Rootkitverdacht

Modul" = "d:\windows\assembly\nativeimages_v4.0.30319_64\smsvchost\a1bca43857f8d35aea9dee66e3d4534b\smsvchost.ni.exe" ( 7: Risikoreich ) ; SMSvcHost.exe ; Microsoft Corporation ;  pid 2484

"Modul" = "d:\windows\assembly\nativeimages_v4.0.30319_64\smsvchost\a1bca43857f8d35aea9dee66e3d4534b\smsvchost.ni.exe" ( 7: Risikoreich ) ; SMSvcHost.exe ; Microsoft Corporation ; pid 3284
         

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 01-05-2017
durchgeführt von Nada (02-05-2017 23:35:06)
Gestartet von D:\Users\käptnBlaubär\Downloads
Windows 10 Pro Version 1607 (X64) (2016-10-09 18:13:36)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-2210758347-1204338499-507655992-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2210758347-1204338499-507655992-503 - Limited - Disabled)
Gast (S-1-5-21-2210758347-1204338499-507655992-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2210758347-1204338499-507655992-1002 - Limited - Enabled)
Nada (S-1-5-21-2210758347-1204338499-507655992-1000 - Administrator - Enabled) => D:\Users\käptnBlaubär
RSS_504C72360D464B11 (S-1-5-21-2210758347-1204338499-507655992-1004 - Limited - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Returnil System Safe 2011 (Enabled - Up to date) {B1F99400-BE58-E5B3-88CF-FB21D431A392}
AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Active Directory Authentication Library for SQL Server (Version: 13.0.1601.5 - Microsoft Corporation) Hidden
Active Directory Authentication Library for SQL Server (x86) (x32 Version: 13.0.1601.5 - Microsoft Corporation) Hidden
AdBlockerHelper   (HKLM-x32\...\{7923DD5E-8FFC-4DE8-A7DC-D4B83797F3C0}) (Version:  - AdBlockerHelper)
Apowersoft kostenloser Bildschirmrekorder V3.0.6 (HKLM-x32\...\{24a5c90b-5128-4fc9-91f5-113d64087118}_is1) (Version: 3.0.6 - APOWERSOFT LIMITED)
Apple Application Support (32-Bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{28791292-D18D-42FA-AE66-3D3D20AA8618}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5ED7462B-EF58-4757-B609-53755021EC34}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Application Insights Tools for Visual Studio 2015 (HKLM-x32\...\{0E4C791E-B78E-477D-BD5A-CDD0985BA6EC}) (Version: 7.0.20622.1 - Microsoft Corporation)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.25.172 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{1f8bb480-f5d7-4414-a6ea-28e005509ae4}) (Version: 1.2.81.6390 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.81.6390 - Avira Operations GmbH & Co. KG) Hidden
Azure AD Authentication Connected Service (x32 Version: 14.0.25420 - Microsoft Corporation) Hidden
AzureTools.Notifications (x32 Version: 2.7.30611.1601 - Microsoft Corporation) Hidden
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.7.1 - EA Digital Illusions CE AB)
BDAntiRansomware (HKLM\...\{BE40AB1F-558F-4434-B72F-461EF97E7796}_is1) (Version: 1.0.12.1 - Bitdefender)
Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.29 - Piriform)
CMS2017  2.0 (HKLM-x32\...\{91190DD8-7271-4F6A-BF98-96B72E835A15}) (Version:  - M.S)
Command & Conquer 3 (HKLM-x32\...\{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}) (Version: 1.00.0000 - Ihr Firmenname)
Command & Conquer(TM) Generäle (HKLM-x32\...\InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}) (Version: 0.50.0000 - Electronic Arts)
Command & Conquer(TM) Generäle (x32 Version: 0.50.0000 - Electronic Arts) Hidden
Command and Conquer(TM) Generäle Die Stunde Null  (HKLM-x32\...\InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}) (Version: 1.00.0000 - Electronic Arts)
Command and Conquer(TM) Generäle Die Stunde Null  (x32 Version: 1.00.0000 - Electronic Arts) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dotfuscator and Analytics Community Edition 5.22.0 (x32 Version: 5.22.0.3788 - PreEmptive Solutions) Hidden
EasySetup  2.0.6 (HKLM-x32\...\{7CD2DA07-6695-4FFE-A2A6-5F7055F1A8FA}) (Version:  - Thorsten Hoeppner)
Emsisoft HiJackFree 4.5 (HKLM-x32\...\Emsisoft HiJackFree_is1) (Version: 4.5 - Emsi Software GmbH)
Entity Framework 6.1.3 Tools  for Visual Studio 2015 Update 1 (HKLM-x32\...\{2A56910C-69C8-495D-8ED8-9080F0A14E58}) (Version: 14.0.41103.0 - Microsoft Corporation)
Entity Framework Designer für Visual Studio 2012 - DEU (HKLM-x32\...\{4705DBFD-9D5E-4D23-817C-8CA7359B7BDE}) (Version: 11.1.20810.00 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{70D065C3-77E5-45E9-A75C-EEB2E84EA869}) (Version: 11.0.2100.60 - Microsoft Corporation)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
HTML Help Workshop (HKLM-x32\...\HTML Help Workshop) (Version:  - )
IIS 10.0 Express (HKLM\...\{13FD7E30-D2F1-498D-ABC2-A4242DB6610E}) (Version: 10.0.1736 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version:  - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{ad846bae-d44b-4722-abad-f7420e08bcd9}.sdb) (Version:  - )
IrfanView 4.44 (64-bit) (HKLM\...\IrfanView64) (Version: 4.44 - Irfan Skiljan)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Linkverwaltung  2.0 (HKLM-x32\...\{3AC6AA2F-8C74-48AC-A064-707CDB7461D8}) (Version:  - M.S)
MD5Hasch  2.0.0 (HKLM-x32\...\{9C0D084E-423E-452F-9935-F96A2A840C61}) (Version:  - M.S)
MeineDaten  2.0 (HKLM-x32\...\{1A25CEB9-5A89-43AB-93CD-BF8B0149F684}) (Version:  - M.S)
MeineDatenBank  2.0 (HKLM-x32\...\{7EA04711-607D-424B-A210-900296D7B874}) (Version:  - M.S)
MFC RunTime files (x32 Version: 1.0.0 - Extensoft) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{98B45D1C-6EB1-460D-A87D-2B60678DC105}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{1948E039-EC79-4591-951D-9867A8C14C90}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{19E8AE59-4D4A-3534-B567-6CC08FA4102E}) (Version: 4.5.51651 - Microsoft Corporation)
Microsoft .NET Framework 4.6 SDK (HKLM-x32\...\{B5915D37-0637-4A26-A3AA-C5DC9F856370}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (ENU) (HKLM-x32\...\{034547E9-D8FA-49E7-8B9C-4C9861FB9146}) (Version: 4.6.00127 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 SDK (Deutsch) (HKLM-x32\...\{529EFF09-750D-48B9-A47A-34A3B6248C3F}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 SDK (HKLM-x32\...\{2F0ECC80-B9E4-4485-8083-CD32F22ABD92}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (ENU) (HKLM-x32\...\{8EEB28EE-5141-411C-9CF0-9952264FE4AF}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (HKLM-x32\...\{8BC3EEC9-090F-4C53-A8DA-1BEC913040F9}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Version Manager (x64) 1.0.0-beta5 (HKLM\...\{c5a4aba3-1aba-3ef8-b2d5-c3fa37f59738}) (Version: 1.0.10609.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Help Viewer 2.0 Language Pack - DEU (HKLM-x32\...\Microsoft Help Viewer 2.0 Language Pack - DEU) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.25420 - Microsoft Corporation)
Microsoft Office 2000 Disc 2 (HKLM-x32\...\{00040407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office Access Runtime (German) 2007 (HKLM-x32\...\{90120000-001C-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM\...\{36E619BC-A234-4EC3-849B-779A7C865A45}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{6B7B7E62-9F56-4C87-8664-0E20F2CAB03B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{D4DA7C91-A59F-4C72-BAC4-DF7C76AB1CB8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (HKLM\...\{55FABD1D-8BE6-4A1A-958D-52B15F1DFEF0}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{13C9CD03-A5FE-4F50-AC8A-17B77C38CC52}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{28C7A4BB-3966-4373-8376-C11F38290630}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects  (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects  (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL ScriptDom  (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 T-SQL Language Service  (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2016 LocalDB  (HKLM\...\{E359515A-92E6-4FA3-A2C9-E1BA02D8DE6E}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 Management Objects  (HKLM-x32\...\{0F1C8E2F-199A-4946-B3BF-0906DACFD032}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 Management Objects  (x64) (HKLM\...\{20EA85AA-2A1D-4F11-B09F-4BA2BF3C8989}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server 2016 T-SQL Language Service  (HKLM-x32\...\{8BFDE775-C5B8-46DB-84EF-43FFC8A2E8AD}) (Version: 13.0.14500.10 - Microsoft Corporation)
Microsoft SQL Server 2016 T-SQL ScriptDom  (HKLM\...\{D091DE8C-EA0F-49AF-8DE3-BD6C79737C6E}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 (Deutsch) (HKLM-x32\...\{FA440BE8-EC2F-4478-A01A-077DA0606501}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (11.1.20828.01) (HKLM-x32\...\{E511AE89-54BB-481D-BC4A-1B1F1E1B7693}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (14.0.60519.0) (HKLM-x32\...\{4E27B0EF-7BAB-432A-AF3D-3FC8F3F7353F}) (Version: 14.0.60519.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20828.01) (HKLM-x32\...\{00C84D22-DB8F-4159-BF70-682B8EA56A1E}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{FC3BB979-AA54-4B60-BBA3-2C4DA6E08D80}) (Version: 12.0.2402.29 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{091CE6AA-2753-4F6E-AD1C-0E875744EB54}) (Version: 12.0.2402.29 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2016 (HKLM\...\{96EB5054-C775-4BEF-B7B9-AA96A295EDCD}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2016 (HKLM-x32\...\{84C23ECA-FE4D-494F-9247-3EBAD57E7F0C}) (Version: 13.0.1601.5 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual FoxPro OLE DB Provider (HKLM-x32\...\{3DA245C5-23B1-4874-BFA7-287B7D6C1EF6}) (Version: 1.0.0 - Microsoft Corporation)
Microsoft Visual Studio Community 2015 with Updates (HKLM-x32\...\{79b486b9-c5f0-4096-a00c-8351f59587c2}) (Version: 14.0.25420.1 - Microsoft Corporation)
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (HKLM-x32\...\{69ec32be-d994-44de-9eae-6d86ced6f352}) (Version: 11.0.50727.42 - Microsoft Corporation)
Microsoft Web Deploy 3.6 (HKLM\...\{94E1227C-08A9-4962-B388-1F05D89AEA75}) (Version: 3.1238.1962 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{4C0B27C3-3E8F-4BD2-80FF-6E9E48EBD6D8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{64A5D39C-95CD-4B8B-B2FA-6C713133B57F}) (Version: 11.0.2100.60 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 53.0 (x64 de) (HKLM\...\Mozilla Firefox 53.0 (x64 de)) (Version: 53.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.0.6312 - Mozilla)
MSBuild/NuGet Integration 14.0 (x86) (x32 Version: 14.0.25420 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Multi-Device Hybrid Apps using C# - Templates - ENU (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
NetObjects Fusion Essentials (HKLM-x32\...\{8508AD2F-9837-4CC3-AC3C-05DB64D20275}) (Version: 13.0 - NetObjects)
NetObjects Fusion Essentials (x32 Version: 13.00.0000.5598 - NetObjects) Hidden
NirSoft Wireless Network Watcher (HKLM-x32\...\NirSoft Wireless Network Watcher) (Version:  - )
Norton Security Scan (HKLM-x32\...\NSS) (Version: 4.6.1.80 - Symantec Corporation)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.3.3 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.0.7.34 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.0.7.34 - NVIDIA Corporation)
NVIDIA Grafiktreiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
NvNodejs (Version: 3.0.7.34 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 1.0.0.0 - NVIDIA Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 10.4.9.38188 - Electronic Arts, Inc.)
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.6.1 (Deutsch) (HKLM-x32\...\{4860C1E5-CE58-4D32-89DE-37951333B4C9}) (Version: 4.6.01055 - Microsoft Corporation)
Panda Devices Agent (x32 Version: 1.03.08 - Panda Security) Hidden
Panda Devices Agent (x32 Version: 1.08.00 - Panda Security) Hidden
PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.5134.1 - PreEmptive Solutions) Hidden
Prerequisites for SSDT  (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation)
Prerequisites for SSDT  (HKLM-x32\...\{B7E94916-7AE6-4F7F-A377-7A410A42BA19}) (Version: 13.0.1601.5 - Microsoft Corporation)
PrivaZer (HKLM-x32\...\PrivaZer) (Version: 3.0.19.0 - Goversoft LLC)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Returnil System Safe 2011 (HKLM-x32\...\{92AF8F5C-4F36-4276-ADC7-AC95F348235B}) (Version: 3.2.10853 - CJSC Returnil Software)
RogueKiller Version 12.10.6.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.10.6.0 - Adlice Software)
Roslyn Language Services - x86 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
Roslyn Language Services - x86 (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version:  - Samsung Electronics CO.,LTD)
SanityCheck 2.02 (HKLM\...\SanityCheck_is1) (Version:  - Resplendence Software Projects Sp.)
Serif PagePlus X2 (HKLM-x32\...\{B00B1355-DD54-4314-90B1-161C6A7D3FD3}) (Version: 12.0.0.012 - Serif (Europe) Ltd)
SHIELD Streaming (Version: 7.1.0320 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.0.7.34 - NVIDIA Corporation) Hidden
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
Team Explorer for Microsoft Visual Studio 2015 Update 3.1 (x32 Version: 14.102.25619 - Microsoft) Hidden
Test Tools for Microsoft Visual Studio 2015 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
TrojanHunter 6.0 (HKLM-x32\...\TrojanHunter_is1) (Version: 6.0 - Bytelayer AB)
TypeScript Power Tool (x32 Version: 1.8.34.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2015 (x32 Version: 1.8.36.0 - Microsoft Corporation) Hidden
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Visual Studio 2015 Update 3 (KB3022398) (HKLM-x32\...\{7a68448b-9cf2-4049-bd73-5875f1aa7ba2}) (Version: 14.0.25420 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VS Update core components (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
vs_update3notification (x32 Version: 14.0.25431 - Microsoft Corporation) Hidden
WCF Data Services 5.6.4 Runtime (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2015 (x32 Version: 5.6.62175.4 - Microsoft Corporation) Hidden
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17362 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {01D4B8E8-467A-4035-90A1-6A5D225FBF40} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {0271E4B5-0CBB-4FBD-BF90-A81C65725AA4} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec.exe 
Task: {0AE4797F-C5A4-4793-A9F9-B58F04895C3D} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\CCleaner\CCleaner.exe [2017-04-11] (Piriform Ltd)
Task: {0C59C8F3-5851-4422-A8EB-C1C2E79851EA} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2016-09-30] (NVIDIA Corporation)
Task: {0D876791-6730-4569-91A1-16C55356B8D7} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-09-30] (NVIDIA Corporation)
Task: {0DA3D330-6608-429D-8C7F-772E1B18F40A} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {22093BCE-0D5C-4DE1-97BA-2DE8FBB4AC7B} - System32\Tasks\Microsoft\VisualStudio\VSIX Auto Update 14 => D:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\VSIXAutoUpdate.exe [2016-06-20] (Microsoft Corporation)
Task: {283FE97C-0921-46FD-89AA-0964480D6676} - System32\Tasks\BDAntiCryptoWallTask => D:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe [2016-05-16] ()
Task: {2CE6F91D-AD61-4A5B-A47E-7BDA0D5CC3EE} - System32\Tasks\Apple\AppleSoftwareUpdate => D:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe 
Task: {2CFBDC09-4D64-44E6-9ECF-CC7F0F76D9BF} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {2FD69397-024B-4ED2-9C5F-29C651355DE4} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {3B5223C3-3DF8-4660-9F71-06FA0C9AC531} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe 
Task: {3D2FDB4D-CAC6-4CE1-A3EA-06B7D18227A5} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-09-30] (NVIDIA Corporation)
Task: {6EADAB68-C306-4603-AAAC-2714B530E405} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {7F5F7452-6161-4DD5-91D9-FCFE41EC5B08} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-09-30] (NVIDIA Corporation)
Task: {7F871D47-7D40-4C22-8BF0-7084448DCE1C} - System32\Tasks\{E7EB9F2C-A589-4420-A190-2EBD4D9356C5} => pcalua.exe -a D:\Users\käptnBlaubär\Downloads\MDAC_TYP.EXE -d D:\Users\käptnBlaubär\Downloads
Task: {8B70AB37-B99E-4BC4-8D87-F711C3643B21} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {95E9774F-A4C2-4FBD-A92D-D0CE10521609} - System32\Tasks\Norton Security Scan for Nada => D:\Program Files (x86)\Norton Security Scan\Engine\4.6.1.80\Nss.exe [2016-11-03] (Symantec Corporation)
Task: {9B8180B6-C3BC-4406-B40D-C9247E07DC26} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {AB65F659-6576-490A-9175-C613E99BAF1E} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {ABB7C120-8C3C-4B0D-87F9-B1FB6910205F} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {AD543F3E-A6BA-4963-B9D4-65399B2608F0} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe 
Task: {DB45A22E-95DB-417E-B2F4-942A0E3F37A3} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-09-30] (NVIDIA Corporation)
Task: {DFD1099D-3BBF-445F-A770-310BDD089ABA} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe 
Task: {E7953A10-891C-4E02-8853-7BFF209B64A5} - System32\Tasks\PrivaZer_SkipUAC => D:\Program Files (x86)\PrivaZer\PrivaZer.exe [2017-04-02] (Goversoft LLC)
Task: {FC71D964-1996-43EF-BCD8-211A7E12C037} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe 
Task: {FD040641-285A-4D1B-87CA-569A58C603B6} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => D:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2016-09-30] (NVIDIA Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () D:\WINDOWS\SYSTEM32\ism32k.dll
2017-04-11 19:36 - 2017-03-28 08:22 - 02681200 _____ () D:\WINDOWS\system32\CoreUIComponents.dll
2016-02-01 19:25 - 2008-06-04 16:53 - 00027648 _____ () D:\WINDOWS\System32\spd__l6.dll
2016-02-01 19:25 - 2009-03-18 14:05 - 00685568 _____ () D:\WINDOWS\system32\spool\DRIVERS\x64\3\spd__du.dll
2014-10-03 20:56 - 2015-09-29 20:38 - 00076152 _____ () D:\WINDOWS\SysWOW64\PnkBstrA.exe
2017-04-20 16:01 - 2017-03-22 09:39 - 00169656 _____ () D:\Program Files\CyberGhost 6\Data\Firewall\x64\nfapi.DLL
2017-04-11 19:36 - 2017-03-28 08:22 - 02681200 _____ () D:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-10-09 20:17 - 2016-10-09 20:17 - 00959168 _____ () D:\Users\käptnBlaubär\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64\ClientTelemetry.dll
2016-10-05 15:38 - 2016-10-07 21:54 - 03525431 _____ () D:\Program Files (x86)\PrivaZer\PrivaMenu5.dll
2016-09-21 22:16 - 2016-09-21 22:16 - 00230064 _____ () D:\Program Files\Notepad++\NppShell_06.dll
2016-10-10 12:07 - 2016-09-07 06:56 - 00134656 _____ () D:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-15 17:55 - 2017-03-04 08:31 - 00474112 _____ () D:\Windows\ShellExperiences\QuickActions.dll
2017-03-15 17:55 - 2017-03-04 08:12 - 09760768 _____ () D:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-15 17:55 - 2017-03-04 08:05 - 01401856 _____ () D:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-15 17:55 - 2017-03-04 08:05 - 00757248 _____ () D:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-04-11 19:36 - 2017-03-28 07:08 - 02424320 _____ () D:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-04-11 19:36 - 2017-03-28 07:11 - 04853760 _____ () D:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-04-29 10:52 - 2016-05-16 16:25 - 01318488 _____ () D:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe
2017-04-29 10:52 - 2015-08-14 14:49 - 00614400 _____ () D:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDMetrics.dll
2017-05-02 20:49 - 2016-12-12 02:16 - 00271280 _____ () D:\Users\käptnBlaubär\Downloads\prozesseChecken\cce_x64\themes\CCE.THEME
2017-05-02 20:49 - 2016-03-16 12:25 - 00073912 _____ () D:\Users\käptnBlaubär\Downloads\prozesseChecken\cce_x64\scanners\smart.cav

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: D:\ProgramData\TEMP:341E39B2 [127]
AlternateDataStreams: D:\ProgramData\TEMP:55B41E6A [122]
AlternateDataStreams: D:\ProgramData\TEMP:9A870F8B [932]
AlternateDataStreams: D:\ProgramData\TEMP:AC64BB05 [131]
AlternateDataStreams: D:\ProgramData\TEMP:CB0AACC9 [320]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\localhost -> hxxps://localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2016-12-29 17:30 - 00000938 _____ D:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-2210758347-1204338499-507655992-1000\Control Panel\Desktop\\Wallpaper -> d:\users\käptnblaubär\appdata\local\microsoft\windows\themes\img10.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\Services: !SASCORE => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: HDDlife HDD Access service => 3
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NvContainerLocalSystem => 2
MSCONFIG\Services: NvContainerNetworkService => 3
MSCONFIG\Services: NVIDIA Wireless Controller Service => 2
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: RUBotSrv => 2
MSCONFIG\Services: Samsung UPD Service => 3
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: XblAuthManager => 3
MSCONFIG\Services: XblGameSave => 3
MSCONFIG\Services: XboxNetApiSvc => 3
HKLM\...\StartupApproved\StartupFolder: => "Malwarebytes Anti-Ransomware.lnk"
HKLM\...\StartupApproved\StartupFolder: => "RSS 2011.lnk"
HKLM\...\StartupApproved\Run: => "NvBackend"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\StartupFolder: => "MALWAREBYTES ANTI-RANSOMWARE.LNK"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "SUPERAntiSpyware"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "Kaspersky Software Updater"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "KSS"
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\StartupApproved\Run: => "CyberGhost"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-dcom] => (Block) %SystemRoot%\system32\svchost.exe
FirewallRules: [RVM-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe
FirewallRules: [RemoteDesktop-Shadow-In-TCP] => (Block) %SystemRoot%\system32\RdpSa.exe
FirewallRules: [{7F769B1A-858C-458B-9A95-FCF7E5EFA399}] => (Allow) D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP3e\WNt600x64\RpcSandraSrv.exe
FirewallRules: [{41724820-1BA1-49E5-BE8C-9DF9A7514327}] => (Allow) D:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe
FirewallRules: [{20B3855F-1D77-488C-A050-B71C2E34D227}] => (Allow) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F76BB3A0-1177-4D72-BBDF-383DFAE32FBB}] => (Allow) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6A13DC88-D16A-4C3D-8925-88FCED9383EA}] => (Allow) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{78948828-5201-497F-9ED0-DBAB838215D6}] => (Allow) D:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{824E0CB4-2954-46A1-9499-1D88D3360982}] => (Allow) D:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{6F41A2D2-BB0F-4472-8855-6FBB7119011A}] => (Allow) D:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{10AFA1D6-1B82-425C-813B-4CF0928E8C60}] => (Allow) D:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{AA6D773E-F25C-4A29-B21D-F255C0EFB9F7}] => (Allow) D:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{0C4085FB-E4A8-494B-B93A-8CD6532DE3A8}] => (Allow) D:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{E0B059C6-F1D4-4441-9780-D8553F11B575}] => (Allow) D:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\WDExpress.exe
FirewallRules: [{E83FB76E-9205-4B6B-8264-196650AF4E39}] => (Allow) D:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{9EBF74DB-BC08-40B6-9575-D8D213608D0A}] => (Allow) D:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{941EDF7C-AC2E-43A4-8F97-03BB134C3A76}] => (Allow) D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP3e\RpcAgentSrv.exe
FirewallRules: [{B1FB53ED-8CBF-4BD7-B2E1-6F7037D2C96D}] => (Allow) D:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{E69C2C7A-2AE5-4E02-B62F-28AFE47B84B1}] => (Allow) D:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{AD7DB536-19D1-4741-B5CA-38074D5E1A78}] => (Allow) D:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{3344C11A-A8FE-4C9A-A9DD-BEEA3D386BF9}] => (Allow) D:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{2384AD3A-D15A-4F07-994F-EBAFEC09606D}] => (Allow) D:\Windows\System32\SUPDSvc.exe
FirewallRules: [{CB56C37F-E60F-44CB-A761-A3E48F5845AA}] => (Allow) D:\Windows\System32\SUPDSvc.exe
FirewallRules: [{49EAE512-EEE3-49B1-9BC4-32F5A7F2FEEC}] => (Allow) D:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{5BD170FA-F34F-4319-8887-B087D7380D33}] => (Allow) D:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{9CE0734A-6829-49A3-81D6-8034B1FECDD0}] => (Allow) D:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{6D6BFBEA-9B0A-4F8F-AD28-79BA423DB5D5}] => (Allow) D:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{1E574917-8CE3-4A76-A3F1-3F565C77BA0F}] => (Allow) D:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{478E522C-A52C-44EA-8670-B3E6C5E89A15}] => (Allow) D:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{6F94AA1F-8281-48E4-9FE4-335A3C70952E}] => (Allow) D:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{631237D1-47B0-48CB-930E-FE9A63BDD72A}D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.vshost.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.vshost.exe
FirewallRules: [UDP Query User{79479189-1BE3-4180-8F59-FF21B7EA6F40}D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.vshost.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.vshost.exe
FirewallRules: [TCP Query User{2C07FB38-2308-41C4-8EA1-3DDE4F628B43}D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.exe
FirewallRules: [UDP Query User{B887583F-AF8C-41D9-AEA1-3A5C9CE84EE1}D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\mserver\mserver\bin\debug\mserver.exe
FirewallRules: [TCP Query User{56F9FDED-A005-4E74-9A7F-2FEFBCC8BC73}D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.vshost.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.vshost.exe
FirewallRules: [UDP Query User{E4569F72-193F-45C8-B231-2A3B0ED01148}D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.vshost.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.vshost.exe
FirewallRules: [TCP Query User{5E2B3BAD-54EE-438C-AC3C-1F309DA1993F}M:\programmieren_2016\visualstudioprojekte\fertige\meinserver\meinserver\bin\debug\meinserver.exe] => (Allow) M:\programmieren_2016\visualstudioprojekte\fertige\meinserver\meinserver\bin\debug\meinserver.exe
FirewallRules: [UDP Query User{1FB60CBB-26D5-4F74-9C58-A75F86DE2937}M:\programmieren_2016\visualstudioprojekte\fertige\meinserver\meinserver\bin\debug\meinserver.exe] => (Allow) M:\programmieren_2016\visualstudioprojekte\fertige\meinserver\meinserver\bin\debug\meinserver.exe
FirewallRules: [TCP Query User{171C4656-4433-4F65-97D4-6CF2B47E7A39}D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.exe
FirewallRules: [UDP Query User{8526678C-D896-49D7-87C9-BC30E338E603}D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.exe] => (Allow) D:\users\käptnblaubär\documents\visual studio 2015\projects\meinserver\meinserver\bin\debug\meinserver.exe
FirewallRules: [{DF89024D-2B67-4DA0-9C70-25F04DDFD0AF}] => (Allow) D:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{053641C4-8E62-423E-830A-D1BCA1D101FE}] => (Allow) D:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{47366012-3301-451E-B967-326DA431DB42}] => (Allow) D:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{69B051BA-DDF0-4670-9130-E5299DDCB00D}] => (Allow) D:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{15C47165-9F69-45AD-B585-0115FD36FBFB}D:\program files\mozilla firefox\firefox.exe] => (Block) D:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{10937510-0CE9-4228-AC1A-2E4453E174F8}D:\program files\mozilla firefox\firefox.exe] => (Block) D:\program files\mozilla firefox\firefox.exe
FirewallRules: [{312AD574-CAF1-4AB3-84D3-3C9936F5111E}] => (Allow) D:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3FAC850C-2CB5-4E7C-A3DF-353FC2451365}] => (Allow) LPort=2869
FirewallRules: [{AEFE14F6-3CDA-438C-B783-08410C687D01}] => (Allow) LPort=1900
FirewallRules: [{E62DE134-693D-44A0-BE77-A4DD434723E5}] => (Allow) D:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe
FirewallRules: [{5919157E-1C8C-4E91-AE5C-7AF5171615B9}] => (Allow) D:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro 2\Apowersoft Screen Recorder Pro 2.exe
FirewallRules: [{20ADF67F-6DAC-41BB-8BAA-0995BAF0A1E0}] => (Allow) D:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{0767923C-CD9E-4991-8A43-09B1226DDE4E}] => (Allow) D:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe

==================== Wiederherstellungspunkte =========================

27-04-2017 14:50:16 Microsoft Visual C++ 2005 Redistributable wird installiert
27-04-2017 15:00:26 JRT Pre-Junkware Removal
01-05-2017 09:53:56 Windows Update
01-05-2017 09:54:39 Windows Update
01-05-2017 10:33:34 Installed Compatibility Pack for the 2007 Office system
02-05-2017 17:44:02 Installed SafenSoft SysWatch.
02-05-2017 17:48:03 Installed SafenSoft SysWatch.
02-05-2017 17:56:03 Removed SafenSoft SysWatch.
02-05-2017 20:15:14 Returnil System Safe 2011 wird installiert

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (05/02/2017 11:26:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 11:26:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 11:16:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 11:16:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 11:06:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 11:06:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 10:56:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 10:56:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 10:46:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).

Error: (05/02/2017 10:46:55 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des Avira Antivirus-Status auf SECURITY_PRODUCT_STATE_ON (Fehler %3).


Systemfehler:
=============
Error: (05/02/2017 09:10:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft Visual Studio 2012 (KB3002339)

Error: (05/02/2017 09:10:43 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft Visual Studio 2012 (KB2781514)

Error: (05/02/2017 09:09:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Returnil System Safe Core Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/02/2017 09:06:23 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "CDPUserSvc_34db1" wurde mit folgendem Fehler beendet: 
Unbekannter Fehler

Error: (05/02/2017 09:03:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.

Error: (05/02/2017 09:03:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Origin Web Helper Service erreicht.

Error: (05/02/2017 09:02:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "WMPNetworkSvc" ist vom Dienst "WSearch" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.

Error: (05/02/2017 09:02:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "rvsmonn" ist vom Dienst "rvsmon" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
Ein an das System angeschlossenes Gerät funktioniert nicht.

Error: (05/02/2017 09:02:52 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "rvsmonf" ist vom Dienst "rvsmon" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
Ein an das System angeschlossenes Gerät funktioniert nicht.

Error: (05/02/2017 08:42:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.


CodeIntegrity:
===================================
  Date: 2017-04-27 12:20:22.419
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Users\käptnBlaubär\Desktop\security\security\sysinternals\PORTMSYS.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.450
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.439
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.427
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.410
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.396
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:56:32.389
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 12:38:10.011
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 10:45:07.782
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-21 10:44:47.507
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\BEC5.tmp because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Ende von Addition.txt ============================
         

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 01-05-2017
durchgeführt von Nada (Administrator) auf NONNAME (02-05-2017 23:33:31)
Gestartet von D:\Users\käptnBlaubär\Downloads
Geladene Profile: Nada (Verfügbare Profile: Nada)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Microsoft Corporation) D:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) D:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) D:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) D:\Windows\System32\mqsvc.exe
() D:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) D:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(CyberGhost S.R.L) D:\Program Files\CyberGhost 6\CyberGhost.Service.exe
(Microsoft Corporation) D:\Windows\System32\dllhost.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\Antivirus\avshadow.exe
() D:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe
(Mozilla Corporation) D:\Program Files\Mozilla Firefox\firefox.exe
(F-Secure Corporation) D:\Users\käptnBlaubär\Downloads\fseasyclean.exe
(COMODO) D:\Users\käptnBlaubär\Downloads\prozesseChecken\cce_x64\CCE.exe
(Microsoft Corporation) D:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) D:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [NvBackend] => D:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1803976 2016-12-09] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => D:\Program Files (x86)\Avira\Antivirus\avgnt.exe [909744 2017-03-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => D:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [63432 2017-01-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\Run: [CyberGhost] => D:\Program Files\CyberGhost 6\CyberGhost.exe [1229360 2017-03-22] (CyberGhost S.R.L.)
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\Run: [CCleaner Monitoring] => D:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-11] (Piriform Ltd)
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\MountPoints2: {96ef2f02-b7e1-11e6-affc-00241dcdd299} - "G:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\MountPoints2: {96ef3006-b7e1-11e6-affc-00241dcdd299} - "G:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\...\MountPoints2: {982a3fa4-8bac-11e6-8259-ac6d6fc2ffef} - "L:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
Startup: D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cardisabled [2017-05-02] ()
GroupPolicy: Beschränkung <======= ACHTUNG
GroupPolicyScripts: Beschränkung <======= ACHTUNG
GroupPolicyScripts\User: Beschränkung <======= ACHTUNG
GroupPolicyScripts-x32: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{5fc12dcf-8f58-4b1e-b714-1f3f22a18988}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{5fc12dcf-8f58-4b1e-b714-1f3f22a18988}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{76bd2376-4dec-4907-811f-8ccb99843d19}: [DhcpNameServer] 192.168.42.129

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2210758347-1204338499-507655992-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> D:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-02-10] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> D:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-10] (Oracle Corporation)
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF ProfilePath: D:\Users\käptnBlaubär\AppData\Roaming\Nvu\Profiles\rsb2mpcf.default [2016-12-27]
FF ProfilePath: D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904 [2017-05-02]
FF Homepage: Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904 -> Google.ch
FF NetworkProxy: Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904 -> type", 0
FF Extension: (Advanced Cookie Manager) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\cookiemgr@jayapal.com [2016-10-22]
FF Extension: (SQLite Manager) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2016-12-06]
FF Extension: (NoScript) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-04-22]
FF Extension: (Video DownloadHelper) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-12-30]
FF Extension: (Adblock Plus) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF Extension: (BetterPrivacy) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2016-12-21]
FF Extension: (DownThemAll!) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-10-20]
FF Extension: (Shield Recipe Client) - D:\Users\käptnBlaubär\AppData\Roaming\Mozilla\Firefox\Profiles\t1a1hz6g.default-1476978448904\features\{e75cc523-2972-4051-acdc-9ff1e83de574}\shield-recipe-client@mozilla.org.xpi [2017-04-29]
FF SearchPlugin: D:\Program Files (x86)\mozilla firefox\browser\searchplugins\pandasecuritytb.xml [2017-01-02]
FF Plugin: @esn/npbattlelog,version=2.6.2 -> D:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2014-12-03] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.7.1 -> D:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> D:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> D:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> D:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2014-12-03] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> D:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [Keine Datei]
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> D:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-10] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> D:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-10] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> D:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> D:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> D:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> D:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> D:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> D:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [Keine Datei]

Opera: 
=======
OPR Extension: (360 Internet Protection) - D:\Users\käptnBlaubär\AppData\Roaming\Opera Software\Opera Stable\Extensions\cnpeghmjdfdmneiljeibjnemfdkojdhl [2016-07-09]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; D:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1115552 2017-03-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\Antivirus\sched.exe [487432 2017-03-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Program Files (x86)\Avira\Antivirus\avguard.exe [487432 2017-03-21] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; D:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1519136 2017-03-21] (Avira Operations GmbH & Co. KG)
S4 Apple Mobile Device Service; D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 Avira.ServiceHost; D:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [349096 2017-01-19] (Avira Operations GmbH & Co. KG)
R2 CG6Service; D:\Program Files\CyberGhost 6\CyberGhost.Service.exe [87088 2017-03-22] (CyberGhost S.R.L)
S3 IEEtwCollectorService; D:\Windows\system32\IEEtwCollector.exe [114688 2015-08-15] (Microsoft Corporation) [Datei ist nicht signiert]
S3 MBAMService; D:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S4 NvContainerLocalSystem; D:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [457272 2016-09-30] (NVIDIA Corporation)
S4 NvContainerNetworkService; D:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [457272 2016-09-30] (NVIDIA Corporation)
S4 NVIDIA Wireless Controller Service; D:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe [1165368 2016-09-30] (NVIDIA Corporation)
S4 Origin Client Service; D:\Program Files (x86)\Origin\OriginClientService.exe [2147216 2017-04-18] (Electronic Arts)
S2 Origin Web Helper Service; D:\Program Files (x86)\Origin\OriginWebHelperService.exe [3116440 2017-04-18] (Electronic Arts)
R2 PnkBstrA; D:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-09-29] ()
S4 RUBotSrv; D:\Program Files (x86)\Trend Micro\RUBotted\RUBotSrv.exe [443416 2013-07-25] (Trend Micro Inc.)
S2 RVSMONBL; D:\Program Files (x86)\Returnil\RVS3\rvsmon.exe [1714696 2010-10-22] (CJSC Returnil Software)
S4 SandraAgentSrv; D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP3e\RpcAgentSrv.exe [73200 2014-10-06] (SiSoftware) [Datei ist nicht signiert]
S3 Sense; D:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 VSStandardCollectorService140; D:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-09-06] (Microsoft Corporation)
S3 WdNisSvc; D:\Program Files\Windows Defender\NisSrv.exe [347328 2017-03-28] (Microsoft Corporation)
S3 WinDefend; D:\Program Files\Windows Defender\MsMpEng.exe [103720 2017-03-28] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; D:\WINDOWS\System32\DRIVERS\avgntflt.sys [161824 2017-03-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; D:\WINDOWS\system32\DRIVERS\avipbb.sys [163976 2017-03-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; D:\WINDOWS\system32\DRIVERS\avkmgr.sys [44488 2017-03-21] (Avira Operations GmbH & Co. KG)
R2 avnetflt; D:\WINDOWS\system32\DRIVERS\avnetflt.sys [88488 2017-03-21] (Avira Operations GmbH & Co. KG)
R0 avusbflt; D:\WINDOWS\System32\Drivers\avusbflt.sys [48584 2017-03-21] (Avira Operations GmbH & Co. KG)
R1 cgnetfilter1521; D:\WINDOWS\System32\drivers\cgnetfilter1521.sys [84768 2017-03-22] (Windows (R) Win 7 DDK provider)
S3 eeCtrl; D:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497392 2016-04-28] (Symantec Corporation)
S3 EraserUtilDrv11521; D:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11521.sys [156912 2016-04-28] (Symantec Corporation)
R3 esihdrv; D:\Users\käptnBlaubär\AppData\Local\Temp\esihdrv.sys [191664 2017-05-02] (ESET) <==== ACHTUNG
R1 HssDRV6; D:\WINDOWS\system32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
S3 MEMSWEEP2; D:\WINDOWS\system32\BEC5.tmp [6144 2009-06-18] (Sophos Plc) [Datei ist nicht signiert]
S3 MFE_RR; D:\Users\käptnBlaubär\AppData\Local\Temp\mfe_rr.sys [24120 2017-05-02] (McAfee, Inc.) <==== ACHTUNG
S3 NetAdapterCx; D:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 netr28ux; D:\WINDOWS\System32\drivers\netr28ux.sys [2224128 2016-07-16] (MediaTek Inc.)
R2 NPF; D:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 NvStreamKms; D:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [29240 2016-09-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; D:\WINDOWS\system32\drivers\nvvad64v.sys [47672 2016-09-30] (NVIDIA Corporation)
S3 PORTMON; D:\Users\käptnBlaubär\Desktop\security\security\sysinternals\PORTMSYS.SYS [28656 2017-04-27] (Systems Internals) [Datei ist nicht signiert]
U5 PROCMON23; D:\Windows\System32\Drivers\PROCMON23.sys [92344 2017-05-02] (Sysinternals - www.sysinternals.com)
S3 PSKMAD; D:\WINDOWS\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
S3 rkhdrv40; D:\Windows\SysWow64\Drivers\rkhdrv40.sys [24320 2017-03-04] () [Datei ist nicht signiert]
S3 rspSanity; D:\WINDOWS\System32\DRIVERS\rspSanity64.sys [29752 2011-05-04] (Resplendence Software Projects Sp.)
R3 rt640x64; D:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S1 rvsmon; D:\WINDOWS\system32\DRIVERS\rvsmon.sys [165664 2010-10-18] (CJSC Returnil Software)
S2 rvsmonf; D:\WINDOWS\System32\DRIVERS\rvsmonf.sys [1436136 2010-10-18] (CJSC Returnil Software)
S2 rvsmonn; D:\WINDOWS\system32\DRIVERS\rvsmonn2.sys [21920 2010-10-18] (CJSC Returnil Software)
R0 RVSystem; D:\WINDOWS\System32\Drivers\RVSystem.sys [61072 2017-05-02] (CJSC Returnil Software)
S3 SANDRA; D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP3e\WNt600x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 taphss6; D:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 tapSF0901; D:\WINDOWS\System32\DRIVERS\tapSF0901.sys [39104 2015-07-31] (Spotflux, Inc.)
S3 WdBoot; D:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; D:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; D:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S0 b06bdrv; System32\drivers\bxvbda.sys [X]
U3 idsvc; kein ImagePath
U2 TMAgent; kein ImagePath
U3 wpcsvc; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-02-15 17:22 - 2017-02-16 09:17 - 0083644 _____ () D:\Program Files (x86)\Debugtest.html
2017-03-19 14:13 - 2017-03-28 09:33 - 0133314 _____ () D:\Users\käptnBlaubär\AppData\Local\ars.cache
2017-03-19 14:13 - 2017-03-28 09:33 - 0388629 _____ () D:\Users\käptnBlaubär\AppData\Local\census.cache
2017-03-19 13:45 - 2017-03-19 13:45 - 0000036 _____ () D:\Users\käptnBlaubär\AppData\Local\housecall.guid.cache
2017-04-07 09:01 - 2017-04-07 09:01 - 0006819 _____ () D:\Users\käptnBlaubär\AppData\Local\recently-used.xbel
2017-04-29 11:19 - 2017-04-29 11:19 - 0001293 _____ () D:\Users\käptnBlaubär\AppData\Local\Temp1.html
2017-04-29 11:19 - 2017-04-29 11:19 - 0012562 _____ () D:\Users\käptnBlaubär\AppData\Local\Temp34.html

Einige Dateien in TEMP:
====================
2017-05-01 17:48 - 2017-05-01 17:48 - 5441776 _____ (APOWERSOFT LIMITED                                          ) D:\Users\käptnBlaubär\AppData\Local\Temp\ApowersoftVideoEditor-x0r3jzwl.svp.exe
2017-05-02 17:42 - 2016-11-11 12:13 - 1886344 _____ (Microsoft Corporation) D:\Users\käptnBlaubär\AppData\Local\Temp\dllnt_dump.dll

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

D:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
D:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
D:\WINDOWS\explorer.exe => Datei ist digital signiert
D:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
D:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
D:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
D:\WINDOWS\system32\services.exe => Datei ist digital signiert
D:\WINDOWS\system32\User32.dll => Datei ist digital signiert
D:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
D:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
D:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
D:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
D:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
D:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
D:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-04-24 11:33

==================== Ende von FRST.txt ============================