:11 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2017-01-11 17:11 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2017-01-11 17:11 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 17:11 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-01-11 17:11 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-01-11 17:11 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-11 17:11 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-01-11 17:11 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 17:11 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2017-01-11 17:11 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-01-11 17:11 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-11 17:11 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-01-11 17:11 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-11 17:11 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2017-01-11 17:11 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-01-11 17:11 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-01-11 17:11 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2017-01-11 17:11 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-01-11 17:11 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2017-01-11 17:11 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-01-11 17:11 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-01-11 17:11 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2017-01-11 17:11 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-01-11 17:11 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-01-11 17:11 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-01-11 17:11 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-01-11 17:11 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-11 17:11 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-11 17:11 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-01-11 10:41 - 2017-01-11 10:41 - 00002587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002583 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002537 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002300 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive for Business.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002270 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002252 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002212 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00002182 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2017-01-11 10:41 - 2017-01-11 10:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016-Tools
2017-01-11 10:34 - 2017-01-11 10:34 - 00000000 ____D C:\Program Files\Microsoft Office 15
2017-01-10 16:10 - 2016-09-13 22:24 - 00047760 _____ (Sophos Limited) C:\WINDOWS\system32\Drivers\swi_callout.sys
2017-01-10 16:10 - 2016-09-13 22:24 - 00044304 _____ (Sophos Limited) C:\WINDOWS\system32\SophosBootTasks.exe
2017-01-10 10:47 - 2017-01-10 10:47 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Brice_Lambson
2017-01-10 10:45 - 2017-01-10 10:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Image Resizer for Windows
2017-01-10 10:45 - 2017-01-10 10:45 - 00000000 ____D C:\Program Files\Image Resizer for Windows
2017-01-10 10:45 - 2017-01-10 10:45 - 00000000 ____D C:\Program Files (x86)\Image Resizer for Windows
2017-01-10 09:55 - 2017-01-10 09:55 - 02558695 _____ C:\Users\Sebastian\Downloads\magentacloud-14.12 Knochenaugmentation .zip
2017-01-08 22:08 - 2017-01-08 22:08 - 00414657 _____ C:\Users\Sebastian\Desktop\10.1177_0022034514549378.pdf
2017-01-08 14:11 - 2017-01-08 14:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco
2017-01-08 14:07 - 2017-01-08 14:07 - 00000000 ____D C:\Users\Sebastian\.cisco
2017-01-08 14:05 - 2017-01-08 14:11 - 00000000 ____D C:\ProgramData\Cisco
2017-01-08 14:05 - 2017-01-08 14:11 - 00000000 ____D C:\Program Files (x86)\Cisco
2017-01-08 14:05 - 2017-01-08 14:05 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Cisco
2017-01-08 14:05 - 2016-12-09 16:43 - 00244032 ____R (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\acsock64.sys
2017-01-02 23:44 - 2017-01-02 23:44 - 00226216 _____ C:\Users\Sebastian\Downloads\Parodontologische Epikrise cmd Sebastian Fox.pdf
2017-01-02 16:55 - 2017-01-02 16:55 - 00003280 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2016-12-28 13:29 - 2017-01-02 18:26 - 00000000 ____D C:\Users\Sebastian\Desktop\MUSIC
2016-12-20 13:10 - 2016-12-20 13:10 - 00053495 _____ C:\Users\Sebastian\Downloads\Begruessungsschreiben_Zusatzdienste-04.12.2014.pdf
2016-12-20 13:03 - 2016-12-20 13:03 - 00053048 _____ C:\Users\Sebastian\Downloads\Auftragsbestaetigung_Zusatzdienste-04.12.2014.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-01-16 12:49 - 2016-05-12 14:51 - 00000000 ____D C:\Users\Sebastian\AppData\Local\SquirrelTemp
2017-01-16 12:27 - 2016-10-17 12:18 - 00000000 ____D C:\ProgramData\NVIDIA
2017-01-16 12:26 - 2016-12-03 18:43 - 00003024 _____ C:\WINDOWS\System32\Tasks\AsrSP.exe
2017-01-16 12:25 - 2016-10-17 12:35 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-01-16 12:23 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-01-16 11:39 - 2016-10-17 12:16 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-01-16 09:46 - 2016-10-29 12:36 - 00000000 ____D C:\Users\Sebastian\Desktop\Bildas
2017-01-16 06:46 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-15 20:35 - 2016-10-17 12:21 - 00000000 ____D C:\Users\Sebastian
2017-01-15 14:02 - 2016-11-28 23:49 - 00000000 ____D C:\Willi Stick
2017-01-15 11:19 - 2016-05-29 11:44 - 00000000 ____D C:\Users\Sebastian\Documents\PCSX2
2017-01-15 10:58 - 2016-10-17 12:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-01-15 10:58 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-01-15 10:58 - 2016-07-15 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-01-15 10:50 - 2016-03-08 10:13 - 00000000 ____D C:\Users\Sebastian\Desktop\Seltene Proggis
2017-01-15 10:47 - 2016-07-17 11:48 - 01643192 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-15 10:47 - 2016-07-16 23:51 - 00590596 _____ C:\WINDOWS\system32\perfh007.dat
2017-01-15 10:47 - 2016-07-16 23:51 - 00115538 _____ C:\WINDOWS\system32\perfc007.dat
2017-01-15 10:45 - 2016-10-23 11:42 - 00003884 _____ C:\WINDOWS\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:45 - 2016-07-15 18:29 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA
2017-01-15 10:44 - 2016-10-23 11:42 - 00003894 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:44 - 2016-10-23 11:42 - 00003866 _____ C:\WINDOWS\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:44 - 2016-10-23 11:42 - 00003858 _____ C:\WINDOWS\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:44 - 2016-10-23 11:42 - 00003696 _____ C:\WINDOWS\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:44 - 2016-10-23 11:42 - 00003654 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-01-15 10:44 - 2016-10-17 12:17 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-01-15 10:44 - 2016-10-17 12:17 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-01-15 10:44 - 2016-07-15 18:29 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA Corporation
2017-01-15 02:25 - 2016-12-13 10:31 - 00000000 ____D C:\AirDroid
2017-01-15 02:25 - 2015-10-31 13:47 - 00000000 ____D C:\Users\Sebastian\Documents\AirDroid
2017-01-15 02:08 - 2016-07-11 10:54 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps
2017-01-15 02:08 - 2015-06-30 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2017-01-15 02:04 - 2015-07-01 21:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2017-01-14 20:32 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-01-14 01:18 - 2016-01-28 00:24 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\uTorrent
2017-01-13 22:19 - 2015-07-04 19:32 - 00000000 ____D C:\Users\Sebastian\AppData\LocalLow\Obsidian Entertainment
2017-01-13 20:43 - 2016-03-08 10:13 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Usenet.nl
2017-01-13 20:42 - 2016-04-06 10:40 - 00000000 ____D C:\Users\Sebastian\Downloads\Usenet
2017-01-13 20:26 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-13 19:12 - 2015-07-01 04:56 - 00000000 ___RD C:\Users\Sebastian\MagentaCLOUD
2017-01-13 15:59 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-12 22:21 - 2015-09-03 11:47 - 00000000 ____D C:\Users\Sebastian\Desktop\Unikrams
2017-01-12 13:30 - 2015-06-30 17:51 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Packages
2017-01-12 13:18 - 2015-07-03 08:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-12 13:17 - 2016-02-07 10:33 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-12 13:16 - 2016-10-17 12:35 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-12 13:03 - 2016-04-27 06:56 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-11 20:14 - 2016-10-17 12:16 - 00353376 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-01-11 20:12 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-11 20:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-11 20:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-11 20:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-11 20:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-01-11 19:02 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-11 10:59 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-01-11 10:34 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-01-11 10:21 - 2015-06-30 17:59 - 00000000 __RDO C:\Users\Sebastian\OneDrive
2017-01-10 16:11 - 2015-08-12 22:07 - 00000000 ____D C:\ProgramData\Sophos
2017-01-10 15:58 - 2016-06-16 11:02 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\vlc
2017-01-10 10:45 - 2014-08-01 05:25 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-09 20:13 - 2015-06-30 18:48 - 00000000 ____D C:\Users\Sebastian\AppData\Local\CrashDumps
2017-01-09 15:17 - 2016-01-06 22:38 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Origin
2017-01-09 15:17 - 2016-01-06 22:37 - 00000000 ____D C:\ProgramData\Origin
2017-01-09 15:07 - 2015-09-28 05:19 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Ubisoft Game Launcher
2017-01-08 16:03 - 2016-08-01 21:01 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\dvdcss
2017-01-06 02:10 - 2016-10-23 11:42 - 01855544 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2017-01-06 02:10 - 2016-10-23 11:42 - 01756728 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2017-01-06 02:10 - 2016-10-23 11:42 - 01454136 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2017-01-06 02:10 - 2016-10-23 11:42 - 01318968 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2017-01-06 02:10 - 2016-10-23 11:42 - 00121912 _____ C:\WINDOWS\system32\NvRtmpStreamer64.dll
2017-01-06 02:10 - 2016-10-23 11:42 - 00047672 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2017-01-02 22:28 - 2015-07-04 19:44 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\TS3Client
2017-01-02 18:04 - 2016-05-12 14:52 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\WhatsApp
2017-01-02 16:55 - 2016-07-17 12:09 - 00002435 _____ C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-21 06:04 - 2016-01-06 22:36 - 00000000 ____D C:\Users\Sebastian\AppData\Local\ElevatedDiagnostics
2016-12-20 13:19 - 2016-10-17 12:35 - 00003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-12-20 13:19 - 2016-10-17 12:35 - 00003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-12-20 13:19 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Tasks
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2016-03-06 19:27 - 2016-03-06 19:27 - 21405208 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
2016-07-15 18:40 - 2016-07-15 18:40 - 0000017 _____ () C:\Users\Sebastian\AppData\Local\resmon.resmoncfg
2015-08-26 10:03 - 2015-08-26 10:03 - 0005219 _____ () C:\Users\Sebastian\AppData\Local\transitiontransition_9237a2690e8a06e6e509f66bf7085492.ini
2015-07-03 08:34 - 2015-07-03 08:34 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-10-17 12:18 - 2016-10-17 12:18 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\Adblocker.exe
C:\Users\Sebastian\AppData\Local\Temp\MMIns.exe
C:\Users\Sebastian\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Sebastian\AppData\Local\Temp\nvStInst.exe
C:\Users\Sebastian\AppData\Local\Temp\NvTelemetry.dll
C:\Users\Sebastian\AppData\Local\Temp\NvTelemetryAPI32.dll
C:\Users\Sebastian\AppData\Local\Temp\NvTelemetryAPI64.dll
C:\Users\Sebastian\AppData\Local\Temp\octCEC7.tmp.exe
C:\Users\Sebastian\AppData\Local\Temp\SetupScreenShared.exe
C:\Users\Sebastian\AppData\Local\Temp\VideoBox.exe
C:\Users\Sebastian\AppData\Local\Temp\wajam_install.exe
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-01-16 12:35
==================== Ende von FRST.txt ============================
|
|
16.01.2017, 13:51
| #17 |
| | Browser Hijacker nova.rumbler.ru gefangen Addition.txt
__________________Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-01-2017
durchgeführt von Sebastian (16-01-2017 13:45:15)
Gestartet von C:\Users\Sebastian\Desktop
Windows 10 Home Version 1607 (X64) (2016-10-17 11:44:45)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1585825436-704687126-3158100386-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1585825436-704687126-3158100386-503 - Limited - Disabled)
Gast (S-1-5-21-1585825436-704687126-3158100386-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1585825436-704687126-3158100386-1019 - Limited - Enabled)
Sebastian (S-1-5-21-1585825436-704687126-3158100386-1001 - Administrator - Enabled) => C:\Users\Sebastian
SophosSAUMICASA0 (S-1-5-21-1585825436-704687126-3158100386-1004 - Limited - Enabled)
SophosSAUMICASA1 (S-1-5-21-1585825436-704687126-3158100386-1017 - Limited - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Sophos Home (Enabled - Up to date) {FFADE7EA-DC92-4602-D6B2-626CD3450A0F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Home (Enabled - Up to date) {44CC060E-FAA8-498C-EC02-591EA8C240B2}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
"Nero SoundTrax Help (x32 Version: 4.4.32.0 - Nero AG) Hidden
µTorrent (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\uTorrent) (Version: 3.4.9.43085 - BitTorrent Inc.)
Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2005.0 - Acer Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.023.20053 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
AirDroid 3.2.0.0 (HKLM-x32\...\AirDroid) (Version: 3.2.0.0 - Sand Studio)
Amazon Kindle (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\Amazon Kindle) (Version: 1.16.0.44025 - Amazon)
AnimanicChat Version 4.2.365 (HKLM-x32\...\AnimanicChat_is1) (Version: 4.2.365 - )
Ansel (Version: 376.33 - NVIDIA Corporation) Hidden
ASRock XFast RAM v3.0.3 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.)
A-Tuning v2.0.271 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.271 - ASRock Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Bonjour (HKLM-x32\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.)
calibre 64bit (HKLM\...\{489E20EA-CCB7-4B03-A9A9-10BA7E460A21}) (Version: 2.66.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 4.3.05017 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 4.3.05017 - Cisco Systems, Inc.) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (HKLM-x32\...\{35A2FE53-CC80-4D17-941F-3A7C82824FC7}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ The Ultimate Collection Additional Content (HKLM-x32\...\{1A882F29-BC18-4AC2-A71E-0FC30FA32568}) (Version: 1.0.0.0 - Electronic Arts)
Core Temp 1.1 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.1 - Alcpu)
Corel PaintShop Pro X7 (HKLM-x32\...\_{176F50D6-6857-49CE-B731-65F757EE3F0D}) (Version: 17.0.0.199 - Corel Corporation)
Corel PaintShop Pro X7 (x32 Version: 17.0.0.199 - Corel Corporation) Hidden
Curse Client (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.844 - Curse)
Deus Ex: Mankind Divided™ (HKLM\...\Steam App 337000) (Version: - Eidos Montreal)
Die Sims™ 3 Reiseabenteuer (HKLM-x32\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)
DolbyFiles (x32 Version: 2.0 - Nero AG) Hidden
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version: - Klei Entertainment)
EPSON XP-402 403 405 406 Series Printer Uninstall (HKLM\...\EPSON XP-402 403 405 406 Series) (Version: - SEIKO EPSON Corporation)
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Gwent (HKLM-x32\...\1971477531_is1) (Version: 2.0.0.0 - GOG.com)
Harmony Browser Plug-in (HKLM-x32\...\{634F79E1-2A41-4C40-9E8D-89EC740AC9D6}) (Version: 2.0 - Logitech)
Heroes & Generals (HKLM\...\Steam App 227940) (Version: - Reto-Moto)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hotkey Utility (HKLM-x32\...\{A6DC88AD-501A-44BC-884D-57435F972E2C}) (Version: 3.00.8104 - Acer Incorporated)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{15B2F0E3-3FAC-4495-B0FD-398EECFA4100}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Deskjet 3520 series Setup Guide (HKLM-x32\...\{AEEDCEB7-00B8-4BE1-B492-AB04803D5F1E}) (Version: 27.0.0 - Hewlett Packard)
ICA (x32 Version: 17.0.0.199 - Corel Corporation) Hidden
ICQ (Version 10.0.12027) (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\icq.desktop) (Version: 10.0.12027 - ICQ)
Image Resizer for Windows (64 bit) (HKLM\...\{B6EFF29D-7CAB-4CE0-9FFC-3D55D27E948D}) (Version: 3.0.4442.6002 - Brice Lambson)
Image Resizer for Windows (HKLM-x32\...\{14ebe571-096e-4cdd-8ee5-a2c0cc6b9b5e}) (Version: 3.0.4442.6002 - Brice Lambson)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Infix PDF Editor Version 7.0.5.0 (HKLM-x32\...\83FFB914-6FA7-4F1F-807E-E0FFBA2E49E1_is1) (Version: 7.0.5.0 - Iceni Technology)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Network Connections 19.0.27.0 (HKLM\...\PROSetDX) (Version: 19.0.27.0 - Intel)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.1.1.9 - Intel(R) Corporation) Hidden
IPM_PSP_COM (x32 Version: 17.0.0.199 - Corel Corporation) Hidden
IPM_PSP_COM64 (Version: 17.0.0.199 - Corel Corporation) Hidden
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Kingdom Come: Deliverance (Beta Access) (HKLM\...\Steam App 286860) (Version: - )
Kingdoms of Amalur: Reckoning (HKLM-x32\...\{6A9D1594-7791-48f5-9CAA-DE9BCB968320}) (Version: 1.0.0.0 - Electronic Arts)
LastPass (Nur deinstallieren) (HKLM-x32\...\LastPass) (Version: - LastPass)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
MagentaCLOUD Software (HKLM-x32\...\{E9D2DFCA-ACCC-4D19-B0DA-9CD1DE76B2DA}) (Version: 5.2.0.0 - Deutsche Telekom AG)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Mansions of Madness (HKLM\...\Steam App 478980) (Version: - Fantasy Flight Games)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Master of Orion (HKLM-x32\...\Steam App 298050) (Version: - NGD Studios)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0 - Nero AG) Hidden
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Movie Templates - Starter Kit (x32 Version: 9.4.6.0 - Nero AG) Hidden
Nero 9 (HKLM-x32\...\{aa3bd892-e1e0-4873-a8b7-7c03975a475b}) (Version: - Nero AG)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 376.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 376.33 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.2.2.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.2.2.49 - NVIDIA Corporation)
NVIDIA Grafiktreiber 376.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.33 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.17 - NVIDIA Corporation)
NVIDIA Miracast Virtueller Ton 368.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 368.81 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.2.2.49 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.0.2.1 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.2 - NVIDIA Corporation) Hidden
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 10.3.3.1921 - Electronic Arts, Inc.)
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PSPPContent (x32 Version: 17.0.0.199 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 17.0.0.199 - Corel Corporation) Hidden
PSPPro64 (Version: 17.0.0.199 - Corel Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7560 - Realtek Semiconductor Corp.)
Remote Mouse version 3.002 (HKLM-x32\...\{01E4BC6D-3ACC-45E1-8928-C2FF626F63F3}_is1) (Version: 3.002 - Remote Mouse)
Rise of the Tomb Raider (HKLM-x32\...\{45F08513-973A-4C18-93FD-8E12B1908390}_is1) (Version: - Square Enix)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Sennheiser 3D G4ME1 (HKLM-x32\...\{71B53BA8-4BE3-49AF-BC3E-07F392DDDFB6}) (Version: 1.00.0001 - )
Setup (x32 Version: 17.0.0.199 - Ihr Firmenname) Hidden
Shadowrun: Hong Kong (HKLM-x32\...\Steam App 346940) (Version: - Harebrained Schemes)
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.2.2.49 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Sid Meier's Civilization VI (HKLM\...\Steam App 289070) (Version: - Firaxis)
Sid Meier's Civilization: Beyond Earth (HKLM-x32\...\Steam App 65980) (Version: - Firaxis Games)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
Sophos Anti-Virus (HKLM-x32\...\{3B998572-90A5-4D61-9022-00B288DD755D}) (Version: 10.7.0.301 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}) (Version: 5.5.2.1 - Sophos Limited)
Sophos Diagnostic Utility (HKLM-x32\...\{4627F5A1-E85A-4394-9DB3-875DF83AF6C2}) (Version: 1.13.0.4 - Sophos Limited)
Sophos Home (HKLM-x32\...\{63F3BF88-DE8E-4B21-BB24-F64CE500308E}) (Version: 1.1.0.78 - Sophos Limited)
Sophos Management Communications System (HKLM-x32\...\{2C14E1A2-C4EB-466E-8374-81286D723D3A}) (Version: 4.3.0.107 - Sophos Limited)
Sophos System Protection (HKLM\...\{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}) (Version: 2.6.0.71 - Sophos Limited)
SoundTrax (x32 Version: 4.4.32.0 - Nero AG) Hidden
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)
The Secret World (HKLM-x32\...\The Secret World_is1) (Version: 1.0.0 - Funcom)
Tom Clancy's The Division (HKLM-x32\...\Uplay Install 568) (Version: - Ubisoft)
Total War™: WARHAMMER® (HKLM\...\Steam App 364360) (Version: - Creative Assembly)
Tyranny (HKLM\...\Steam App 362960) (Version: - Obsidian Entertainment)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uplay (HKLM-x32\...\Uplay) (Version: 24.0.1 - Ubisoft)
Usenet.nl (HKLM-x32\...\Usenet.nl_is1) (Version: - )
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
WhatsApp (HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\WhatsApp) (Version: 0.2.2245 - WhatsApp)
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17332 - Microsoft Corporation)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {00F02F14-DE4B-4E6F-AA9B-1D2432DB25BC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-01-11] (Microsoft Corporation)
Task: {0808349E-5446-43AA-9B70-87F3A995977F} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [2014-03-03] (Acer Incorporated)
Task: {10D838AC-36D5-48BD-8018-DEB637B03BF1} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-01-06] (NVIDIA Corporation)
Task: {2038DE5D-86E9-4ADA-A81E-D85B2E4B77A3} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-06] (NVIDIA Corporation)
Task: {24E082F2-9ACD-4C4C-AFBE-105475BB95EF} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Sebastian\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {2865A78C-C913-4EF3-8895-D69C60316FDC} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {2B85DB4A-A78E-4262-9BD1-CF0F8BA355B8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-30] (Google Inc.)
Task: {32F981EB-6F99-4C70-ACD2-9E3408BBC372} - System32\Tasks\Update\SecUpdate => C:\Users\Sebastian\AppData\Roaming\svchost.exe <==== ACHTUNG
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {353D9464-75E2-4381-A08A-FB9A52667188} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {4354A565-40E2-4CE0-B0CE-FA61965DB292} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-30] (Google Inc.)
Task: {4CCA3664-5306-4441-A05B-FEE1B0944CA2} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {50032F7A-5814-44FF-BC04-AD8B7E0E52D8} - System32\Tasks\{BE121B94-043A-49C6-B2BE-1333B2973479} => pcalua.exe -a "C:\ProgramData\Battle.net\Agent\Blizzard Uninstaller.exe" -c --lang=deDE --uid=prometheus --displayname="Overwatch"
Task: {5182C0B0-0B93-4019-BF7E-CDB7D5243E09} - System32\Tasks\AsrSP.exe => C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\AsrSP.exe [2014-12-02] ()
Task: {5597F99E-CAF5-4EFC-A3AE-65983DB37143} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {62967D05-79A7-4AA2-B25C-9D91D51D6393} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-06] (NVIDIA Corporation)
Task: {689D66B7-07CC-43F4-8890-1C477FA735AC} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
Task: {79252ADA-73B4-4E07-8CDC-F7291F065563} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-01-06] (NVIDIA Corporation)
Task: {799B1AFA-17B3-42AE-B5A9-301B858AF1D6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)
Task: {7C59626F-CB46-48BD-84E8-00CBD1A7BEB9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-01-11] (Microsoft Corporation)
Task: {7D38A6E6-3915-4F47-B71E-F4FF052C2726} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {967F54D9-5DDF-4E34-B0D3-D4321D875F91} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-01-11] (Microsoft Corporation)
Task: {A2AB4BD6-6239-464C-9EE5-36560B473C5D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {BE19FBD8-397A-4634-8B4C-CCAB2B64655B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {BEDB405D-600B-4EE6-AE3B-AB774DA16DE6} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {C01A1739-AEC4-48E5-B0DB-28DEDFAEED6D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {C8F4BAFD-BDEF-4CDA-9E9F-6DFDAF2C7632} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {C9E11438-0AE0-4686-8885-732FA9ADA86B} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-01-06] (NVIDIA Corporation)
Task: {D00FAF10-8977-4545-85D2-578B545DE28F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {D00FBD76-EE80-491D-B919-2819BF259886} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {D40E1AC1-72B2-45B0-A859-9DB3217D5F9B} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {E7B49752-54E9-4776-BE4F-69496A93EE5A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {EFAAE108-C311-470E-97E9-85E403679CF6} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {FFDDF89D-3299-44BD-BAF3-1E3CD4B792D1} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-01-06] (NVIDIA Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps\Vysоr.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.emorhc.bat (Keine Datei) <===== Cyrillic
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Eхplorеr.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.erolpxei.bat (Keine Datei) <===== Cyrillic
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоoglе Сhromе.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.emorhc.bat (Keine Datei) <===== Cyrillic
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Ехрlоrer Вrowsеr.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.erolpxei.bat (Keine Datei) <===== Cyrillic
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\АirDroid.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.rehcnual.bat (Keine Datei) <===== Cyrillic
Shortcut: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gоogle Chromе.lnk -> C:\Users\Sebastian\AppData\Roaming\Browsers\exe.emorhc.bat (Keine Datei) <===== Cyrillic
ShortcutWithArgument: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps\Vysor.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gidgenkbbabolejbgbpnhbimgjbffefm
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-14 18:21 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 04490808 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 01148984 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2015-07-02 06:43 - 2015-07-02 06:43 - 00076888 _____ () C:\WINDOWS\SysWoW64\PnkBstrA.exe
2016-11-05 21:05 - 2016-06-25 08:52 - 00018432 _____ () C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe
2016-07-15 18:43 - 2014-07-31 15:17 - 00463112 _____ () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe
2016-10-17 12:18 - 2016-12-11 19:47 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-12-14 18:21 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2017-01-02 16:54 - 2017-01-02 16:54 - 01678560 _____ () C:\Users\Sebastian\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2016-10-17 13:11 - 2016-10-17 13:11 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 17:11 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-11 17:11 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 17:11 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 17:11 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 17:11 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 17:11 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 17:11 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-09-01 15:55 - 2013-05-28 17:56 - 00151552 _____ () C:\Windows\System\3DG4me.exe
2016-12-14 18:24 - 2016-12-14 18:24 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2016-12-14 18:24 - 2016-12-14 18:24 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-01-10 16:20 - 2017-01-10 16:20 - 13017280 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7805.42277.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.dll
2016-12-13 18:13 - 2016-12-13 18:13 - 03810816 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1612.3341.0_x64__8wekyb3d8bbwe\Calculator.exe
2016-12-09 17:26 - 2016-12-09 17:26 - 00073728 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2016-12-07 11:21 - 2016-12-07 11:20 - 02493440 _____ () D:\Origin\libGLESv2.dll
2016-11-05 21:05 - 2015-05-26 19:54 - 00152576 _____ () C:\Program Files (x86)\Remote Mouse\FileS.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 00020536 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 03776056 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 00901688 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-01 15:55 - 2012-06-06 10:56 - 00143360 _____ () C:\Windows\System\3DG4me.dll
2016-10-23 11:42 - 2017-01-06 02:10 - 64246840 _____ () C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2016-10-23 11:42 - 2017-01-06 01:09 - 00527416 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2016-10-23 11:42 - 2017-01-06 01:09 - 00252352 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2016-10-23 11:42 - 2017-01-06 01:09 - 02807232 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2016-10-23 11:42 - 2017-01-06 01:09 - 00384568 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2016-10-23 11:42 - 2017-01-06 01:09 - 00449080 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-10-23 11:42 - 2017-01-06 01:09 - 00336832 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2016-10-23 11:42 - 2017-01-06 01:09 - 01003456 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvCameraAPINode.node
2017-01-15 10:44 - 2017-01-06 01:09 - 00954816 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSDKAPINode.node
2017-01-02 16:54 - 2017-01-02 16:54 - 01244376 _____ () C:\Users\Sebastian\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\ClientTelemetry.dll
2016-12-15 15:32 - 2016-12-08 08:29 - 01829208 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libglesv2.dll
2016-12-15 15:32 - 2016-12-08 08:29 - 00085848 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libegl.dll
2015-05-20 10:20 - 2013-09-16 05:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Users\Sebastian:Heroes & Generals [38]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2016-12-07 11:26 - 00003085 ____A C:\WINDOWS\system32\Drivers\etc\hosts
0.0.0.0 vortex.data.microsoft.com
0.0.0.0 vortex-win.data.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0 oca.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com.nsatc.net
0.0.0.0 watson.telemetry.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com.nsatc.net
0.0.0.0 redir.metaservices.microsoft.com
0.0.0.0 choice.microsoft.com
0.0.0.0 choice.microsoft.com.nsatc.net
0.0.0.0 wes.df.telemetry.microsoft.com
0.0.0.0 services.wes.df.telemetry.microsoft.com
0.0.0.0 sqm.df.telemetry.microsoft.com
0.0.0.0 telemetry.microsoft.com
0.0.0.0 watson.ppe.telemetry.microsoft.com
0.0.0.0 telemetry.appex.bing.net
0.0.0.0 telemetry.urs.microsoft.com
0.0.0.0 telemetry.appex.bing.net:443
0.0.0.0 settings-sandbox.data.microsoft.com
0.0.0.0 survey.watson.microsoft.com
0.0.0.0 watson.live.com
0.0.0.0 watson.microsoft.com
0.0.0.0 statsfe2.ws.microsoft.com
0.0.0.0 corpext.msitadfs.glbdns2.microsoft.com
0.0.0.0 compatexchange.cloudapp.net
0.0.0.0 a-0001.a-msedge.net
0.0.0.0 statsfe2.update.microsoft.com.akadns.net
0.0.0.0 sls.update.microsoft.com.akadns.net
Da befinden sich 30 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sebastian\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{bb17ab4f-846f-43cc-9156-6835177188f7}.png
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\StartupFolder: => "vpngui.exe.lnk"
HKLM\...\StartupApproved\StartupFolder: => "Install LastPass IE RunOnce.lnk"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\StartupFolder: => "MagentaCLOUD.lnk"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "AcerPortal"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "GalaxyClient"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_678E52C622D3FEC81C940F43ECEEEB26"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "HP Deskjet 3520 series (NET)"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "autoRunTest"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "icq.desktop"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "AirDroid 3"
HKU\S-1-5-21-1585825436-704687126-3158100386-1001\...\StartupApproved\Run: => "OneDrive"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{1E2FCB30-188E-4064-B3E3-CDECF4A77BC9}] => D:\Steam\steamapps\common\How to Survive 2\Exe\Detect.exe
FirewallRules: [{1D86337B-D945-4B6F-BDA5-4F02D5AFCD96}] => D:\Steam\steamapps\common\How to Survive 2\Exe\Detect.exe
FirewallRules: [{96BC4FB7-7919-4C35-944D-350BF6720031}] => D:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{DA56D1F5-C267-417F-8091-658718E0A61A}] => D:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{6FA063BF-560B-41DB-A608-2BDE32B6BC80}] => D:\Steam\steamapps\common\How to Survive 2\Exe\Detect.exe
FirewallRules: [{754C5186-84A8-4DFC-91C1-DB66C944E143}] => D:\Steam\steamapps\common\How to Survive 2\Exe\Detect.exe
FirewallRules: [{D1593052-2167-44D5-AC6A-F214EFF3759B}] => D:\Steam\steamapps\common\How to Survive 2\Exe\HowToSurvive2.exe
FirewallRules: [{DB2D85BD-0061-4E20-80DD-B7323F3C4D78}] => D:\Steam\steamapps\common\How to Survive 2\Exe\HowToSurvive2.exe
FirewallRules: [{D9974259-2F1D-425A-A66F-A30329CF38F8}] => D:\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{447DE757-8F8D-4E82-8AFC-163A10B1C251}] => D:\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{FA8DE2EB-12FA-43F7-9C82-6A8734A4393F}] => D:\Steam\steamapps\common\Deus Ex Mankind Divided\retail\DXMD.exe
FirewallRules: [{7B6C33B0-FB82-43A2-A250-8A459736D7C3}] => D:\Steam\steamapps\common\Deus Ex Mankind Divided\retail\DXMD.exe
FirewallRules: [UDP Query User{CB20F2D2-A04C-4EBA-82F9-252C2F856F3D}D:\steam\steamapps\common\life is feudal your own\server\cm_yo_server.exe] => D:\steam\steamapps\common\life is feudal your own\server\cm_yo_server.exe
FirewallRules: [TCP Query User{53701EF3-87E6-4AA4-87E3-ABFBD4E593DF}D:\steam\steamapps\common\life is feudal your own\server\cm_yo_server.exe] => D:\steam\steamapps\common\life is feudal your own\server\cm_yo_server.exe
FirewallRules: [{50286E3B-8E36-414C-9BFC-B0458C58D174}] => D:\Steam\steamapps\common\Kingdom Come Deliverance\Bin\Win64\KingdomCome.exe
FirewallRules: [{A415AEA0-AC37-4F94-9FEC-8541A03FFA7C}] => D:\Steam\steamapps\common\Kingdom Come Deliverance\Bin\Win64\KingdomCome.exe
FirewallRules: [{0D04DD23-CACC-4A6D-BDA1-7826A0D0D395}] => D:\Steam\steamapps\common\Mansions of Madness\Mansions of Madness.exe
FirewallRules: [{3E257D4E-E632-48D7-A23A-71329A7E4E7C}] => D:\Steam\steamapps\common\Mansions of Madness\Mansions of Madness.exe
FirewallRules: [{E571D2BA-8496-4F5C-888B-4AABB2378B42}] => C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{E52CD804-4FF4-4CA7-A58E-CD8D417943ED}] => C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{F8146DE8-34D8-4D8A-AAA9-82783948D8B7}] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{A9434915-3207-4FBA-A179-81C9054ECCEF}] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{40FC94B5-E6D4-4003-834D-AFE6979337DE}] => D:\Steam\Steam.exe
FirewallRules: [{64826A5F-81A8-4D33-9D4C-17EC5CE023E1}] => D:\Steam\Steam.exe
FirewallRules: [{11ED5125-63F7-40AE-B49A-1FE6E421B7C4}] => D:\Steam\bin\steamwebhelper.exe
FirewallRules: [{83B19263-5FB4-4055-B8E4-800472E5B7F7}] => D:\Steam\bin\steamwebhelper.exe
FirewallRules: [{8CC69F9C-0FC7-45E6-84BC-CCDFD404E5FC}] => D:\Battle.net\Battle.net.exe
FirewallRules: [{14634FAF-E8B2-427E-B3E5-31B0C31BD25A}] => D:\Battle.net\Battle.net.exe
FirewallRules: [{F08CB014-20C2-4FD6-9190-DA7988FE6237}] => D:\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{4A1E334F-5EAE-47A1-804A-24C7D7076BFA}] => D:\Steam\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{97CA08B6-AD2D-44A5-A058-69AC3452B214}] => D:\Steam\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{65B1B9B4-C260-4A07-A790-80C79AB4DB7B}] => D:\Steam\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{7A3C1821-C450-4D82-AA03-6694B59C6438}] => D:\Steam\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{5D7977EE-2587-4D92-8ED3-152C93D38D14}] => D:\Steam\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{E71B900E-2431-46F6-BC22-E165851B19C1}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{BDC4493D-DE85-4601-9092-432844F54343}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{49536044-9D3C-4C9C-A432-F5F5E0A41FC3}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{B4D87CB3-FB89-4579-8E42-8AE89A314666}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{59C6A513-8B30-41D8-A569-C049BE95B31D}] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe
FirewallRules: [{275E7FC1-9D7D-4701-B0EF-D6D8E83625FF}] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{A8B14BF4-FC01-47CC-AE2A-E2DFC50C8601}] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{83352639-0988-44A4-A0FA-E2D4C8807703}] => D:\The Secret World\ClientPatcher.exe
FirewallRules: [{878F7B7B-7B63-44F1-82C5-5F0B59A86D37}] => D:\The Secret World\ClientPatcher.exe
FirewallRules: [TCP Query User{F5C3513C-3A46-4A68-96DE-112FC9B7A9B3}C:\windows\syswow64\msiexec.exe] => C:\windows\syswow64\msiexec.exe
FirewallRules: [UDP Query User{4C9C6C66-9995-4255-B2E9-27A622E8BB43}C:\windows\syswow64\msiexec.exe] => C:\windows\syswow64\msiexec.exe
FirewallRules: [TCP Query User{752AA425-2EEB-4A30-AE58-ECB1093CEC9C}C:\users\sebastian\appdata\roaming\spotify\spotify.exe] => C:\users\sebastian\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{27A0D4E1-856D-42B8-80B4-4702FCC7AC57}C:\users\sebastian\appdata\roaming\spotify\spotify.exe] => C:\users\sebastian\appdata\roaming\spotify\spotify.exe
FirewallRules: [{C8033AF6-FBA3-4902-9699-DB8F29C05F57}] => D:\Steam\steamapps\common\Shadowrun Hong Kong\SRHK.exe
FirewallRules: [{AE22A613-392C-4262-AC5E-FEB412153FF8}] => D:\Steam\steamapps\common\Shadowrun Hong Kong\SRHK.exe
FirewallRules: [TCP Query User{DD76B5B4-D07A-4B09-ABF0-CC2C1CC533E9}D:\steam\steamapps\common\sid meier's civilization v\civilizationv_dx11.exe] => D:\steam\steamapps\common\sid meier's civilization v\civilizationv_dx11.exe
FirewallRules: [UDP Query User{F7F15F6F-13ED-41C4-8693-854350B77316}D:\steam\steamapps\common\sid meier's civilization v\civilizationv_dx11.exe] => D:\steam\steamapps\common\sid meier's civilization v\civilizationv_dx11.exe
FirewallRules: [TCP Query User{3E354004-9268-458B-9A99-1FCED9BC2616}C:\users\sebastian\documents\octgn\octgn\octgn.exe] => C:\users\sebastian\documents\octgn\octgn\octgn.exe
FirewallRules: [UDP Query User{400B5718-1B40-4855-90B4-30F9F513471C}C:\users\sebastian\documents\octgn\octgn\octgn.exe] => C:\users\sebastian\documents\octgn\octgn\octgn.exe
FirewallRules: [TCP Query User{5FA96732-ABDF-495B-ACED-C315068CE662}C:\users\sebastian\documents\octgn\octgn\octgn.online.standaloneserver.exe] => C:\users\sebastian\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [UDP Query User{406450A6-8838-4830-80A5-6C0FC412D820}C:\users\sebastian\documents\octgn\octgn\octgn.online.standaloneserver.exe] => C:\users\sebastian\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [{ABC943DC-EDCD-4834-BB3D-87E96B7478D3}] => C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{419D19DC-9CEC-47EC-B24F-9785AE2550EE}] => C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [TCP Query User{5E898775-9F44-4C56-92B8-D1D5E3102A1E}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [UDP Query User{83384FE7-0C39-4E68-B5A9-2265065AE523}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [{E6757B03-4881-4C24-B433-B95D46973D5B}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9BD03B36-BDE6-41F4-A2F6-A450558A9538}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{36B7A6DE-1A19-4556-8501-69D9386A7E31}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{D4E2DC39-2B1F-4579-8D47-AD662567EC1B}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{6ADBBA35-D962-46A8-BFB8-DB9E3E4A65FC}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{8485B2A0-C9F8-4277-B724-5697659E6CCF}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{68A2A34D-BDEF-4901-B461-6909D53BF282}] => D:\Steam\steamapps\common\Magicka\Magicka.exe
FirewallRules: [{683A8B75-1D2C-4AD3-BCF1-D95AE8F528F4}] => D:\Steam\steamapps\common\Magicka\Magicka.exe
FirewallRules: [{5F00ADEC-8D64-4EE1-9BB8-66F0FC6AAA1C}] => D:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [{CE697F2F-E8A6-4C14-9B80-3689B69FD7F6}] => D:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [{F169CA40-D9C0-441C-8936-987B8D13E739}] => D:\Program Files (x86)\Origin Games\Command and Conquer The Ultimate Collection Additional Content\Launcher.exe
FirewallRules: [{9C49EC69-BA8C-49D4-8FA8-CAA9AB9A947E}] => D:\Program Files (x86)\Origin Games\Command and Conquer The Ultimate Collection Additional Content\Launcher.exe
FirewallRules: [{AB7388E9-13EA-49A5-9AF2-70D6A17DDF1F}] => D:\Program Files (x86)\Origin Games\Kingdoms of Amalur Reckoning\Reckoning.exe
FirewallRules: [{5270EEB3-B047-4917-A56F-2598C010E634}] => D:\Program Files (x86)\Origin Games\Kingdoms of Amalur Reckoning\Reckoning.exe
FirewallRules: [{24864E73-C3C3-4A9F-B444-BF5BEEA7EFF7}] => D:\Program Files (x86)\Origin Games\Command and Conquer 3 TW and KW\CNC3Launcher.exe
FirewallRules: [{AEF2FE6B-B6EA-4782-8388-168F5CF9489F}] => D:\Program Files (x86)\Origin Games\Command and Conquer 3 TW and KW\CNC3Launcher.exe
FirewallRules: [{360E5EE0-373F-4B5B-90C3-C606735B20C8}] => D:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{4EC1512D-7E5A-478E-AFF2-EED706A49E28}] => D:\Program Files (x86)\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [TCP Query User{2C9C4554-1DB6-4774-B4E9-10A6C93E2AB7}D:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe] => D:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe
FirewallRules: [UDP Query User{C5B58821-8763-4F7E-82D1-C7C8AD99A9DF}D:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe] => D:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe
FirewallRules: [{ECD4C8F3-6821-492C-85FD-8F11DF298749}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{504ACAF4-9687-41A6-A705-1363B707C00F}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{150A4AEB-F4C3-4E92-B8B3-BEF67FCB2C65}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{652FBEF4-BF9C-4FAA-B4BB-BB75F5A7679E}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{85B39268-9006-4852-9253-ADC6B5FBCEB0}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F6CDDAA5-88A1-49AC-97CF-D4D3CC595BC7}] => C:\Users\Sebastian\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{B79D23D2-435B-4FA5-ADC7-00CF340B04E7}D:\steam\steamapps\common\dayz\dayz.exe] => D:\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [UDP Query User{BD223A38-745A-49A4-9E7B-4CEDBC60FBB5}D:\steam\steamapps\common\dayz\dayz.exe] => D:\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [TCP Query User{F9D09625-2A4C-432E-82F9-BC16604EB404}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0B13E370-F5F8-4A7F-BD44-B8E02D769A86}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{FC755AC1-4BE5-4D80-88A7-B5FE4B66A88C}] => D:\Steam\steamapps\common\Master of Orion\MasterOfOrion.exe
FirewallRules: [{1D233D33-5AF8-499B-B5ED-53C7EBE86BDF}] => D:\Steam\steamapps\common\Master of Orion\MasterOfOrion.exe
FirewallRules: [{F3E51548-9C74-4540-8556-68AD6805584E}] => D:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [{91D19457-4724-447E-8657-82F862079FA1}] => D:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [{1F1ABCED-8FED-4251-B186-BE2BD261A08D}] => D:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [{CB1DF477-8C62-4653-932E-C9EAEA6835DB}] => D:\Steam\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [TCP Query User{5F045DA0-746C-45FE-B3A1-64AA872233B4}D:\steam\steamapps\common\total war warhammer\warhammer.exe] => D:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [UDP Query User{0B9C5B8D-AF74-4E05-BD29-FC70AE576709}D:\steam\steamapps\common\total war warhammer\warhammer.exe] => D:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [TCP Query User{6E995F57-FD6B-4103-B4B1-00ADFB7D3537}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [UDP Query User{3A0457DE-F585-4B4C-AAFB-18454028B18C}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [{CFE949C7-DEF8-4327-B83F-EBCCA68250EF}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{00C520C6-6352-47F0-ABAC-8EFC87226455}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{307DF031-DDE4-4BCE-97DF-B7419C15F55E}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D5F685E7-B5C5-4EF7-A4DC-987F70CF6453}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BDCA39D0-25CD-4552-9297-6BD5708C6C20}] => D:\Steam\steamapps\common\Wolcen\win_x64\Wolcen.exe
FirewallRules: [{B8950063-3A1F-4AFE-8158-5988296A97DC}] => D:\Steam\steamapps\common\Wolcen\win_x64\Wolcen.exe
FirewallRules: [{E0379937-13F7-4682-A9FB-132CF0051966}] => D:\Steam\steamapps\common\How to Survive 2\Exe\HowToSurvive2.exe
FirewallRules: [{82522F76-9015-432A-9678-B5ACC4A4D5C8}] => D:\Steam\steamapps\common\How to Survive 2\Exe\HowToSurvive2.exe
FirewallRules: [{5B14A1AB-F510-4959-8A63-1E2A8DC1E1D4}] => C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\games\Tom Clancy's The Division\TheDivision.exe
FirewallRules: [{E2E03B96-686A-4E4A-AB08-7AFB08486890}] => D:\Steam\steamapps\common\Heroes & Generals\hngsteamlauncher.exe
FirewallRules: [{27AF7F03-0254-4028-AE31-CBD6D3BA01E9}] => D:\Steam\steamapps\common\Heroes & Generals\hngsteamlauncher.exe
FirewallRules: [{6CEC33C8-0BC4-4CF1-AA3F-3AC4896DE355}] => C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
FirewallRules: [{AAD09435-7629-46A4-92C4-0BF4412D3E57}] => C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
FirewallRules: [{85E83FF6-AB0D-43AA-B165-931E19250471}] => C:\Program Files (x86)\Remote Mouse\RemoteMouseCore.exe
FirewallRules: [{B12E5F70-9D93-4189-B27D-4BE89EFC8CF3}] => C:\Program Files (x86)\Remote Mouse\RemoteMouseCore.exe
FirewallRules: [TCP Query User{F4B46B22-43D3-4DF6-874C-D0F159BE2A62}C:\program files (x86)\heroes of the storm\versions\base47479\heroesofthestorm.exe] => C:\program files (x86)\heroes of the storm\versions\base47479\heroesofthestorm.exe
FirewallRules: [UDP Query User{698782D2-8C0D-4AF1-B3EB-80A824B89E25}C:\program files (x86)\heroes of the storm\versions\base47479\heroesofthestorm.exe] => C:\program files (x86)\heroes of the storm\versions\base47479\heroesofthestorm.exe
FirewallRules: [{C43E6989-9C85-4A70-B6D7-61ED93737D6D}] => D:\Steam\steamapps\common\Dishonored2\Dishonored2.exe
FirewallRules: [{458AA6CC-4444-4158-85FB-CE84E47CE0DF}] => D:\Steam\steamapps\common\Dishonored2\Dishonored2.exe
FirewallRules: [TCP Query User{013E6EC7-8959-4CE2-9B36-CCC02BE56538}C:\gog games\gwent\gwent.exe] => C:\gog games\gwent\gwent.exe
FirewallRules: [UDP Query User{4A9B70CA-2449-4972-B9D1-793A6D2CD93C}C:\gog games\gwent\gwent.exe] => C:\gog games\gwent\gwent.exe
FirewallRules: [TCP Query User{CC9B9F35-BC41-4777-A5B8-779DF526F3D1}C:\program files (x86)\heroes of the storm\versions\base48297\heroesofthestorm.exe] => C:\program files (x86)\heroes of the storm\versions\base48297\heroesofthestorm.exe
FirewallRules: [UDP Query User{BE5885CF-12CD-49DD-802E-60BC71F62B03}C:\program files (x86)\heroes of the storm\versions\base48297\heroesofthestorm.exe] => C:\program files (x86)\heroes of the storm\versions\base48297\heroesofthestorm.exe
FirewallRules: [{D924F747-86E8-4645-A559-58B710F021E2}] => D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{3F37CB3F-D5B3-4EF5-B85B-A442B7A4A5E4}] => D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{7011B0D9-8930-4B24-86BC-951C4C90E788}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{06569F85-BA34-46AA-84BE-C7152193AE5E}] => D:\Steam\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{404E1F38-FD2F-479E-92C8-2BA1F73414D0}] => D:\Steam\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{FD5A5B3F-4A66-4CD4-9E99-13D97711D4DF}] => D:\Steam\steamapps\common\Sid Meier's Civilization VI\Base\Binaries\Win64Steam\CivilizationVI.exe
FirewallRules: [{91BD9679-40FE-4B72-8A69-73F4810D0E3A}] => D:\Steam\steamapps\common\Sid Meier's Civilization VI\Base\Binaries\Win64Steam\CivilizationVI.exe
FirewallRules: [{FA75CE1F-835E-45F9-931E-3B86083C9F42}] => D:\Steam\steamapps\common\Sid Meier's Civilization VI\Base\Binaries\Win64Steam\CivilizationVI_DX12.exe
FirewallRules: [{0BCEDA18-8A52-4A27-849B-5509A12519EA}] => D:\Steam\steamapps\common\Sid Meier's Civilization VI\Base\Binaries\Win64Steam\CivilizationVI_DX12.exe
FirewallRules: [{E97D4C8C-F6EF-4404-B775-B94FA06FE8C4}] => D:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{6DD127F3-D9C4-47C0-8136-4E681535D2FC}] => D:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{28601C56-EBB8-4AA8-A69E-EF0676AE02B0}] => D:\Steam\steamapps\common\Wolcen\win_x64\Wolcen.exe
FirewallRules: [{2F1B23F0-4F51-4300-8210-3D720633205B}] => D:\Steam\steamapps\common\Wolcen\win_x64\Wolcen.exe
FirewallRules: [{D66D6626-C5E9-4649-95EE-74A638754DE8}] => C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{6957B582-14D7-4264-8791-D8ADAEC5D1AB}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{679E17E2-6610-4666-8253-73381AFDBDB0}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{96B33869-E91C-4276-A2A3-B59FD1D3C24A}] => D:\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{B25458AF-5C54-4F72-95AD-469750094E46}] => D:\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{9C896262-4BE2-49D8-8BAB-2E9ED3626D79}] => C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{F02C68A0-3A8A-4B5A-8AB7-AAF6E419E466}] => C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{CB6A2BA9-4228-45EA-A75E-97C7C3BB3CC5}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{06667E90-F57E-413F-A88A-01CBDCEBE9F2}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{92264551-342E-402E-81BD-252CE33441B0}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{3D8F08B4-396C-4FCC-9566-F5F060F35897}] => D:\Steam\steamapps\common\Tyranny\Tyranny.exe
FirewallRules: [{C0D76143-77D3-41BD-97ED-F6C4FAEE17C1}] => D:\Steam\steamapps\common\Tyranny\Tyranny.exe
==================== Wiederherstellungspunkte =========================
05-01-2017 17:34:37 Windows Update
08-01-2017 14:04:39 Installed Cisco AnyConnect Secure Mobility Client
11-01-2017 17:12:57 Windows Update
15-01-2017 14:37:59 Windows Update
15-01-2017 15:20:45 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (01/16/2017 01:46:07 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {F60368A6-685A-4F5A-8D62-771EC8824BA7}
Error: (01/16/2017 01:46:07 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {F60368A6-685A-4F5A-8D62-771EC8824BA7}
Error: (01/16/2017 01:44:42 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {F60368A6-685A-4F5A-8D62-771EC8824BA7}
Error: (01/16/2017 01:44:42 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {F60368A6-685A-4F5A-8D62-771EC8824BA7}
Error: (01/16/2017 06:47:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LogonUI.exe, Version: 10.0.14393.0, Zeitstempel: 0x57899b5a
Name des fehlerhaften Moduls: USBKeyCredentialProvider.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x53d9fa55
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002b3c6
ID des fehlerhaften Prozesses: 0x22fc
Startzeit der fehlerhaften Anwendung: 0x01d26f666c93cd1f
Pfad der fehlerhaften Anwendung: C:\WINDOWS\System32\LogonUI.exe
Pfad des fehlerhaften Moduls: USBKeyCredentialProvider.dll
Berichtskennung: 5f7088de-6fb5-4772-a05f-36c1dbc3837e
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (01/15/2017 03:21:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (01/15/2017 03:15:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "c:\program files (x86)\nero\nero 9\nero photosnap\PhotoSnap.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
Error: (01/15/2017 03:12:52 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (01/15/2017 03:12:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
Error: (01/15/2017 02:40:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Tyranny.exe, Version 1.0.3.31 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1b14
Startzeit: 01d26f3464973e9b
Beendigungszeit: 4294967295
Anwendungspfad: D:\Steam\steamapps\common\Tyranny\Tyranny.exe
Berichts-ID: 26f31892-db28-11e6-832a-d050999924a3
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Systemfehler:
=============
Error: (01/16/2017 12:36:42 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (01/16/2017 12:32:37 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024200b fehlgeschlagen: Hewlett-Packard - Imaging - Null Print - HP Deskjet 3520 series
Error: (01/16/2017 12:23:44 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (01/16/2017 12:23:17 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "NVIDIA LocalSystem Container" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
Es wird bereits eine Instanz des Dienstes ausgeführt.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Origin Web Helper Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA Telemetry Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Sophos Web Filter" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/16/2017 12:23:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Sophos Web Intelligence Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
CodeIntegrity:
===================================
Date: 2017-01-16 12:24:46.698
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-01-15 15:17:58.290
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-01-15 11:34:49.821
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-01-15 11:34:47.964
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-01-11 10:08:50.106
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-01-11 10:08:49.523
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz
Prozentuale Nutzung des RAM: 47%
Installierter physikalischer RAM: 8142.85 MB
Verfügbarer physikalischer RAM: 4311.91 MB
Summe virtueller Speicher: 9422.85 MB
Verfügbarer virtueller Speicher: 5034.31 MB
==================== Laufwerke ================================
Drive c: (Acer) (Fixed) (Total:455.5 GB) (Free:225.12 GB) NTFS
Drive d: (DATA) (Fixed) (Total:456.01 GB) (Free:241.71 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: DE6E102E)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
16.01.2017, 13:58
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Browser Hijacker nova.rumbler.ru gefangenCode:
ATTFilter CHR Profile: C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default [2017-01-16]
CHR Extension: (Google Präsentationen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-30]
CHR Extension: (Google Docs) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-30]
CHR Extension: (Google Drive) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (Adblock Plus) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-26]
CHR Extension: (Google-Suche) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Adobe Acrobat) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-01-12]
CHR Extension: (Google Tabellen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-30]
CHR Extension: (Vysor) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gidgenkbbabolejbgbpnhbimgjbffefm [2017-01-11]
CHR Extension: (TinEye Reverse Image Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2016-08-27]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-01-09]
CHR Extension: (Privacy Palette) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjkcflkplhgpebknipkekjggglimnone [2015-06-30]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (MyHarmony Chrome Plugin) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\omaonpoimgkmbllpdihbnmgphjoipdhf [2016-01-03]
CHR Extension: (Fast search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2017-01-15]
CHR Extension: (Google Mail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-30]
CHR Extension: (Inbox by Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkclgpgponpjmpfokoepglboejdobkpl [2015-10-16]
CHR Extension: (Chrome Media Router) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-15]
Was sind das alles für addons in Chrome....brauchst du die alle, kennst du überhaupt alle??
__________________ |
|
16.01.2017, 14:04
| #19 |
| | Browser Hijacker nova.rumbler.ru gefangen Alsoooo.... Privacy Palette und Fast Search waren mir bis gerade unbekannt, sind jetzt auch gekillt. Den Rest brauch ich für die Koordination mit der Uni - also mehrere Leute gleichzeitig auf ein Dokument zugreifen, das gleiche gilt für Vysor - kann damit mein Smartphone Bild auf den PC senden. Der Rest ist mir bekannt und wird auch genutzt  |
|
16.01.2017, 14:26
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Browser Hijacker nova.rumbler.ru gefangen Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte: 1. Schritt: MBAM Downloade Dir bitte  Malwarebytes Anti-Malware
2. Schritt: ESET ESET Online Scanner
3. Schritt: SecurityCheck Downloade Dir bitte  SecurityCheck und:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
16.01.2017, 17:51
| #21 |
| | Browser Hijacker nova.rumbler.ru gefangen Soo, hat was länger gedauert, ESET hat ewig gebraucht  ESET Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=e1c741dca59d604ebe48e5e1e51641a2
# end=init
# utc_time=2017-01-16 02:00:55
# local_time=2017-01-16 03:00:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32080
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=e1c741dca59d604ebe48e5e1e51641a2
# end=updated
# utc_time=2017-01-16 02:02:46
# local_time=2017-01-16 03:02:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=e1c741dca59d604ebe48e5e1e51641a2
# engine=32080
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-16 04:12:24
# local_time=2017-01-16 05:12:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5179606 15913760 0 0
# compatibility_mode_1='Sophos Anti-Virus'
# compatibility_mode=8450 16777213 100 97 20514 29379779 0 0
# scanned=495851
# found=9
# cleaned=0
# scan_time=7778
sh=12895F39B4B5E9E24AA279BC6E75AB226966D570 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.emorhc.bat"
sh=A8422321D715FBB561F31365243BFD9658AB6807 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.erolpxei.bat"
sh=5F0B935F1BED81F64B2238B490366E8D6797BF1D ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.rehcnual ten.elttab.bat"
sh=7D35A9D91B385AF1C7FA229DB7A01296603DC3A0 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.rehcnual-42fdp.bat"
sh=2282C4795F379B12F6D257A95A2D0C6597206A7F ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.rehcnual.bat"
sh=3CA1ED27DFB696FB5FF6FCB903E175AFAC4AF898 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.rehcnual.lol.bat"
sh=D4711E6444218C0870775E89B0D5354CD73C3379 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\lcqhcmrlvdvwkbowyoaowbelitcuwjsv\exe.rehcnualyfitops.bat"
sh=5B6B20577AF05E0A03F52232989DFF4F78771013 ft=1 fh=f874d28c33fcc132 vn="Win32/Adware.ConvertAd.AJL Anwendung" ac=I fn="C:\Users\Sebastian\AppData\Local\Temp\MMIns.exe"
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 16.01.2017 Suchlaufzeit: 14:38 Protokolldatei: mbam.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2017.01.16.04 Rootkit-Datenbank: v2016.11.20.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: Sebastian Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 336595 Abgelaufene Zeit: 8 Min., 53 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 1 PUP.Optional.Wajam, C:\Users\Sebastian\AppData\Local\Temp\wajam_install.exe, In Quarantäne, [f3a10b717e2a54e2a3ef600a14efca36], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter Results of screen317's Security Check version 1.009
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Sophos Home
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 66
Java version 32-bit out of Date!
Google Chrome (55.0.2883.87)
Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````
Sophos Sophos Anti-Virus SavService.exe
Sophos Sophos Anti-Virus SAVAdminService.exe
Sophos Sophos Anti-Virus Web Control swc_service.exe
Sophos Sophos Anti-Virus Web Intelligence swi_service.exe
Sophos Sophos Anti-Virus Web Intelligence swi_filter.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
|
|
16.01.2017, 22:11
| #22 | ||||||||||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Browser Hijacker nova.rumbler.ru gefangen Dann wären wir durch!  Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.  Abschließend müssen wir noch ein paar Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.  Cleanup: Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen - sofern benötigt, wenn nicht benötigt natürlich sinnigerweise deinstallieren oder Alternativen verwenden (und diese aktuell halten).
Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Schutzsoftware: Vorab sei erwähnt, dass man niemals die Schutzwirkung eines Virenscanners überbewerten darf! Die Dinger sind mittlerweile auch unter Windows stark umstritten und können Probleme bereiten, die man so ohne AV einfach nicht haben wird. Zudem werden sie auch niemals jeden Schädling finden können. Aussagen der Anbieter dieser Software entpuppen sich regelmäßig als Marketinggeblubber. Lies mal => Aus aktuellem Anlass: Antivirus-Schlangenöl | Elias Schwerdtfeger und Antivirensoftware: Die Schlangenöl-Branche - Golem.de Verwende also MAXIMAL ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:
Microsoft Security Essentials (MSE) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE entschieden hast, brauchst du nicht extra MSE zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür. Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und/oder mit dem ESET Online Scanner scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. NoScript kann gerade bei technisch nicht allzu versierten Nutzern beim Surfen zum Nervfaktor werden; ob das Tool geeignet ist, muss jeder selbst mal ausprobieren und dann für sich entscheiden. Alternativen zu NoScript (wenn um das das Verhindern von Usertracking und Werbung auf Webseiten) geht wären da Ghostery oder uBlock. Ghostery ist eine sehr bekannte Erweiterung, die aber auch in Kritik geraten ist, vgl. dazu bitte diesen Thread => Ghostery schleift Werbung durch Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden. Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Browser Hijacker nova.rumbler.ru gefangen |
| antivirenprogramm, browser, browser hijacker, ebenfalls, gefangen, gen, gestern, google, hallo zusammen, hijacker, kurzzeitig, manuell, nichts, nova.rambler.ru, problem, programm, rechner, registry, schei, schließe, sophos, versucht, weitergeleitet, zurücksetzen, zusammen, zusätzlich |
Linear-Darstellung
