| |
| |||||||
Log-Analyse und Auswertung: Windows 10: Virus installiert (russische) SoftwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
10.11.2017, 14:19
| #1 |
 |  Windows 10: Virus installiert (russische) Software Liebes Trojanerboard, ich habe ein Problem mit dem Rechner meines Mitbewohners. Nachdem sich eine Zip-Datei als .exe getarnt hatte und entsprechend ausgeführt wurde, begann ein Virus, der sich als ICQ-Installation tarnte, unzählige Programme zu installieren, die meisten davon in russischer Sprache. Er hat die Software versucht zu deinstallieren, währenddessen kamen allerdings immer weitere hinzu und Chrome öffnete zunehmend seltsame Tabs. Seitdem ich am Rechner bin, habe ich ihn im abgesicherten Modus gestartet und die Software, die sich deinstallieren ließ, deinstalliert. Gerade habe ich FRST und MBAM durchlaufen lassen, folgendes sind die Ergebnisse: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 02-11-2017
durchgeführt von mail (Administrator) auf DESKTOP-39IFTOA (10-11-2017 14:06:59)
Gestartet von C:\Users\mail\Downloads
Geladene Profile: mail (Verfügbare Profile: defaultuser0 & mail)
Platform: Windows 10 Pro Version 1703 15063.674 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Spotify Ltd) C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Lenovo) C:\Users\mail\AppData\Local\Apps\2.0\XN8WOZ2K.D1V\WP5PNMPP.86D\lsb...tion_2d7b41b05b24775e_0001.0006_589ac911618caaca\LSB.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.410_none_9e914f9d2d85dacb\TiWorker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.257.247.0.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-11-01] (Dropbox, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Run: [Spotify Web Helper] => C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-27] (Spotify Ltd)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\MountPoints2: {e2da70c1-bd99-11e6-a447-806e6f6e6963} - "D:\o2Start.exe"
Startup: C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2017-11-08]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung <==== ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{31f33a9e-6641-11e7-a1db-806e6f6e6963}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{99bca9e2-2395-4ec2-b319-d8253fcec71b}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [DhcpNameServer] 10.216.1.1
Tcpip\..\Interfaces\{d0c1fc48-c0e2-4c01-88e8-8e9d67fda094}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{dcd20406-ab04-403e-8a08-6a9b94c429f7}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{defa2878-05d2-444f-aef2-ac5b1b0fa4da}: [NameServer] 8.8.8.8
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> {B74BA737-8C40-47FF-8801-482874673E45} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-11-07] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-10-20] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: 96sqw910.default
FF ProfilePath: C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default [2017-11-08]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\96sqw910.default -> hxxps://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
FF NetworkProxy: Mozilla\Firefox\Profiles\96sqw910.default -> type", 0
FF NewTabOverride: Mozilla\Firefox\Profiles\96sqw910.default -> Enabled: "id":"{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi [2017-11-08]
FF Extension: (ProxTube) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\ich@maltegoetz.de.xpi [2017-06-30]
FF Extension: (Search and New Tab by Yahoo) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi [2017-11-06]
FF Extension: (Safe Browsing Version 4 (temporary add-on)) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\sbv4-gradual-rollout@mozilla.com.xpi [2017-10-12]
FF Extension: (Поиск@Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi [2017-11-08]
FF Extension: (Пульт) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}.xpi [2017-11-08]
FF Extension: (Adblock Plus) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-08]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: (Citavi Picker) - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2017-03-23]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default -> Not-active:"chrome-extension://fabhkdeopjkcpkmofliimbjckmocfiom/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://inline.go.mail.ru/search?inline_comp=dse&q={searchTerms}&fr=chxtn12.0.23
CHR DefaultSearchKeyword: Default -> inline.go.mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/chrome?q={searchTerms}
CHR Profile: C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default [2017-11-10]
CHR Extension: (Präsentationen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-15]
CHR Extension: (Docs) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-15]
CHR Extension: (Google Drive) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-08]
CHR Extension: (YouTube) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-08]
CHR Extension: (OneTab) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2017-07-06]
CHR Extension: (Polarr Photo Editor) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\djonnbgfieijldcieafgjcnhmpcfpmgg [2017-07-06]
CHR Extension: (Yahoo Partner) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-11-08]
CHR Extension: (Tabellen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-15]
CHR Extension: (IRC QuakeNet webchat) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhaphniflbbhhfailihfckiifpbgeokd [2016-12-08]
CHR Extension: (Google Docs Offline) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-09]
CHR Extension: (AdBlock) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-11-08]
CHR Extension: (Stealthy) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2017-10-26]
CHR Extension: (Imagus) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\immpkjjlgappgfkkfieppnmlhakdmaab [2017-10-29]
CHR Extension: (The Great Suspender) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2017-07-06]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-14]
CHR Extension: (Citavi Picker) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2017-03-23]
CHR Extension: (Google Mail) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-08]
CHR Extension: (Chrome Media Router) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-28]
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8063656 2017-10-31] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-11-01] (Dropbox, Inc.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1648840 2016-08-05] (Foxit Software Inc.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273232 2016-08-24] (Lenovo)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-01-20] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-09-19] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-20] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193464 2017-11-08] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2017-11-08] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2017-11-08] (Malwarebytes)
R1 MpKsl641e927f; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AC10FC23-3DF6-4C0A-ACEC-F4CF7920B1BF}\MpKsl641e927f.sys [58120 2017-11-08] (Microsoft Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvlddmkm.sys [14427064 2017-01-21] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-09-19] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48064 2017-09-19] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [57792 2017-09-19] (NVIDIA Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [422656 2016-03-09] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-10 14:06 - 2017-11-10 14:07 - 000022779 _____ C:\Users\mail\Downloads\FRST.txt
2017-11-10 14:06 - 2017-11-10 14:06 - 000000000 ____D C:\FRST
2017-11-10 14:03 - 2017-11-10 14:03 - 000091890 _____ C:\Users\mail\Desktop\MBAM1.txt
2017-11-10 14:02 - 2017-11-10 14:02 - 000002311 _____ C:\Users\mail\Desktop\MBAM2.txt
2017-11-09 14:28 - 2017-11-09 14:28 - 000000306 __RSH C:\Users\mail\ntuser.pol
2017-11-08 19:16 - 2017-11-08 19:16 - 000000608 _____ C:\Users\mail\Desktop\Neues Textdokument.txt
2017-11-08 18:07 - 2017-11-08 19:54 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-11-08 18:07 - 2017-11-08 19:19 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2017-11-08 18:07 - 2017-11-08 18:07 - 000193464 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2017-11-08 18:07 - 2017-11-08 18:07 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\Program Files\Malwarebytes
2017-11-08 18:07 - 2017-11-01 08:54 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-11-08 18:01 - 2017-11-08 18:01 - 002403328 _____ (Farbar) C:\Users\mail\Downloads\FRST64.exe
2017-11-08 17:56 - 2017-11-08 17:56 - 078346672 _____ (Malwarebytes ) C:\Users\mail\Downloads\mb3-setup-consumer-3.3.1.2183.exe
2017-11-08 17:40 - 2017-11-08 19:28 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-11-08 17:38 - 2017-11-08 19:23 - 000508936 _____ C:\WINDOWS\ntbtlog.txt
2017-11-08 17:23 - 2017-11-08 17:23 - 000008766 _____ C:\Users\mail\AppData\Local\recently-used.xbel
2017-11-08 17:20 - 2017-11-08 17:20 - 000187904 _____ C:\WINDOWS\rsrcs.dll
2017-11-08 17:19 - 2017-11-08 17:44 - 000000000 ____D C:\WINDOWS\SysWOW64\SSL
2017-11-08 17:19 - 2017-11-08 17:19 - 000003476 _____ C:\WINDOWS\System32\Tasks\ad0bac7e89c025620fe2c59cee788b06
2017-11-08 17:19 - 2017-11-08 17:19 - 000003300 _____ C:\WINDOWS\System32\Tasks\0417403daac781b09224837cc2b08bbe
2017-11-08 17:18 - 2017-11-08 17:18 - 000024616 _____ C:\WINDOWS\System32\Tasks\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F}
2017-11-08 17:18 - 2017-11-08 17:18 - 000003720 _____ C:\WINDOWS\System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C}
2017-11-08 17:18 - 2017-11-08 17:18 - 000000000 ____D C:\Users\mail\AppData\Local\Поиcк в Интeрнете
2017-11-08 17:18 - 2017-11-08 17:18 - 000000000 ____D C:\Users\mail\AppData\Local\AdvinstAnalytics
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ C:\Users\mail\AppData\Local\installer.dat
2017-11-08 17:17 - 2017-11-08 17:17 - 000003266 __RSH C:\ProgramData\ntuser.pol
2017-11-08 17:15 - 2017-11-08 17:42 - 000000000 ____D C:\Users\mail\AppData\Local\Mail.Ru
2017-11-08 17:15 - 2017-11-08 17:15 - 000000000 ____D C:\ProgramData\Mail.Ru
2017-11-08 17:08 - 2017-11-08 17:09 - 000000500 _____ C:\Users\mail\Downloads\dundjinni_free_art_a4b-f83.torrent
2017-11-08 17:01 - 2017-11-08 17:12 - 151144754 _____ C:\Users\mail\Downloads\Nicht bestätigt 953397.crdownload
2017-11-08 16:39 - 2017-11-08 16:39 - 000712704 _____ C:\WINDOWS\system32\bi3.exe
2017-11-08 00:53 - 2017-11-08 00:53 - 000214380 _____ C:\Users\mail\Desktop\Wiz20.pdf
2017-11-07 16:04 - 2017-11-07 16:05 - 113493996 _____ C:\Users\mail\Downloads\CA54_JonRobertsDungeon.exe
2017-11-07 15:23 - 2017-11-07 15:23 - 000000000 ____D C:\Users\mail\Downloads\-Getintopc.com-Campaign_Cartographer_3
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\Pymapper9
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pymapper9
2017-11-07 12:06 - 2017-11-07 12:06 - 000306688 _____ C:\WINDOWS\732544d0d69ee4681b6b07707b6a652c.exe
2017-11-07 12:06 - 2017-11-07 12:06 - 000051621 _____ C:\WINDOWS\uninstaller.dat
2017-11-06 19:59 - 2017-11-06 19:59 - 000060450 _____ C:\Users\mail\Downloads\Alternatives Giftsystem.pdf
2017-11-05 12:17 - 2017-11-05 12:17 - 000001160 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2017-11-05 12:17 - 2017-11-05 12:17 - 000000000 ____D C:\Program Files\paint.net
2017-11-05 12:15 - 2017-11-05 12:22 - 000000000 ____D C:\Users\mail\AppData\Local\paint.net
2017-11-05 12:12 - 2017-11-05 12:12 - 000000000 ____D C:\Users\mail\Downloads\paint.net.4.0.10.install
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Geeks3D
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\Program Files (x86)\Geeks3D
2017-11-03 16:53 - 2017-11-03 16:53 - 000000000 ____D C:\Users\mail\Downloads\word
2017-11-03 15:49 - 2017-11-03 15:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-11-02 00:59 - 2017-11-02 00:59 - 000507314 _____ C:\Users\mail\Downloads\Arradon - Untoter Nekromant.pdf
2017-11-02 00:59 - 2017-11-02 00:59 - 000130889 _____ C:\Users\mail\Downloads\Azmalia von Lorstein, die Blutgeweihte.pdf
2017-11-02 00:29 - 2017-11-02 00:29 - 000000000 ___HD C:\OneDriveTemp
2017-11-01 12:58 - 2017-11-01 12:58 - 000051016 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2017-11-01 12:58 - 2017-11-01 12:58 - 000045672 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2017-11-01 12:58 - 2017-11-01 12:58 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2017-11-01 12:58 - 2017-11-01 12:58 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2017-10-24 08:31 - 2017-10-24 08:31 - 000090049 _____ C:\Users\mail\Downloads\Seminarplan.pdf
2017-10-13 12:27 - 2017-10-13 12:27 - 000125998 _____ C:\Users\mail\Downloads\Order Receipt - DE-A-041024.pdf
2017-10-11 12:40 - 2017-10-11 12:40 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2017-10-11 12:29 - 2017-09-30 03:29 - 001408536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-10-11 12:29 - 2017-09-30 03:29 - 000804784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-10-11 12:29 - 2017-09-30 03:26 - 001333136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-10-11 12:29 - 2017-09-30 03:26 - 001292872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-10-11 12:29 - 2017-09-30 03:10 - 001839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-10-11 12:29 - 2017-09-30 03:10 - 000606072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-10-11 12:29 - 2017-09-30 03:09 - 002259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-10-11 12:29 - 2017-09-30 03:09 - 000787712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-10-11 12:29 - 2017-09-30 03:06 - 004471368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-10-11 12:29 - 2017-09-30 03:05 - 005827744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-10-11 12:29 - 2017-09-30 03:05 - 001266544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-10-11 12:29 - 2017-09-30 03:05 - 000750488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-10-11 12:29 - 2017-09-30 03:05 - 000559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-10-11 12:29 - 2017-09-30 03:04 - 004215184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2017-10-11 12:29 - 2017-09-30 03:04 - 000612120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-10-11 12:29 - 2017-09-30 03:04 - 000519680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-10-11 12:29 - 2017-09-30 03:04 - 000438096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-10-11 12:29 - 2017-09-30 03:04 - 000347544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-10-11 12:29 - 2017-09-30 03:04 - 000182680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2017-10-11 12:29 - 2017-09-30 03:03 - 020373408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-10-11 12:29 - 2017-09-30 03:03 - 006768288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-10-11 12:29 - 2017-09-30 03:02 - 001517464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2017-10-11 12:29 - 2017-09-29 08:45 - 002953216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-10-11 12:29 - 2017-09-29 08:43 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-10-11 12:29 - 2017-09-29 08:41 - 013844992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-10-11 12:29 - 2017-09-29 08:40 - 006728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-10-11 12:29 - 2017-09-29 08:40 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-10-11 12:29 - 2017-09-29 08:39 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-10-11 12:29 - 2017-09-29 08:38 - 005721600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2017-10-11 12:29 - 2017-09-29 08:38 - 002671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-10-11 12:29 - 2017-09-29 08:38 - 000471040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-10-11 12:29 - 2017-09-29 08:38 - 000308224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-10-11 12:29 - 2017-09-29 08:37 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2017-10-11 12:29 - 2017-09-29 08:36 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-10-11 12:29 - 2017-09-29 08:34 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-10-11 12:29 - 2017-09-29 08:34 - 000798720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-10-11 12:29 - 2017-09-29 08:34 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-10-11 12:29 - 2017-09-29 08:33 - 007598080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-10-11 12:29 - 2017-09-29 08:33 - 004559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-10-11 12:29 - 2017-09-29 08:33 - 001506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-10-11 12:29 - 2017-09-29 08:32 - 002782720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-10-11 12:29 - 2017-09-29 08:32 - 002340864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2017-10-11 12:29 - 2017-09-29 08:32 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-10-11 12:29 - 2017-09-29 08:32 - 000035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-10-11 12:29 - 2017-09-29 08:29 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll
2017-10-11 12:29 - 2017-09-29 08:24 - 003377664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-10-11 12:29 - 2017-09-19 00:09 - 000554400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-10-11 12:28 - 2017-09-30 06:49 - 001004136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2017-10-11 12:28 - 2017-09-30 06:49 - 000777400 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-10-11 12:28 - 2017-09-30 06:49 - 000135576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-10-11 12:28 - 2017-09-30 06:48 - 008319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-10-11 12:28 - 2017-09-30 06:48 - 002399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-10-11 12:28 - 2017-09-30 06:48 - 002327448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-10-11 12:28 - 2017-09-30 06:47 - 002969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-10-11 12:28 - 2017-09-30 06:47 - 001194792 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2017-10-11 12:28 - 2017-09-30 06:45 - 000511896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2017-10-11 12:28 - 2017-09-30 06:44 - 000181912 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-10-11 12:28 - 2017-09-30 06:42 - 000820120 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-10-11 12:28 - 2017-09-30 06:41 - 005304496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2017-10-11 12:28 - 2017-09-30 06:41 - 000654976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-10-11 12:28 - 2017-09-30 06:41 - 000259400 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2017-10-11 12:28 - 2017-09-30 06:40 - 000724704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-10-11 12:28 - 2017-09-30 06:40 - 000336320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2017-10-11 12:28 - 2017-09-30 06:40 - 000173976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys
2017-10-11 12:28 - 2017-09-30 06:38 - 002239136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-10-11 12:28 - 2017-09-30 06:36 - 002672024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-10-11 12:28 - 2017-09-30 06:36 - 000057976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-10-11 12:28 - 2017-09-30 03:10 - 001150776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2017-10-11 12:28 - 2017-09-30 03:10 - 000508344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-10-11 12:28 - 2017-09-30 03:10 - 000480920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2017-10-11 12:28 - 2017-09-30 03:05 - 002603744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll
2017-10-11 12:28 - 2017-09-30 03:03 - 001439032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-10-11 12:28 - 2017-09-30 03:02 - 001624096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.AppAgent.dll
2017-10-11 12:28 - 2017-09-30 03:02 - 000175512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
2017-10-11 12:28 - 2017-09-30 03:01 - 000124544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-10-11 12:28 - 2017-09-29 08:46 - 023678976 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-10-11 12:28 - 2017-09-29 08:44 - 000133120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-10-11 12:28 - 2017-09-29 08:43 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smartscreenps.dll
2017-10-11 12:28 - 2017-09-29 08:43 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2017-10-11 12:28 - 2017-09-29 08:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mgmtapi.dll
2017-10-11 12:28 - 2017-09-29 08:41 - 000110080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BitLockerCsp.dll
2017-10-11 12:28 - 2017-09-29 08:40 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-10-11 12:28 - 2017-09-29 08:39 - 020511232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-10-11 12:28 - 2017-09-29 08:39 - 011888640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-10-11 12:28 - 2017-09-29 08:38 - 001135616 ____R (The ICU Project) C:\WINDOWS\SysWOW64\icuuc.dll
2017-10-11 12:28 - 2017-09-29 08:38 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.Office2013CustomActions.dll
2017-10-11 12:28 - 2017-09-29 08:38 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2017-10-11 12:28 - 2017-09-29 08:38 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-10-11 12:28 - 2017-09-29 08:38 - 000229376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
2017-10-11 12:28 - 2017-09-29 08:37 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2017-10-11 12:28 - 2017-09-29 08:36 - 019337216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-10-11 12:28 - 2017-09-29 08:35 - 003654656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-10-11 12:28 - 2017-09-29 08:34 - 006255616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-10-11 12:28 - 2017-09-29 08:34 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2017-10-11 12:28 - 2017-09-29 08:33 - 000658944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-10-11 12:28 - 2017-09-29 08:32 - 001244160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-10-11 12:28 - 2017-09-29 08:32 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-10-11 12:28 - 2017-09-29 08:32 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-10-11 12:28 - 2017-09-29 08:32 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\system32\mgmtapi.dll
2017-10-11 12:28 - 2017-09-29 08:31 - 003107328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-10-11 12:28 - 2017-09-29 08:31 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-10-11 12:28 - 2017-09-29 08:31 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-10-11 12:28 - 2017-09-29 08:31 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2017-10-11 12:28 - 2017-09-29 08:30 - 023686144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 008333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 001460736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 001318912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 000724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-10-11 12:28 - 2017-09-29 08:29 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2017-10-11 12:28 - 2017-09-29 08:28 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2017-10-11 12:28 - 2017-09-29 08:28 - 000473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2017-10-11 12:28 - 2017-09-29 08:28 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-10-11 12:28 - 2017-09-29 08:28 - 000297984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2017-10-11 12:28 - 2017-09-29 08:28 - 000104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe
2017-10-11 12:28 - 2017-09-29 08:28 - 000040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cipher.exe
2017-10-11 12:28 - 2017-09-29 08:27 - 012803072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-10-11 12:28 - 2017-09-29 08:27 - 000409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-10-11 12:28 - 2017-09-29 08:27 - 000350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2017-10-11 12:28 - 2017-09-29 08:26 - 008213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-10-11 12:28 - 2017-09-29 08:25 - 008199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-10-11 12:28 - 2017-09-29 08:24 - 001628672 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2017-10-11 12:28 - 2017-09-29 08:23 - 005557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-10-11 12:28 - 2017-09-29 08:23 - 004730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-10-11 12:28 - 2017-09-29 08:23 - 001887744 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2017-10-11 12:28 - 2017-09-29 08:23 - 000756224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-10-11 12:28 - 2017-09-29 08:22 - 002829824 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2017-10-11 12:28 - 2017-09-29 08:21 - 003304448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-10-11 12:28 - 2017-09-29 08:21 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2017-10-11 12:28 - 2017-09-29 08:21 - 000414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-10-11 12:28 - 2017-09-29 08:21 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2017-10-11 12:28 - 2017-09-29 08:20 - 000804864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll
2017-10-11 12:28 - 2017-09-29 08:20 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2017-10-11 12:28 - 2017-09-29 08:20 - 000286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-10-11 12:28 - 2017-09-29 08:19 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2017-10-11 12:28 - 2017-09-29 08:19 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveui.dll
2017-10-11 12:28 - 2017-09-29 08:18 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe
2017-10-11 12:28 - 2017-09-29 08:18 - 000215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\manage-bde.exe
2017-10-11 12:28 - 2017-09-29 08:18 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerDeviceEncryption.exe
2017-10-11 12:28 - 2017-09-29 06:40 - 000804312 _____ C:\WINDOWS\SysWOW64\locale.nls
2017-10-11 12:28 - 2017-09-29 06:40 - 000804312 _____ C:\WINDOWS\system32\locale.nls
2017-10-11 12:28 - 2017-09-20 16:08 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-10-11 12:28 - 2017-09-20 16:08 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-10-11 12:28 - 2017-09-20 16:08 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-10-11 12:28 - 2017-09-18 23:20 - 000831488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-10-11 12:28 - 2017-09-18 23:20 - 000049664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tetheringclient.dll
2017-10-11 12:28 - 2017-09-18 23:15 - 000648704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-10-11 12:27 - 2017-09-30 06:52 - 001595152 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-10-11 12:27 - 2017-09-30 06:51 - 001458320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-10-11 12:27 - 2017-09-30 06:51 - 001147288 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-10-11 12:27 - 2017-09-30 06:51 - 000661224 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-10-11 12:27 - 2017-09-30 06:50 - 001346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-10-11 12:27 - 2017-09-30 06:50 - 001068208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-10-11 12:27 - 2017-09-30 06:50 - 001024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-10-11 12:27 - 2017-09-30 06:48 - 000644696 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2017-10-11 12:27 - 2017-09-30 06:44 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-10-11 12:27 - 2017-09-30 06:43 - 007318888 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-10-11 12:27 - 2017-09-30 06:43 - 002442136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-10-11 12:27 - 2017-09-30 06:42 - 004848952 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-10-11 12:27 - 2017-09-30 06:42 - 001506712 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-10-11 12:27 - 2017-09-30 06:41 - 005477600 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-10-11 12:27 - 2017-09-30 06:41 - 002086808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-10-11 12:27 - 2017-09-30 06:41 - 000961944 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2017-10-11 12:27 - 2017-09-30 06:41 - 000651672 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-10-11 12:27 - 2017-09-30 06:41 - 000257432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2017-10-11 12:27 - 2017-09-30 06:41 - 000228248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-10-11 12:27 - 2017-09-30 06:40 - 000849816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2017-10-11 12:27 - 2017-09-30 06:40 - 000701336 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2017-10-11 12:27 - 2017-09-30 06:40 - 000642680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-10-11 12:27 - 2017-09-30 06:40 - 000558912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-10-11 12:27 - 2017-09-30 06:40 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-10-11 12:27 - 2017-09-30 06:40 - 000184728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2017-10-11 12:27 - 2017-09-30 06:40 - 000072944 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2017-10-11 12:27 - 2017-09-30 06:39 - 021351760 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-10-11 12:27 - 2017-09-30 06:39 - 001694104 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2017-10-11 12:27 - 2017-09-30 06:39 - 000203672 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
2017-10-11 12:27 - 2017-09-30 06:38 - 007910072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-10-11 12:27 - 2017-09-30 06:38 - 001854872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2017-10-11 12:27 - 2017-09-30 06:37 - 002377112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.AppAgent.dll
2017-10-11 12:27 - 2017-09-30 06:37 - 002229144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2017-10-11 12:27 - 2017-09-30 06:37 - 001464728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2017-10-11 12:27 - 2017-09-30 06:36 - 000855960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2017-10-11 12:27 - 2017-09-30 06:36 - 000675224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2017-10-11 12:27 - 2017-09-29 08:34 - 017370624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-10-11 12:27 - 2017-09-29 08:34 - 003669504 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-10-11 12:27 - 2017-09-29 08:33 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-10-11 12:27 - 2017-09-29 08:32 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-10-11 12:27 - 2017-09-29 08:32 - 000209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreenps.dll
2017-10-11 12:27 - 2017-09-29 08:32 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
2017-10-11 12:27 - 2017-09-29 08:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2017-10-11 12:27 - 2017-09-29 08:31 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2017-10-11 12:27 - 2017-09-29 08:31 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\efssvc.dll
2017-10-11 12:27 - 2017-09-29 08:30 - 007931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-10-11 12:27 - 2017-09-29 08:30 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-10-11 12:27 - 2017-09-29 08:30 - 000179200 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerCsp.dll
2017-10-11 12:27 - 2017-09-29 08:30 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-10-11 12:27 - 2017-09-29 08:30 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-10-11 12:27 - 2017-09-29 08:29 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-10-11 12:27 - 2017-09-29 08:29 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-10-11 12:27 - 2017-09-29 08:29 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-10-11 12:27 - 2017-09-29 08:29 - 000304640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2017-10-11 12:27 - 2017-09-29 08:29 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ServiceWorkerHost.exe
2017-10-11 12:27 - 2017-09-29 08:28 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2017-10-11 12:27 - 2017-09-29 08:28 - 000556032 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-10-11 12:27 - 2017-09-29 08:28 - 000527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-10-11 12:27 - 2017-09-29 08:28 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-10-11 12:27 - 2017-09-29 08:28 - 000254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 001321984 ____R (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 000616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowManagement.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 000565760 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 000538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-10-11 12:27 - 2017-09-29 08:27 - 000412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 002809344 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 001468928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 001269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 001197568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.CommonBridge.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 001141760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplySettingsTemplateCatalog.exe
2017-10-11 12:27 - 2017-09-29 08:26 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 000356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2017-10-11 12:27 - 2017-09-29 08:26 - 000045056 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2017-10-11 12:27 - 2017-09-29 08:25 - 004175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-10-11 12:27 - 2017-09-29 08:25 - 002760704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-10-11 12:27 - 2017-09-29 08:25 - 000586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-10-11 12:27 - 2017-09-29 08:24 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-10-11 12:27 - 2017-09-29 08:24 - 002503680 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-10-11 12:27 - 2017-09-29 08:24 - 001886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-10-11 12:27 - 2017-09-29 08:24 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-10-11 12:27 - 2017-09-29 08:24 - 001201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AgentService.exe
2017-10-11 12:27 - 2017-09-29 08:24 - 000684032 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 003140096 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 002730496 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe
2017-10-11 12:27 - 2017-09-29 08:23 - 002446336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 002195968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.ModernAppAgent.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 002055680 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-10-11 12:27 - 2017-09-29 08:23 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 001460224 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 001398784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 001052672 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 000986624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 000841216 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 000647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-10-11 12:27 - 2017-09-29 08:23 - 000512000 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2017-10-11 12:27 - 2017-09-29 08:22 - 001802240 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-10-11 12:27 - 2017-09-29 08:22 - 001438208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-10-11 12:27 - 2017-09-29 08:22 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-10-11 12:27 - 2017-09-29 08:21 - 000722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-10-11 12:27 - 2017-09-29 08:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2017-10-11 12:27 - 2017-09-29 08:21 - 000154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\regsvc.dll
2017-10-11 12:27 - 2017-09-29 08:21 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll
2017-10-11 12:27 - 2017-09-29 08:20 - 001811456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-10-11 12:27 - 2017-09-29 08:20 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll
2017-10-11 12:27 - 2017-09-29 08:20 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiexe.dll
2017-10-11 12:27 - 2017-09-29 08:19 - 002088448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-10-11 12:27 - 2017-09-29 08:19 - 000208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2017-10-11 12:27 - 2017-09-29 08:18 - 002438656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2017-10-11 12:27 - 2017-09-29 08:18 - 001527296 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2017-10-11 12:27 - 2017-09-29 08:18 - 000893440 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2017-10-11 12:27 - 2017-09-29 08:18 - 000603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2017-10-11 12:27 - 2017-09-29 08:18 - 000347648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2017-10-11 12:27 - 2017-09-29 08:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe
2017-10-11 12:27 - 2017-09-29 08:18 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\cipher.exe
2017-10-11 12:27 - 2017-09-19 00:20 - 001065104 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2017-10-11 12:27 - 2017-09-19 00:20 - 000900376 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2017-10-11 12:27 - 2017-09-19 00:18 - 000965024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2017-10-11 12:27 - 2017-09-19 00:17 - 001395664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2017-10-11 12:27 - 2017-09-19 00:17 - 001186464 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2017-10-11 12:27 - 2017-09-19 00:17 - 000821664 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
2017-10-11 12:27 - 2017-09-19 00:11 - 001018272 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2017-10-11 12:27 - 2017-09-18 23:26 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2017-10-11 12:27 - 2017-09-18 23:25 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\eShims.dll
2017-10-11 12:27 - 2017-09-18 23:23 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-10 14:06 - 2017-03-18 22:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-10 14:06 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-10 14:02 - 2017-07-11 14:08 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-10 14:00 - 2016-12-11 14:39 - 000000000 ____D C:\Users\mail\AppData\Local\CrashDumps
2017-11-09 15:02 - 2017-05-02 19:04 - 000000000 ____D C:\Users\mail\AppData\Roaming\BitTorrent
2017-11-09 14:29 - 2016-12-08 15:27 - 000000000 __SHD C:\Users\mail\IntelGraphicsProfiles
2017-11-09 14:28 - 2017-07-11 14:11 - 000000000 ____D C:\Users\mail
2017-11-08 19:53 - 2017-07-11 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-11-08 19:20 - 2017-03-18 12:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-11-08 19:14 - 2016-12-09 01:05 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-08 19:14 - 2016-12-08 15:34 - 000002264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-08 17:46 - 2017-01-25 18:55 - 000000000 ____D C:\Users\mail\AppData\Local\ElevatedDiagnostics
2017-11-08 17:27 - 2016-12-08 18:02 - 000000000 ____D C:\ProgramData\Foxit Software
2017-11-08 17:23 - 2016-12-26 23:56 - 000000000 ____D C:\Users\mail\AppData\Local\gtk-2.0
2017-11-08 17:23 - 2016-12-26 23:32 - 000000000 ____D C:\Users\mail\.gimp-2.8
2017-11-08 17:20 - 2017-05-02 19:11 - 000000000 ____D C:\Users\mail\Documents\PF 3rd Party
2017-11-08 17:17 - 2017-03-18 22:03 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-11-08 17:17 - 2016-07-16 12:47 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-11-08 02:13 - 2016-12-09 01:06 - 000000000 ____D C:\Users\mail\AppData\LocalLow\Mozilla
2017-11-08 00:52 - 2017-03-23 17:58 - 000000000 ____D C:\Users\mail\Documents\Citavi 5
2017-11-07 08:53 - 2017-03-18 22:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-11-07 08:51 - 2016-12-08 19:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-11-07 08:43 - 2016-12-08 15:32 - 000000000 ___RD C:\Users\mail\OneDrive
2017-11-07 08:42 - 2017-07-31 17:24 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-815402739-1259396803-2248114470-1001
2017-11-07 08:42 - 2016-12-08 15:32 - 000002380 _____ C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-11-05 09:05 - 2016-12-08 16:18 - 000000000 ____D C:\Users\mail\AppData\Roaming\NVIDIA
2017-11-04 00:00 - 2017-07-11 14:28 - 002188846 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-11-04 00:00 - 2017-03-20 05:41 - 000987718 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-04 00:00 - 2017-03-20 05:41 - 000213750 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-03 23:53 - 2016-12-09 01:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-03 23:53 - 2016-12-09 01:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-03 15:50 - 2016-12-08 18:04 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-11-02 01:05 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\Packages
2017-11-01 15:47 - 2017-01-25 15:30 - 000000000 ____D C:\Users\mail\.maptool
2017-10-23 16:35 - 2017-03-18 22:01 - 000000000 ____D C:\WINDOWS\INF
2017-10-23 16:35 - 2016-12-08 17:50 - 000000000 ____D C:\Users\mail\AppData\Local\NVIDIA Corporation
2017-10-18 00:03 - 2016-12-08 16:21 - 000000000 ____D C:\ProgramData\Oracle
2017-10-18 00:02 - 2017-03-18 21:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-17 23:52 - 2016-12-11 15:53 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2017-10-14 18:21 - 2016-12-08 18:11 - 000000000 ___RD C:\Users\mail\Dropbox
2017-10-14 15:14 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\rescache
2017-10-13 13:16 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\ConnectedDevicesPlatform
2017-10-13 01:21 - 2017-03-18 22:06 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-10-13 01:21 - 2017-03-18 22:06 - 000177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-11 23:47 - 2016-12-08 18:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-10-11 17:04 - 2016-12-08 15:27 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-11 16:48 - 2017-07-11 14:00 - 000387384 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-11 16:45 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-10-11 16:45 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\Provisioning
2017-10-11 16:45 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-11 16:44 - 2017-03-18 22:03 - 000230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2017-10-11 16:44 - 2017-03-18 22:03 - 000207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2017-10-11 12:45 - 2016-12-10 12:41 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-11 12:40 - 2016-12-10 12:41 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ () C:\Users\mail\AppData\Local\installer.dat
2017-11-08 17:23 - 2017-11-08 17:23 - 000008766 _____ () C:\Users\mail\AppData\Local\recently-used.xbel
2017-07-11 14:06 - 2017-07-11 14:06 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
2017-11-08 17:21 - 2017-11-08 17:20 - 000848880 _____ () C:\Users\mail\AppData\Local\Temp\60D2.tmp.exe
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\7Xfck9gu6RaQ.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\a0cihmQ7qOQd.exe
2017-11-08 17:18 - 2017-11-08 17:18 - 001700140 _____ () C:\Users\mail\AppData\Local\Temp\dkGcWQG2Z2Ic.exe
2017-11-08 17:22 - 2017-11-08 17:20 - 000848880 _____ () C:\Users\mail\AppData\Local\Temp\F419.tmp.exe
2017-11-08 17:15 - 2017-11-08 17:15 - 002643640 _____ () C:\Users\mail\AppData\Local\Temp\h2wD0yUimdTL.exe
2017-11-08 17:21 - 2017-11-08 17:21 - 064938720 ____N (Kometa LCC) C:\Users\mail\AppData\Local\Temp\jFLhCEqErwDH.exe
2017-10-17 23:50 - 2017-10-17 23:50 - 001856576 _____ (Oracle Corporation) C:\Users\mail\AppData\Local\Temp\jre-8u151-windows-au.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\rsp7enBYwyNL.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000491520 _____ () C:\Users\mail\AppData\Local\Temp\UoR7BXFblh6R.exe
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\yL1LhWraFtvM.exe
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-11-02 00:48
==================== Ende von FRST.txt ============================
|
|
10.11.2017, 14:20
| #2 |
| | Windows 10: Virus installiert (russische) SoftwareCode:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 02-11-2017
durchgeführt von mail (10-11-2017 14:09:29)
Gestartet von C:\Users\mail\Downloads
Windows 10 Pro Version 1703 15063.674 (X64) (2017-07-11 13:40:42)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-815402739-1259396803-2248114470-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-815402739-1259396803-2248114470-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-815402739-1259396803-2248114470-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-815402739-1259396803-2248114470-501 - Limited - Disabled)
mail (S-1-5-21-815402739-1259396803-2248114470-1001 - Administrator - Enabled) => C:\Users\mail
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 378.49 - NVIDIA Corporation) Hidden
AutoREALM Version 2.2.1 (HKLM-x32\...\AutoREALM_is1) (Version: - )
BitTorrent (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\BitTorrent) (Version: 7.10.0.43917 - BitTorrent Inc.)
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.5.0.1 - Swiss Academic Software)
CollageIt 1.9.5 (HKLM-x32\...\{D9757258-30B2-496E-86F2-84920C5858E1}_is1) (Version: 1.9.5 - PearlMountain)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.16.50 - Conexant)
Dark Age of Camelot (HKLM-x32\...\Dark Age of Camelot) (Version: - Electronic Arts)
Discord (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Discord) (Version: 0.0.298 - Discord Inc.)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.2.1 - CEWE Stiftung u Co. KGaA)
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.5.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 38.4.27 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
ELAN Touchpad 11.15.0.18_X64 (HKLM\...\Elantech) (Version: 11.15.0.18 - ELAN Microelectronic Corp.)
FastCAD (HKLM-x32\...\FastCAD) (Version: - )
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 8.0.6.909 - Foxit Software Inc.)
Geeks3D FurMark 1.19.1.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version: - Geeks3D)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
IrfanView 4.44 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.44 - Irfan Skiljan)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.15.0414.1 - Vimicro)
Lenovo Service Bridge (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\dda9ca0b023f4c56) (Version: 1.6.4.0 - Lenovo)
Lenovo Solution Center (HKLM\...\{558E50EE-5E2D-479A-A455-8A826191583B}) (Version: 3.3.004.00 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.9 - Thibaut Lauziere)
Malwarebytes Version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.8625.2121 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\OneDriveSetup.exe) (Version: 17.3.7076.1026 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 56.0.2 (x64 de) (HKLM\...\Mozilla Firefox 56.0.2 (x64 de)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 56.0.2.6506 - Mozilla)
Mozilla Thunderbird 52.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.4.0 (x86 de)) (Version: 52.4.0 - Mozilla)
NVIDIA GeForce Experience 3.9.0.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.49 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
PDF Image Extraction Wizard 1.2 (HKLM-x32\...\PDF Image Extraction Wizard 1.2_is1) (Version: - RL Vision)
PDFMate PDF Converter 1.7.5 (HKLM-x32\...\PDFMate PDF Converter_is1) (Version: - pdfmate.com)
Pymapper9 version 9.5 (HKLM-x32\...\{FB6CD2CE-26BF-4F55-A5AD-AC55628AC2DA}_is1) (Version: 9.5 - Toxic Rat Industries)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31222 - Realtek Semiconduct Corp.)
Spotify (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Uthgard Launcher (HKLM-x32\...\Uthgard Launcher) (Version: 1.00.00.00 - Uthgard)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Vulkan Run Time Libraries 1.0.37.0 (HKLM\...\VulkanRT1.0.37.0) (Version: 1.0.37.0 - LunarG, Inc.)
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
XnView 2.41 (HKLM-x32\...\XnView_is1) (Version: 2.41 - Gougelet Pierre-e)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-815402739-1259396803-2248114470-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-08-12] (Foxit Software Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-03] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-01-20] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0C4E832E-F04A-4AEF-B8B2-909B4313E7B8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {167F2551-D0CC-4A6E-87A8-1EE9AAEA0106} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-09-19] (NVIDIA Corporation)
Task: {204C6882-DF25-4A55-8BEE-CAD856479F34} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {30A04931-E773-431F-AF21-55236CBE481B} - System32\Tasks\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F} => C:\WINDOWS\system32\WindowsPowershell\v1.0\powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand IAA7ADsAIAAgACAAOwA7ACAAIAA7ACAAOwAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAPQAiAHMAdABvAHAAIgA7ACQAcwBjAD0AIgBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACIAOwAkAFcAYQByAG4AaQBuAGcAUAByAGUAZgBlAHIA (Der Dateneintrag hat 10072 mehr Zeichen). <==== ACHTUNG
Task: {41FEEF5F-8762-4122-8682-BD10F2C6263D} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {484861FC-9E47-4FFB-B124-AEDDAF9C6C4E} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {4C555743-0F99-4037-B1FE-7CB0765FFE06} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {53E44DE0-EF6E-48EA-83B6-6F43387EBA89} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {5CD983AE-61D1-4F50-85D3-AF7C935DB805} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-09-19] (NVIDIA Corporation)
Task: {6FD57D65-66F5-455A-9D97-DFAA9F693FE8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7159EC6E-08A8-4DA7-BF4F-21B82E68180D} - System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => C:\PROGRA~2\FASTDA~1\FASTDA~1.EXE
Task: {74C25C0E-57E0-4CD9-B312-D7DD4D7D8E4A} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-11-07] (Microsoft Corporation)
Task: {75FE8B99-B0F4-4159-8407-7F76F57D9FCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7E239916-4AD3-4D4D-A09F-A64D620E13C5} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {8C767394-63ED-4D42-A3AA-9CB6B8B78406} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2016-08-24] (Lenovo)
Task: {923CD155-975F-4A02-8581-125AF959A99A} - System32\Tasks\0417403daac781b09224837cc2b08bbe => sc start 0417403daac781b09224837cc2b08bbe <==== ACHTUNG
Task: {96B097DB-6A97-4859-91B9-527F63509A0F} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-08-24] (Lenovo)
Task: {9ECBF216-67A3-46B8-B020-C1C06F4C4397} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-815402739-1259396803-2248114470-1001 => "C:\WINDOWS\system32\rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms
Task: {A2B16A6F-6BA9-4217-991D-E6F393680F2B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {B7666FC2-381A-4A6F-9C41-548F1EF694B2} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {BE2E3880-F457-4548-BFD6-8F1C6076AE05} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {C6956744-A8AE-44E1-A213-008E4823F0D6} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [2016-08-24] ()
Task: {D45BA73C-D40C-4BCC-B4A1-0A1421D5032F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {E358401E-62CC-4EE5-B9E0-C624CF7664D0} - System32\Tasks\ad0bac7e89c025620fe2c59cee788b06 => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File "C:\WINDOWS\ad0bac7e89c025620fe2c59cee788b06.ps1" <==== ACHTUNG
Task: {EAD48978-505B-41BE-A0E0-1591E00491C6} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-09-19] (NVIDIA Corporation)
Task: {EE5FB4A5-3756-47BC-AE3A-61F09F0D89AE} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {F759F44B-5A43-4B69-B549-341BC0CE44F7} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-09-19] (NVIDIA Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-12-08 17:46 - 2017-09-19 08:23 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-11-08 18:07 - 2017-11-01 08:55 - 002299344 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2017-07-11 14:09 - 2017-01-20 16:13 - 000134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-03-18 21:58 - 2017-03-18 21:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 21:59 - 2017-03-20 05:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-11-07 14:25 - 2017-11-07 14:26 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-11-07 14:25 - 2017-11-07 14:26 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-11-07 14:25 - 2017-11-07 14:26 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-11-07 14:25 - 2017-11-07 14:26 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\skypert.dll
2017-11-07 14:25 - 2017-11-07 14:25 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.480.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2017-11-10 14:05 - 2017-11-10 14:06 - 000061952 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2017-11-03 15:48 - 2017-11-01 12:58 - 000724288 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll
2017-11-03 15:48 - 2017-11-01 12:58 - 002002752 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll
2017-11-03 15:48 - 2017-11-01 12:57 - 000100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000020800 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000130512 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001856848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2017-11-03 15:48 - 2017-11-01 12:57 - 000105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000062784 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000040248 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000392656 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000392512 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000026056 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021824 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022856 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000066392 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001796920 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000084424 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001956152 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 003859264 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000154440 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000521024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000050496 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000042304 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000131384 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000218944 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000204096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000054608 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000100688 _____ () C:\Program Files (x86)\Dropbox\Client\windisplaytoast.compiled._DisplayToast.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000027488 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000349128 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000101184 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWinExtras.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000023896 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000025424 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000032600 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000181056 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2017-11-03 15:48 - 2017-11-01 13:01 - 000030536 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000024368 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL
2017-11-03 15:48 - 2017-11-01 13:01 - 001638200 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000545080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000359224 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000038208 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngine.pyd
2016-12-08 17:46 - 2017-09-19 08:23 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\3590F75ABA9E485486C100C1A9D4FF06ZZZ..ZZ.Z..Z...Z:1 [898]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\sharepoint.com -> hxxps://goetheuniversitaet-files.sharepoint.com
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 12:47 - 2017-11-08 17:17 - 000001832 _____ C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 wemsofts.com
127.0.0.1 bongadoom.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 internalcampaigntargets.com
127.0.0.1 bongadoom.com
127.0.0.1 getthefilenow.com
127.0.0.1 bigpicturepop.com
127.0.0.1 wizzcaster.com
127.0.0.1 bestoffersfortoday.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 agent.wizztrakys.com
127.0.0.1 csdimonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 titiaredh.com
127.0.0.1 wepcdisplaysystem.com
127.0.0.1 wepcanalyticsystem.com
127.0.0.1 healthydownload.com
127.0.0.1 leading2download.com
127.0.0.1 dwl0.wizzlabs.com
127.0.0.1 dwl1.wizzlabs.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 dl.smashdl.com
127.0.0.1 downloadmyhost.com
127.0.0.1 lapapahoster.com
127.0.0.1 bratitlamio.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.wizzuniquify.com
127.0.0.1 wizzmonetize.com
127.0.0.1 laserveradedomaina.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mail\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\foto 28.03.16, 03 14 53.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "Discord"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{3264E36F-6CAD-4B11-A1F8-2893FE78CEEB}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{D22A9FB5-F808-42DC-9F87-61A9BBE26BC2}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2E473171-008A-4966-BABB-DCE0C6179FC9}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E9274098-C9DA-40DD-899F-641A24346199}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{895D205B-FEDD-40F7-A600-080C0D8E6B85}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2468923A-D59A-4E55-9DE5-73A657225418}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [UDP Query User{57E89783-32EB-4A2C-9696-CD35FD2B58EC}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [TCP Query User{D8008437-509B-4D4E-B038-6A54E0D4A6FE}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [UDP Query User{E1F79280-719A-46F8-885D-FCC0C1C48F69}C:\program files (x86)\java\jre1.8.0_111\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\java.exe
FirewallRules: [TCP Query User{97AA1379-DF3A-418B-851C-A4D3C50699F9}C:\program files (x86)\java\jre1.8.0_111\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\java.exe
FirewallRules: [UDP Query User{88429F3F-215F-47A2-BC21-43654ECDBA62}C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe
FirewallRules: [TCP Query User{55B4245A-651A-4F69-8024-8139E9ABE510}C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe
FirewallRules: [{F3A0410E-D389-4C9E-8958-016955C67952}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{8F956C12-421A-476D-8BFB-EE5AF7646D97}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [UDP Query User{CE2B7748-5164-4669-804B-A0F7C18ADBC8}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{8A1F13D8-EE89-426A-924B-80663F58D722}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
FirewallRules: [{208BEC37-BE91-4A52-AD79-3E31C610C2F5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FEB4439F-9E3D-4BEC-A1F8-D7E0C0110D32}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3097BE7C-4898-4CD2-8CF5-E11F0C646C42}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{7A361860-11D4-4D5A-A72C-68BF62AD141C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{637CC52B-1B22-45F0-A2E7-876AC357A025}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4D269292-7786-47CC-866C-79CA978C2FCC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B3D92AB8-4B40-4273-AD07-BADFA50FEAC6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{34A9437D-1B8E-4492-96AE-63F443FFB338}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{BF1443E1-45FB-4752-89A4-83DF4413EE33}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [TCP Query User{8832E6A5-75F0-4395-A870-6D4F48C15467}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [UDP Query User{FD6CBCA4-2B1E-42A3-B308-C7BC2954CDC0}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [{E103BBA1-D072-41F2-92EB-D5147BB87668}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{F3DDEE16-0CBC-49E9-9D14-DD5D189F6D7B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{FA424D00-0FB7-4D93-9DD9-4AA1A8B2778C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{49A32A26-78E6-4411-8B65-71D746D787F4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{9F687A38-F8D2-4027-9F04-FFBB7210CA33}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{A110D626-2439-4AB6-BA3C-4A849051C53A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{523D7D06-516C-43A1-AA4A-033776286170}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{1832303E-FE07-45B0-A149-40F05DA7BAFC}C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe
FirewallRules: [UDP Query User{A3F26144-D6B1-4C0C-B4A2-BC820789C000}C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe
FirewallRules: [{ECDD42D5-D680-490C-B2E4-CF0EE1CA3745}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{B77E98B8-7242-4510-A5C4-B41102B2C825}] => (Allow) C:\WINDOWS\system32\rundll32.exe
==================== Wiederherstellungspunkte =========================
23-10-2017 17:26:27 Geplanter Prüfpunkt
31-10-2017 17:46:48 Geplanter Prüfpunkt
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/10/2017 02:00:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: bi3.exe, Version: 1.0.2.7, Zeitstempel: 0x5a0319b7
Name des fehlerhaften Moduls: bi3.exe, Version: 1.0.2.7, Zeitstempel: 0x5a0319b7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000478f6
ID des fehlerhaften Prozesses: 0x8e4
Startzeit der fehlerhaften Anwendung: 0x01d35a23d6b2eee4
Pfad der fehlerhaften Anwendung: C:\WINDOWS\system32\bi3.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\system32\bi3.exe
Berichtskennung: 95c02e14-d5cc-4734-94fa-39896bf02511
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/10/2017 02:00:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: DESKTOP-39IFTOA)
Description: Das Paket „Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe+App“ wurde beendet, da das Anhalten zu lange dauerte.
Error: (11/08/2017 07:52:35 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 512) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.
Details:
Could not query the status of the EventSystem service.
System Error:
Der Computer wird heruntergefahren.
.
Error: (11/08/2017 05:44:59 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Users\mail\AppData\Local\Kometa\Application\kometa.exe". Fehler in Manifest- oder Richtliniendatei "C:\Users\mail\AppData\Local\Kometa\Application\52.0.2743.82\52.0.2743.82.MANIFEST" in Zeile 0.
Ungültige XML-Syntax.
Error: (11/08/2017 05:43:08 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Users\mail\AppData\Local\Kometa\Application\kometa.exe". Fehler in Manifest- oder Richtliniendatei "C:\Users\mail\AppData\Local\Kometa\Application\52.0.2743.82\52.0.2743.82.MANIFEST" in Zeile 0.
Ungültige XML-Syntax.
Error: (11/08/2017 05:40:26 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Users\mail\AppData\Local\Kometa\Application\kometa.exe". Fehler in Manifest- oder Richtliniendatei "C:\Users\mail\AppData\Local\Kometa\Application\52.0.2743.82\52.0.2743.82.MANIFEST" in Zeile 0.
Ungültige XML-Syntax.
Error: (11/08/2017 05:40:14 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Users\mail\AppData\Local\Kometa\Application\kometa.exe". Fehler in Manifest- oder Richtliniendatei "C:\Users\mail\AppData\Local\Kometa\Application\52.0.2743.82\52.0.2743.82.MANIFEST" in Zeile 0.
Ungültige XML-Syntax.
Error: (11/08/2017 05:17:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: starter.exe, Version: 1.0.0.1, Zeitstempel: 0x5a032af9
Name des fehlerhaften Moduls: ntdll.dll, Version: 10.0.15063.608, Zeitstempel: 0x802f667e
Ausnahmecode: 0xc0000028
Fehleroffset: 0x000a38b9
ID des fehlerhaften Prozesses: 0x2284
Startzeit der fehlerhaften Anwendung: 0x01d358ad09a323e8
Pfad der fehlerhaften Anwendung: C:\Users\mail\AppData\Local\Temp\5sfvhcwr.ibf\starter.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll
Berichtskennung: 8ce00ab3-4cd6-4b50-b5c3-5408ea813c6b
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/08/2017 05:17:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: starter.exe, Version: 1.0.0.1, Zeitstempel: 0x5a032af9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x00450e2a
ID des fehlerhaften Prozesses: 0x2284
Startzeit der fehlerhaften Anwendung: 0x01d358ad09a323e8
Pfad der fehlerhaften Anwendung: C:\Users\mail\AppData\Local\Temp\5sfvhcwr.ibf\starter.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: d810ce53-5526-4351-bc2a-820241d2bb0c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/08/2017 05:17:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: starter.exe, Version: 1.0.0.1, Zeitstempel: 0x5a032af9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x00450e2a
ID des fehlerhaften Prozesses: 0x2284
Startzeit der fehlerhaften Anwendung: 0x01d358ad09a323e8
Pfad der fehlerhaften Anwendung: C:\Users\mail\AppData\Local\Temp\5sfvhcwr.ibf\starter.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: b60448d9-47eb-4ada-8a61-623b5f284a28
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Systemfehler:
=============
Error: (11/09/2017 08:13:45 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/09/2017 02:29:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (11/09/2017 02:29:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.
Error: (11/09/2017 02:28:38 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/09/2017 02:28:38 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/08/2017 07:53:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SAService" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.
Error: (11/08/2017 07:53:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CldFlt" wurde aufgrund folgenden Fehlers nicht gestartet:
Die Anforderung wird nicht unterstützt.
Error: (11/08/2017 07:52:34 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
Error: (11/08/2017 07:52:34 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
Error: (11/08/2017 07:52:34 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
CodeIntegrity:
===================================
Date: 2017-11-07 15:42:06.651
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-05 01:49:05.270
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-17 01:58:20.458
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-12 16:36:38.103
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-21 23:31:01.932
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-15 21:20:30.027
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-08-09 16:49:22.963
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-21 17:49:22.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-18 18:29:38.752
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-17 18:33:33.774
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 46%
Installierter physikalischer RAM: 6046.35 MB
Verfügbarer physikalischer RAM: 3224.51 MB
Summe virtueller Speicher: 7006.35 MB
Verfügbarer virtueller Speicher: 3970.61 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:464.65 GB) (Free:344.03 GB) NTFS
Drive d: (o2 CD) (CDROM) (Total:0.36 GB) (Free:0 GB) CDFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1A9999E4)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=464.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=782 MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
10.11.2017, 14:51
| #3 |
| | Windows 10: Virus installiert (russische) SoftwareCode:
ATTFilter Malwarebytes
www.malwarebytes.com
-Protokolldetails-
Scan-Datum: 08.11.17
Scan-Zeit: 18:09
Protokolldatei: 9d734252-c4a7-11e7-9880-dc0ea1fe1870.json
Administrator: Ja
-Softwaredaten-
Version: 3.3.1.2183
Komponentenversion: 1.0.236
Version des Aktualisierungspakets: 1.0.3207
Lizenz: Testversion
-Systemdaten-
Betriebssystem: Windows 10 (Build 15063.674)
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-39IFTOA\mail
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 410664
Erkannte Bedrohungen: 526
In die Quarantäne verschobene Bedrohungen: 524
Abgelaufene Zeit: 7 Min., 27 Sek.
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
Modul: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 74
Backdoor.XTRat, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SvcHost Service Host, In Quarantäne, [591], [224521],1.0.3207
Backdoor.XTRat, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE, In Quarantäne, [591], [224521],1.0.3207
Backdoor.XTRat, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE, In Quarantäne, [591], [224521],1.0.3207
PUP.Optional.MailRu, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\hcadgijmedbfgciegjomfpjcdchlhnif, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.SearchModule, HKLM\SOFTWARE\SearchModule, In Quarantäne, [675], [388629],1.0.3207
PUP.Optional.SpeeDownloader, HKLM\SOFTWARE\Speedownloader0099, In Quarantäne, [8174], [384272],1.0.3207
Adware.Wajam, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, In Quarantäne, [491], [-1],0.0.0
PUP.Optional.MailRu, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bhjhnafpiilpffhglajcaepjbnbjemci, In Quarantäne, [680], [448286],1.0.3207
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\TASKENG.EXE, In Quarantäne, [5417], [425125],1.0.3207
PUP.Optional.MailRu, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}, In Quarantäne, [680], [382913],1.0.3207
PUP.Optional.InstallCore, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\csastats, In Quarantäne, [2], [260986],1.0.3207
PUP.Optional.SpeeDownloader, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\Speedownloader0099, In Quarantäne, [8174], [453126],1.0.3207
Adware.REOptimizer, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\119, In Quarantäne, [7060], [417947],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\lhemechcanjmilllmccjbjldonmnnjjj, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.SystemHealer, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\SYSTEM HEALER, In Quarantäne, [994], [261796],1.0.3207
Adware.DNSUnlocker.ACMB2, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\11598763487076930564, In Quarantäne, [1745], [424293],1.0.3207
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE, In Quarantäne, [5417], [425124],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, In Quarantäne, [559], [398592],1.0.3207
PUP.Optional.Search.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6237A681-5509-44AC-A2AE-416CCF438329}, In Quarantäne, [9105], [256101],1.0.3207
PUP.Optional.BitCoinMiner, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\gplyra, In Quarantäne, [180], [317317],1.0.3207
PUP.Optional.ProductSetup, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\PRODUCTSETUP, In Quarantäne, [14420], [242047],1.0.3207
PUP.Optional.ChinAd, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wfcre, In Quarantäne, [96], [417524],1.0.3207
PUP.Optional.SpeeDownloader, HKLM\SOFTWARE\WOW6432NODE\Speedownloader0099, In Quarantäne, [8174], [384272],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROLEAVES\Online Application, In Quarantäne, [559], [360190],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{02206A9D-A145-43D6-95DD-9E15A82FB210}, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2863EBE6-E01B-4B0E-820F-32A61A0A3B2E}, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{28C4B9DD-8ADC-4548-B68F-8D29AD9B2ADE}, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38F24578-012A-4641-A003-F6A4542FC7CA}, In Quarantäne, [559], [317311],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3E485764-3335-4C7C-B7F7-78E4C1093182}, In Quarantäne, [526], [449223],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{56AD3B6F-D600-495E-A40F-E6060B713736}, In Quarantäne, [526], [449223],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{56CB40B9-75DE-4DFB-AB0E-2058B4C1F7D1}, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROLEAVES\Online.io Application, In Quarantäne, [559], [317312],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{72D43993-EF70-469A-9F0B-1FBC4DC4CC2A}, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8F595E67-760F-42FB-90F2-3C2F77E8CE1F}, In Quarantäne, [559], [391427],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{B2EC9408-DC17-414C-9EF5-5F44A3997327}, In Quarantäne, [526], [448304],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{B42FC9C5-F005-40AF-85D3-5B9C6F4C6DE8}, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BC96365D-6AB4-4C54-925A-17C1F51933E2}, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC76EB8-EC8D-4BFD-A0E4-424CF226B94E}, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROLEAVES\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, In Quarantäne, [559], [339688],1.0.3207
Trojan.Agent.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C3BF34D0-D0C0-4CEC-A924-F89040E5FC03}, In Quarantäne, [466], [399557],1.0.3207
PUP.Optional.MailRu, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DDF4D034-8ECB-447A-B27A-8F0481309781}, In Quarantäne, [680], [403907],1.0.3207
PUP.Optional.SpeeDownloader, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\WOW6432NODE\Speedownloader0099, In Quarantäne, [8174], [453126],1.0.3207
PUP.Optional.Goobzo.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\jlcgehabolcakkjhgmgpkagpolbjlhfa, In Quarantäne, [2648], [371293],1.0.3207
Adware.RuKometa, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\KometaInstaller, In Quarantäne, [149], [387291],1.0.3207
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\NSaveA, In Quarantäne, [395], [451259],1.0.3207
Trojan.Agent.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\etdctrl, In Quarantäne, [466], [399558],1.0.3207
PUP.Optional.MailRu, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\MailRuUpdater, In Quarantäne, [680], [403908],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G1, In Quarantäne, [559], [317313],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G2, In Quarantäne, [559], [317313],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G3, In Quarantäne, [559], [317313],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G4, In Quarantäne, [559], [317313],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G5, In Quarantäne, [559], [317313],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Online Application V2G6, In Quarantäne, [559], [317313],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PjDfytumxbayONn, In Quarantäne, [526], [449224],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PjDfytumxbayONn2, In Quarantäne, [526], [449224],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SystemHealer Monitor, In Quarantäne, [994], [252788],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SystemHealer Run Delay, In Quarantäne, [994], [252788],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SystemHealer Task, In Quarantäne, [994], [252788],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Updater_Online_Application, In Quarantäne, [559], [391428],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\zjwPaeaadZaNwF, In Quarantäne, [526], [448305],1.0.3207
PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, In Quarantäne, [83], [170024],1.0.3207
PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, In Quarantäne, [83], [170024],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, In Quarantäne, [526], [420739],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, In Quarantäne, [526], [420739],1.0.3207
Adware.NeoBar, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, In Quarantäne, [526], [420739],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\CLASSES\CLSID\{C0D38E5A-7CF8-4105-8FE8-31B81443A114}, In Quarantäne, [526], [420739],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{8E8F97CD-60B5-456F-A201-73065652D099}, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\CLASSES\IESearchPlugin.MailRuBHO, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\CLASSES\IESearchPlugin.MailRuBHO.1, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}, In Quarantäne, [10], [351113],1.0.3207
PUP.Optional.Wajam, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, In Quarantäne, [83], [170024],1.0.3207
Registrierungswert: 38
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_WINDOWSPOWERSHELL_V1.0_POWERSHELL.EXE|WINDOWPOSITION, In Quarantäne, [5417], [425126],1.0.3207
Adware.Wajam, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Entfernung fehlgeschlagen, [491], [-1],0.0.0
Adware.Wajam, HKU\S-1-5-19\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In Quarantäne, [491], [-1],0.0.0
Adware.Wajam, HKU\S-1-5-20\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In Quarantäne, [491], [-1],0.0.0
Adware.Wajam, HKU\S-1-5-21-815402739-1259396803-2248114470-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In Quarantäne, [491], [-1],0.0.0
Adware.Wajam, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In Quarantäne, [491], [-1],0.0.0
Adware.Wajam, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Entfernung fehlgeschlagen, [491], [-1],0.0.0
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\TASKENG.EXE|WINDOWPOSITION, In Quarantäne, [5417], [425125],1.0.3207
PUP.Optional.MailRu, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}|URL, In Quarantäne, [680], [382913],1.0.3207
PUP.Optional.MailRu, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}|FAVICONURLFALLBACK, In Quarantäne, [680], [382913],1.0.3207
PUP.Optional.MailRu, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}|SUGGESTIONSURL, In Quarantäne, [680], [382913],1.0.3207
Adware.REOptimizer, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\119|DISPLAYNAME, In Quarantäne, [7060], [417947],1.0.3207
PUP.Optional.SystemHealer, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\SYSTEM HEALER|CARTURL, In Quarantäne, [994], [261796],1.0.3207
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE|WINDOWPOSITION, In Quarantäne, [5417], [425124],1.0.3207
PUP.Optional.Search.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6237A681-5509-44AC-A2AE-416CCF438329}|OSDFILEURL, In Quarantäne, [9105], [256101],1.0.3207
PUP.Optional.Search.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6237A681-5509-44AC-A2AE-416CCF438329}|FAVICONURL, In Quarantäne, [9105], [256101],1.0.3207
PUP.Optional.Search.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6237A681-5509-44AC-A2AE-416CCF438329}|URL, In Quarantäne, [9105], [256101],1.0.3207
PUP.Optional.ProductSetup, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\PRODUCTSETUP|TB, In Quarantäne, [14420], [242047],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{02206A9D-A145-43D6-95DD-9E15A82FB210}|PATH, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2863EBE6-E01B-4B0E-820F-32A61A0A3B2E}|PATH, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{28C4B9DD-8ADC-4548-B68F-8D29AD9B2ADE}|PATH, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38F24578-012A-4641-A003-F6A4542FC7CA}|PATH, In Quarantäne, [559], [317311],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3E485764-3335-4C7C-B7F7-78E4C1093182}|PATH, In Quarantäne, [526], [449223],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{56AD3B6F-D600-495E-A40F-E6060B713736}|PATH, In Quarantäne, [526], [449223],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{56CB40B9-75DE-4DFB-AB0E-2058B4C1F7D1}|PATH, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{72D43993-EF70-469A-9F0B-1FBC4DC4CC2A}|PATH, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8F595E67-760F-42FB-90F2-3C2F77E8CE1F}|PATH, In Quarantäne, [559], [391427],1.0.3207
Adware.NeoBar, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{B2EC9408-DC17-414C-9EF5-5F44A3997327}|PATH, In Quarantäne, [526], [448304],1.0.3207
PUP.Optional.SystemHealer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{B42FC9C5-F005-40AF-85D3-5B9C6F4C6DE8}|PATH, In Quarantäne, [994], [258707],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BC96365D-6AB4-4C54-925A-17C1F51933E2}|PATH, In Quarantäne, [559], [317311],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BCC76EB8-EC8D-4BFD-A0E4-424CF226B94E}|PATH, In Quarantäne, [559], [317311],1.0.3207
Trojan.Agent.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C3BF34D0-D0C0-4CEC-A924-F89040E5FC03}|PATH, In Quarantäne, [466], [399557],1.0.3207
PUP.Optional.MailRu, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DDF4D034-8ECB-447A-B27A-8F0481309781}|PATH, In Quarantäne, [680], [403907],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}|CONTACT, In Quarantäne, [559], [333852],1.0.3207
PUP.Optional.OnlineIO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}|URLINFOABOUT, In Quarantäne, [559], [321304],1.0.3207
Trojan.ProxyAgent, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|dclink, In Quarantäne, [214], [449161],1.0.3207
Trojan.Agent.Generic, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|TEFUUKJDFV.exe, In Quarantäne, [466], [369948],1.0.3207
Adware.Amonetize, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|DAMRPRKUGH.exe, In Quarantäne, [333], [378669],1.0.3207
Registrierungsdaten: 11
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|DhcpNameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}|DhcpNameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{99bca9e2-2395-4ec2-b319-d8253fcec71b}|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}|DhcpNameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{d0c1fc48-c0e2-4c01-88e8-8e9d67fda094}|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{dcd20406-ab04-403e-8a08-6a9b94c429f7}|NameServer, Ersetzt, [1745], [-1],0.0.0
Adware.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{defa2878-05d2-444f-aef2-ac5b1b0fa4da}|NameServer, Ersetzt, [1745], [-1],0.0.0
PUP.Optional.Search.ShrtCln, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Ersetzt, [9105], [291049],1.0.3207
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
Ordner: 67
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Crashpad\reports, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Crashpad, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.BitCoinMiner, C:\USERS\MAIL\APPDATA\ROAMING\GPLYRA, In Quarantäne, [180], [316518],1.0.3207
PUP.Optional.PCCleanPlus, C:\PROGRAM FILES (X86)\PCCLEANPLUS, In Quarantäne, [221], [363175],1.0.3207
Trojan.Agent.Generic, C:\USERS\MAIL\APPDATA\LOCAL\ETDCTRL, In Quarantäne, [466], [399560],1.0.3207
PUP.Optional.MailRu, C:\PROGRAM FILES (X86)\MAIL.RU, In Quarantäne, [680], [384138],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\INSTALLER\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, In Quarantäne, [559], [391425],1.0.3207
PUP.Optional.MirageISO, C:\USERS\PUBLIC\DOCUMENTS\XMUPDATE, In Quarantäne, [9030], [443706],1.0.3207
Adware.OnlineIO, C:\ProgramData\Microleaves\Online Application\updates, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\ProgramData\Microleaves\Online Application, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\PROGRAMDATA\MICROLEAVES, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0\install, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\USERS\MAIL\APPDATA\ROAMING\MICROLEAVES, In Quarantäne, [8642], [399763],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\563a2c32-06b3-1, In Quarantäne, [8415], [407181],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\563a2c32-34e7-0, In Quarantäne, [8415], [407181],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\563a2c32-3e73-1, In Quarantäne, [8415], [407181],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\e823f6f6-11e3-0, In Quarantäne, [8415], [407181],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\e823f6f6-7c95-1, In Quarantäne, [8415], [407181],1.0.3207
PUP.Optional.BitsInstall.BITSRST, C:\PROGRAMDATA\e823f6f6-7ff1-1, In Quarantäne, [8415], [407181],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\PROGRAM FILES (X86)\MICROLEAVES, In Quarantäne, [8642], [399420],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\distribution, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\unity, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\_metadata, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\icons, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\hcadgijmedbfgciegjomfpjcdchlhnif, In Quarantäne, [680], [448282],1.0.3207
Adware.Wajam, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\rawumvjn.xf3, In Quarantäne, [491], [450113],1.0.3207
Adware.Neoreklami.TskLnk, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\s3445vf4.gvb, In Quarantäne, [281], [452204],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\special\new-year, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\recommendation, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\chrome, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\amigo, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\page-action, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\settings, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\special, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\_metadata, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\external, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\css, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj, In Quarantäne, [10], [450941],1.0.3207
Datei: 336
Backdoor.XTRat, C:\WINDOWS\MICROSOFT\SVCHOST.EXE, In Quarantäne, [591], [224521],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\TASKS\System HealerPeriod.job, In Quarantäne, [994], [252785],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\TASKS\System HealerStartUp.job, In Quarantäne, [994], [252785],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\kometastartdllx64.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\kometastartdllx86.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\kometastartvx64.exe, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\kometastartvx86.exe, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\sciter32.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\sciter64.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\skin_Air.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\skin_Default.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\skin_Jon.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\skin_Win10.dll, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Crashpad\metadata, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Crashpad\settings.dat, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\Bookmarks, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\Cookies, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\data.xml, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\History, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\Login Data, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\User Data\Default\Top Sites, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\SYSTEM32\TASKS\SystemHealer Monitor, In Quarantäne, [994], [252784],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\SYSTEM32\TASKS\SystemHealer Run Delay, In Quarantäne, [994], [252784],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\SYSTEM32\TASKS\SystemHealer Task, In Quarantäne, [994], [252784],1.0.3207
PUP.Optional.SearchModule, C:\USERS\MAIL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\96SQW910.DEFAULT\SEARCHPLUGINS\SMOD.XML, In Quarantäne, [675], [242730],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\SYSTEM32\TASKS\System HealerPeriod, In Quarantäne, [994], [252783],1.0.3207
PUP.Optional.SystemHealer, C:\WINDOWS\SYSTEM32\TASKS\System HealerStartUp, In Quarantäne, [994], [252783],1.0.3207
PUP.Optional.BitCoinMiner, C:\Users\mail\AppData\Roaming\gplyra\config.json, In Quarantäne, [180], [316518],1.0.3207
PUP.Optional.BitCoinMiner, C:\Users\mail\AppData\Roaming\gplyra\gplyra-uninst.exe, In Quarantäne, [180], [316518],1.0.3207
PUP.Optional.BitCoinMiner, C:\Users\mail\AppData\Roaming\gplyra\gplyra.exe, In Quarantäne, [180], [316518],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\INSTALLER\SOURCEHASH{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}, In Quarantäne, [559], [391431],1.0.3207
PUP.Optional.Amonetize.Gen, C:\PROGRAMDATA\563a2c32-34e7-0\BIT3780.tmp, In Quarantäne, [15087], [257931],1.0.3207
PUP.Optional.Amonetize.Gen, C:\PROGRAMDATA\563a2c32-3e73-1\BIT3414.tmp, In Quarantäne, [15087], [257931],1.0.3207
PUP.Optional.Amonetize.Gen, C:\PROGRAMDATA\e823f6f6-11e3-0\BIT6400.tmp, In Quarantäne, [15087], [257931],1.0.3207
PUP.Optional.Amonetize.Gen, C:\PROGRAMDATA\e823f6f6-7ff1-1\BIT63B1.tmp, In Quarantäne, [15087], [257931],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G1, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G2, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G3, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G4, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G5, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\Online Application V2G6, In Quarantäne, [559], [317314],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\UPDATER_ONLINE_APPLICATION.JOB, In Quarantäne, [559], [391430],1.0.3207
Trojan.Agent.Generic, C:\USERS\MAIL\APPDATA\LOCAL\ETDCTRL\ETDCTRL.EXE, In Quarantäne, [466], [399560],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G1.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G2.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G3.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G4.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G5.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\TASKS\Online Application V2G6.job, In Quarantäne, [559], [382506],1.0.3207
PUP.Optional.OnlineIO, C:\Windows\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}\online.exe, In Quarantäne, [559], [391425],1.0.3207
PUP.Optional.OnlineIO, C:\Windows\Installer\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}\SystemFoldermsiexec.exe, In Quarantäne, [559], [391425],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\MAIL.RU.LNK, In Quarantäne, [680], [384473],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\96SQW910.DEFAULT\SEARCHPLUGINS\mailru.xml, In Quarantäne, [680], [384856],1.0.3207
PUP.Optional.MirageISO, C:\USERS\PUBLIC\DOCUMENTS\XMUPDATE\CONF.DB, In Quarantäne, [9030], [443706],1.0.3207
PUP.Optional.OnlineIO, C:\WINDOWS\SYSTEM32\TASKS\UPDATER_ONLINE_APPLICATION, In Quarantäne, [559], [391429],1.0.3207
Adware.OnlineIO, C:\ProgramData\Microleaves\Online Application\updates\basic_updates.aiu, In Quarantäne, [8642], [399763],1.0.3207
Adware.OnlineIO, C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1\Basic Installer with memory detection.msi, In Quarantäne, [8642], [399763],1.0.3207
Adware.NeoBar, C:\WINDOWS\SYSTEM32\TASKS\PjDfytumxbayONn, In Quarantäne, [526], [449225],1.0.3207
Adware.NeoBar, C:\WINDOWS\SYSTEM32\TASKS\PjDfytumxbayONn2, In Quarantäne, [526], [449225],1.0.3207
Trojan.Agent, C:\WINDOWS\MICROSOFT\SVCHOST.EXE.EXE, In Quarantäne, [19], [420426],1.0.3207
Adware.OnlineIO, C:\PROGRAM FILES (X86)\MICROLEAVES\Online Application\Online Application Updater.exe, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online.io EULA.url, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online.io Privacy.url, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Uninstall Online Application.lnk, In Quarantäne, [8642], [399420],1.0.3207
Adware.OnlineIO, C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.ini, In Quarantäne, [8642], [399420],1.0.3207
Trojan.Agent.Generic, C:\WINDOWS\SYSTEM32\TASKS\ETDCTRL, In Quarantäne, [466], [399559],1.0.3207
PUP.Optional.MailRu, C:\WINDOWS\SYSTEM32\TASKS\MailRuUpdater, In Quarantäne, [680], [403909],1.0.3207
Adware.SearchAwesome.TskLnk, C:\WINDOWS\ad0bac7e89c025620fe2c59cee788b06.ps1, In Quarantäne, [2377], [428239],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\icons\128.png, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\icons\16.png, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\icons\48.png, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\icons\512.png, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\distribution\background.js, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\distribution\distribution-module.js, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\unity\unity-stub-background.js, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\integration\unity\unity-stub-inject.js, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\_metadata\computed_hashes.json, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\_metadata\verified_contents.json, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\manifest.json, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcadgijmedbfgciegjomfpjcdchlhnif\12.0.28_0\metrics.js, In Quarantäne, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [680], [448282],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Ersetzt, [680], [448282],1.0.3207
Adware.NeoBar, C:\WINDOWS\SYSTEM32\TASKS\zjwPaeaadZaNwF, In Quarantäne, [526], [448306],1.0.3207
Adware.Wajam, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\rawumvjn.xf3\s2s_install.exe, In Quarantäne, [491], [450113],1.0.3207
Adware.Neoreklami.TskLnk, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\s3445vf4.gvb\gib_1_m_baty.exe, In Quarantäne, [281], [452204],1.0.3207
Adware.NeoBar, C:\WINDOWS\TASKS\PjDfytumxbayONn.job, In Quarantäne, [526], [449226],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [680], [448286],1.0.3207
PUP.Optional.RussAd, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Ersetzt, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\css\cs-add-site.css, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\css\main.css, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\external\build.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\Lato-Black.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\Lato-Bold.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\Lato-Light.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\Lato-Regular.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\OpenSans-Bold.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\OpenSans-Light.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\OpenSans-Regular.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\OpenSans-Semibold.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\fonts\PTM75F_W.woff, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\at-sign.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\games.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\horo-large.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\horo-medium.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\horo-small.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\mail-large.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\mail-medium.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\mail-small.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\music-large.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\music-medium.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\music-small.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\extensions\music-special.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\anchor-scroll.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\downloads.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\favorites.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\history.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\message-center.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\footer-icons\settings.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-left-arrow-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-left-arrow-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-left-from-top-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-left-from-top-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-right-from-top-arrow-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\bottom-right-from-top-arrow-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\top left-arrow-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\top-left-arrow-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\top-right-arrow-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\arrows\top-right-arrow-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\add-site.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\add-tile.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\can-drag-tile.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\drag-tile-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\hint-cross.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\hint-more-themes.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\restore-tile.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\hints\robot.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\libra-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\aquarius-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Aquarius.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\aries-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\aries.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\cancer-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Cancer.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\capricorn-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Capricorn.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\gemini-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Gemini.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\leo-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Leo.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Libra.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\pisces-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\pisces.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\sagittarius-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Sagittarius.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\scorpio-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Scorpio.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\taurus-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Taurus.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\virgo-dark.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\horo\Virgo.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\amigo\icon128.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\amigo\icon16.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\amigo\icon48.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\chrome\icon128.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\chrome\icon19.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\icons\chrome\icon48.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\hitech.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\media-arrow-left.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\media-arrow-old.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\media-arrow-right.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\recipes-left.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\media-tile\recipes-right.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\adding-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\adding.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\menu-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\menu.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\onboarding-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\onboarding-done.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\search-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\search.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\sites-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\sites.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\onboarding\start.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\page-action\add.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\page-action\added.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\page-action\disabled.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\aliexpress.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\ask.fm.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\cloud.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\confluence.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\dobro.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\facebook.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\fotostrana.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\games.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\hr.corp.mail.ru_irj_portal.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\instagram.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\jira.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\my.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\news.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\ok.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\otvet.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\sf.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\sys.mail.ru.blog.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\sys.mail.ru.ideas.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\sys.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\tanks.mail.ru_game_unity.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\twitter.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\vk.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\vkontakte.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\wf.mail.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\wikipedia.org.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\predefined\youtube.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\recommendation\heart.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search\loupe.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search\search-arrow.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\settings\collections-icon.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\settings\modes-icon.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\settings\presets-description-icon.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\settings\themes-icon.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\1.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\2.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\3.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\4.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\5.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\showcase-placeholders\games\6.jpg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\facebook.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\fb-hover.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\mm-hover.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\my.mail.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\ok-hover.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\ok.ru.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\tw-hover.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\twitter.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\vk-hover.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\social\vk.com.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\special\new-year\new_year_big.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\special\new-year\new_year_middle.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\special\new-year\new_year_small.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\authors-info.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\authors-info.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\error.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\loaded-empty.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\random.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\shuffle.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\themes__arrow-left.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\themes__arrow-right.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\upload.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\themes\upload.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings\mode-large.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings\mode-medium.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings\mode-mix.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings\mode-small.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\tiles-settings\mode-switch.gif, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\1.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\10.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\11.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\2.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\3.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\4.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\5.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\6.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\7.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\8.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\weather\9.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\no-int-big-black.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\arrows.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\black-cross.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\boards-icon.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\boards-panel-preview.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\combined.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\combined.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\currency-arrow-light-rotated.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\currency-arrow-light.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\currency-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\dialog-cross.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\dots.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\drag-arrows.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\drop-arrow-up.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\drop-arrow.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\green-circle.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\no-int-big-white.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\options-spritesheet.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\pencil.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\plus.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\puppy-error.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\remove-tile-cross.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search-cancel-button.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search-crosses.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\search.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\side-menu.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\spinner.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\spinner.svg, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\trash.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\img\white-cross.png, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js\app.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js\background.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js\cs-add-site.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js\preload.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\js\vendors.js, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\_metadata\verified_contents.json, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\background.html, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\manifest.json, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\sign.bin, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhemechcanjmilllmccjbjldonmnnjjj\3.3.5_1\visual-bookmarks.html, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\000003.log, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\CURRENT, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\LOCK, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\LOG, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\LOG.old, In Quarantäne, [10], [450941],1.0.3207
PUP.Optional.RussAd, C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lhemechcanjmilllmccjbjldonmnnjjj\MANIFEST-000001, In Quarantäne, [10], [450941],1.0.3207
Adware.Linkury.Generic, C:\USERS\MAIL\APPDATA\LOCAL\PO.DB, In Quarantäne, [1931], [412180],1.0.3207
PUP.Optional.ChinAd, C:\WINDOWS\SYSTEM32\DRIVERS\WFCRE.SYS, In Quarantäne, [96], [417524],1.0.3207
PUP.Optional.Goobzo.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [2648], [371293],1.0.3207
PUP.Optional.Amonetize, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\AMIPIXEL.CFG, In Quarantäne, [6], [302488],1.0.3207
Adware.Linkury.TskLnk, C:\USERS\MAIL\APPDATA\LOCAL\INSTALLATIONCONFIGURATION.XML, In Quarantäne, [3941], [444923],1.0.3207
PUP.Optional.Search.ShrtCln, C:\USERS\MAIL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\96SQW910.DEFAULT\PREFS.JS, Ersetzt, [9105], [301760],1.0.3207
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\96SQW910.DEFAULT\PREFS.JS, Ersetzt, [680], [382918],1.0.3207
Trojan.ProxyAgent, C:\USERS\MAIL\APPDATA\LOCAL\DCLINK.DLL, In Quarantäne, [214], [449161],1.0.3207
PUP.Optional.RussAd, C:\USERS\MAIL\APPDATA\LOCAL\MAIL.RU\SPUTNIK\IE_ADDON_DLL.DLL, In Quarantäne, [10], [351113],1.0.3207
Trojan.Agent.Generic, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\ZLDTLALZLY\TEFUUKJDFV.EXE, In Quarantäne, [466], [369948],1.0.3207
Adware.Amonetize, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\ZLDTLALZLY\DAMRPRKUGH.EXE, In Quarantäne, [333], [378669],1.0.3207
PUP.Optional.FastDataX, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\0G245MPD.IDJ\DATA.EXE, In Quarantäne, [8462], [407240],1.0.3207
PUP.Optional.EnjoyWiFi, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\1R4QE1TD.GKA\SETUP.4.22.EXE, In Quarantäne, [8710], [417533],1.0.3207
Adware.Linkury, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\5SFVHCWR.IBF\STARTER.EXE, In Quarantäne, [2042], [448342],1.0.3207
Adware.RuKometa, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\CR_82971.TMP\SETUP.EXE, In Quarantäne, [149], [454370],1.0.3207
PUP.Optional.SystemHealer, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\YCLLYKWV.L1U\SYSTEMHEALER.EXE, In Quarantäne, [994], [424479],1.0.3207
Adware.Tuto4PC, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\KYUHILXTPTYI.EXE, In Quarantäne, [395], [438990],1.0.3207
PUP.Optional.Goobzo, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\PER5733.TMP, In Quarantäne, [346], [333435],1.0.3207
Adware.LoadMoney, C:\USERS\MAIL\APPDATA\LOCAL\TEMP\NFCQLLRZWLSV.EXE, In Quarantäne, [45], [450185],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
(end)
Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Protokolldetails-
Scan-Datum: 08.11.17
Scan-Zeit: 19:22
Protokolldatei: ccc3975b-c4b1-11e7-8eaa-dc0ea1fe1870.json
Administrator: Ja
-Softwaredaten-
Version: 3.3.1.2183
Komponentenversion: 1.0.236
Version des Aktualisierungspakets: 1.0.3207
Lizenz: Testversion
-Systemdaten-
Betriebssystem: Windows 10 (Build 15063.674)
CPU: x64
Dateisystem: NTFS
Benutzer: System
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 421534
Erkannte Bedrohungen: 8
In die Quarantäne verschobene Bedrohungen: 8
Abgelaufene Zeit: 29 Min., 44 Sek.
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
Modul: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)
Registrierungswert: 0
(keine bösartigen Elemente erkannt)
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
Ordner: 3
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Kometa, C:\USERS\MAIL\APPDATA\LOCAL\KOMETA, In Quarantäne, [3624], [180814],1.0.3207
Datei: 5
PUP.Optional.Kometa, C:\Users\mail\AppData\Local\Kometa\StartButton\1.0.0.462\startremove.exe, In Quarantäne, [3624], [180814],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16369], [454819],1.0.3207
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Ersetzt, [16369], [454819],1.0.3207
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
(end)
Code:
ATTFilter # AdwCleaner 7.0.4.0 - Logfile created on Fri Nov 10 13:45:18 2017
# Updated on 2017/27/10 by Malwarebytes
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support
***** [ Services ] *****
No malicious services deleted.
***** [ Folders ] *****
Deleted: C:\Windows\System32\\SSL
Deleted: C:\Windows\SysWOW64\\SSL
Deleted: C:\Users\mail\AppData\Local\YSearchUtil
Deleted: C:\Users\mail\AppData\Local\AdvinstAnalytics
Deleted: C:\Users\mail\AppData\Local\Поиcк в Интeрнете
Deleted: C:\ProgramData\Mail.Ru
Deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Mail.Ru
Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru
Deleted: C:\Users\All Users\Mail.Ru
Deleted: C:\Users\mail\AppData\Local\Mail.Ru
***** [ Files ] *****
Deleted: C:\Windows\\rsrcs.dll
Deleted: C:\Users\mail\Favorites\Mail.Ru.url
Deleted: C:\Users\mail\Favorites\Mail.Ru Агент - используй для общения!.url
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
Deleted: 0417403daac781b09224837cc2b08bbe
Deleted: ad0bac7e89c025620fe2c59cee788b06
***** [ Registry ] *****
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Gosearchq
Deleted: [Key] - HKCU\Software\Microsoft\Gosearchq
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Gosearch
Deleted: [Key] - HKCU\Software\Microsoft\Gosearch
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\{94ebd7b5-82ae-449t-b679-3d04078ed154}
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\{94ebd7b5-82ae-449t-b679-3d04078ed154}
Deleted: [Key] - HKCU\Software\Microsoft\{94ebd7b5-82ae-449t-b679-3d04078ed154}
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}
Deleted: [Key] - HKCU\Software\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\NetBox
Deleted: [Key] - HKCU\Software\NetBox
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\FastDataX
Deleted: [Key] - HKCU\Software\FastDataX
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\{6711eba6-cf08-4edw-9528-86004fa424bb}
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\{6711eba6-cf08-4edw-9528-86004fa424bb}
Deleted: [Key] - HKCU\Software\Microsoft\{6711eba6-cf08-4edw-9528-86004fa424bb}
Deleted: [Key] - HKLM\SOFTWARE\Mail.Ru
Deleted: [Key] - HKU\.DEFAULT\Software\Mail.Ru
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Mail.Ru
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\AppDataLow\Software\Mail.Ru
Deleted: [Key] - HKU\S-1-5-18\Software\Mail.Ru
Deleted: [Key] - HKCU\Software\Mail.Ru
Deleted: [Key] - HKCU\Software\AppDataLow\Software\Mail.Ru
Deleted: [Key] - HKLM\SOFTWARE\Microleaves
Deleted: [Key] - HKLM\SOFTWARE\pccleanplus
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\APreSam
Deleted: [Key] - HKCU\Software\Microsoft\APreSam
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\MPrForShutT
Deleted: [Key] - HKCU\Software\Microsoft\MPrForShutT
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d}
Deleted: [Key] - HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d}
Deleted: [Key] - HKCU\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d}
***** [ Firefox (and derivatives) ] *****
Plugin deleted: Домашняя страница Mail.Ru -
Plugin deleted: Поиск@Mail.Ru - mail.ru
Plugin deleted: Search and New Tab by Yahoo - Yahoo
Plugin deleted: __MSG_extName__ -
Startpage deleted: https://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries deleted.
*************************
::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0
*************************
C:/AdwCleaner/AdwCleaner[S0].txt - [5354 B] - [2017/11/10 13:43:38]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########
|
|
13.11.2017, 00:16
| #4 |
| | Windows 10: Virus installiert (russische) Software Aloha Trojanerboard! Kann es sein, dass mein Beitrag irgendwie verschluckt wurde? Wir würden uns hier sehr über Unterstützung freuen, da sich das Problem leider noch immer nicht erledigt hat und der Laptop für eine Hausarbeit benötigt wird  Vielen Dank und liebe Grüße! |
|
14.11.2017, 08:15
| #5 | |
| | Windows 10: Virus installiert (russische) Software Hier noch ein ESET-Log: Zitat:
|
|
14.11.2017, 15:47
| #6 |
| /// TB-Ausbilder   | Windows 10: Virus installiert (russische) Software Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Um die Bereinigung möchlichst effektiv und schnell gestalten zu können, bitte ich um Beachtung der folgenden Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Schritt 1 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Bitte poste mit deiner nächsten Antwort
|
|
15.11.2017, 00:53
| #7 |
| | Windows 10: Virus installiert (russische) Software Großartig, vielen Dank! Hier die Logs: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 12-11-2017 03
durchgeführt von mail (Administrator) auf DESKTOP-39IFTOA (15-11-2017 00:47:02)
Gestartet von C:\Users\mail\Downloads
Geladene Profile: mail (Verfügbare Profile: defaultuser0 & mail)
Platform: Windows 10 Pro Version 1703 15063.674 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Spotify Ltd) C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
() C:\Users\mail\AppData\Local\NVIDIA\NvBackend\Packages\0000adb3\DAO.23132999.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
(Microsoft Corporation) C:\Windows\System32\UNP\UNPCampaignManager.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-11-01] (Dropbox, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Run: [Spotify Web Helper] => C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-27] (Spotify Ltd)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\MountPoints2: {e2da70c1-bd99-11e6-a447-806e6f6e6963} - "D:\o2Start.exe"
Startup: C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2017-11-13]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung <==== ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.216.1.1
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{31f33a9e-6641-11e7-a1db-806e6f6e6963}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{99bca9e2-2395-4ec2-b319-d8253fcec71b}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [DhcpNameServer] 10.216.1.1
Tcpip\..\Interfaces\{d0c1fc48-c0e2-4c01-88e8-8e9d67fda094}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{dcd20406-ab04-403e-8a08-6a9b94c429f7}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{defa2878-05d2-444f-aef2-ac5b1b0fa4da}: [NameServer] 8.8.8.8
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> {B74BA737-8C40-47FF-8801-482874673E45} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-11-07] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-10-20] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: 96sqw910.default
FF ProfilePath: C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default [2017-11-14]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\96sqw910.default -> hxxps://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
FF Session Restore: Mozilla\Firefox\Profiles\96sqw910.default -> ist aktiviert.
FF NetworkProxy: Mozilla\Firefox\Profiles\96sqw910.default -> type", 0
FF NewTabOverride: Mozilla\Firefox\Profiles\96sqw910.default -> Enabled: "id":"{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi [2017-11-08]
FF Extension: (ProxTube) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\ich@maltegoetz.de.xpi [2017-11-13]
FF Extension: (Suchen und neue Registerkarte von Yahoo) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi [2017-11-13]
FF Extension: (Safe Browsing Version 4 (temporary add-on)) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\sbv4-gradual-rollout@mozilla.com.xpi [2017-10-12]
FF Extension: (Поиск@Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi [2017-11-08]
FF Extension: (Пульт) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}.xpi [2017-11-08]
FF Extension: (Adblock Plus) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-13]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: (Citavi Picker) - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2017-03-23]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default -> Not-active:"chrome-extension://fabhkdeopjkcpkmofliimbjckmocfiom/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://inline.go.mail.ru/search?inline_comp=dse&q={searchTerms}&fr=chxtn12.0.23
CHR DefaultSearchKeyword: Default -> inline.go.mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/chrome?q={searchTerms}
CHR Session Restore: Default -> ist aktiviert.
CHR Profile: C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default [2017-11-15]
CHR Extension: (Präsentationen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-15]
CHR Extension: (Docs) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-15]
CHR Extension: (Google Drive) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-08]
CHR Extension: (YouTube) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-08]
CHR Extension: (OneTab) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2017-07-06]
CHR Extension: (Polarr Photo Editor) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\djonnbgfieijldcieafgjcnhmpcfpmgg [2017-11-14]
CHR Extension: (Yahoo Partner) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-11-08]
CHR Extension: (Tabellen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-15]
CHR Extension: (IRC QuakeNet webchat) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhaphniflbbhhfailihfckiifpbgeokd [2016-12-08]
CHR Extension: (Google Docs Offline) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-09]
CHR Extension: (AdBlock) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-11-13]
CHR Extension: (Stealthy) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2017-10-26]
CHR Extension: (Imagus) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\immpkjjlgappgfkkfieppnmlhakdmaab [2017-10-29]
CHR Extension: (The Great Suspender) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2017-07-06]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-14]
CHR Extension: (Citavi Picker) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2017-03-23]
CHR Extension: (Google Mail) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-08]
CHR Extension: (Chrome Media Router) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-28]
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8063656 2017-10-31] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-11-01] (Dropbox, Inc.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1648840 2016-08-05] (Foxit Software Inc.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273232 2016-08-24] (Lenovo)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-01-20] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-09-19] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-20] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 MpKslbd4a8324; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AD0191CA-0EF7-4176-B088-7CA6DCC27103}\MpKslbd4a8324.sys [58120 2017-11-14] (Microsoft Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvlddmkm.sys [14427064 2017-01-21] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-09-19] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48064 2017-09-19] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [57792 2017-09-19] (NVIDIA Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [422656 2016-03-09] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-15 00:47 - 2017-11-15 00:50 - 000023270 _____ C:\Users\mail\Downloads\FRST.txt
2017-11-15 00:46 - 2017-11-15 00:46 - 000000000 ____D C:\Users\mail\Downloads\FRST-OlderVersion
2017-11-14 00:19 - 2017-11-14 00:19 - 000000000 ____D C:\Program Files (x86)\ESET
2017-11-14 00:15 - 2017-11-14 00:15 - 002870984 _____ (ESET) C:\Users\mail\Downloads\esetsmartinstaller_deu.exe
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ C:\Users\mail\AppData\Local\recently-used.xbel
2017-11-10 17:57 - 2017-11-10 17:57 - 000000000 ____D C:\Program Files (x86)\ProFantasy
2017-11-10 17:48 - 2017-11-10 17:49 - 000000000 ____D C:\Program Files\ProFantasy
2017-11-10 17:15 - 2017-11-10 17:16 - 011699519 ____R (ProFantasy Software ) C:\Users\mail\Desktop\CC3Patch7.exe
2017-11-10 14:41 - 2017-11-10 15:06 - 000000000 ____D C:\AdwCleaner
2017-11-10 14:40 - 2017-11-10 14:41 - 008261584 _____ (Malwarebytes) C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
2017-11-10 14:06 - 2017-11-15 00:47 - 000000000 ____D C:\FRST
2017-11-10 14:03 - 2017-11-10 14:03 - 000091890 _____ C:\Users\mail\Desktop\MBAM1.txt
2017-11-10 14:02 - 2017-11-10 14:02 - 000002311 _____ C:\Users\mail\Desktop\MBAM2.txt
2017-11-09 14:28 - 2017-11-09 14:28 - 000000306 __RSH C:\Users\mail\ntuser.pol
2017-11-08 19:16 - 2017-11-08 19:16 - 000000608 _____ C:\Users\mail\Desktop\Neues Textdokument.txt
2017-11-08 18:07 - 2017-11-08 18:07 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\Program Files\Malwarebytes
2017-11-08 18:07 - 2017-11-01 08:54 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-11-08 18:01 - 2017-11-15 00:46 - 002392576 _____ (Farbar) C:\Users\mail\Downloads\FRST64.exe
2017-11-08 17:56 - 2017-11-08 17:56 - 078346672 _____ (Malwarebytes ) C:\Users\mail\Downloads\mb3-setup-consumer-3.3.1.2183.exe
2017-11-08 17:40 - 2017-11-08 19:28 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-11-08 17:38 - 2017-11-08 19:23 - 000508936 _____ C:\WINDOWS\ntbtlog.txt
2017-11-08 17:18 - 2017-11-08 17:18 - 000024616 _____ C:\WINDOWS\System32\Tasks\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F}
2017-11-08 17:18 - 2017-11-08 17:18 - 000003720 _____ C:\WINDOWS\System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C}
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ C:\Users\mail\AppData\Local\installer.dat
2017-11-08 17:17 - 2017-11-08 17:17 - 000003266 __RSH C:\ProgramData\ntuser.pol
2017-11-08 00:53 - 2017-11-08 00:53 - 000214380 _____ C:\Users\mail\Desktop\Wiz20.pdf
2017-11-07 16:04 - 2017-11-07 16:05 - 113493996 _____ C:\Users\mail\Downloads\CA54_JonRobertsDungeon.exe
2017-11-07 15:23 - 2017-11-07 15:23 - 000000000 ____D C:\Users\mail\Downloads\-Getintopc.com-Campaign_Cartographer_3
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\Pymapper9
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pymapper9
2017-11-07 12:06 - 2017-11-07 12:06 - 000051621 _____ C:\WINDOWS\uninstaller.dat
2017-11-06 19:59 - 2017-11-06 19:59 - 000060450 _____ C:\Users\mail\Downloads\Alternatives Giftsystem.pdf
2017-11-05 12:17 - 2017-11-05 12:17 - 000001160 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2017-11-05 12:17 - 2017-11-05 12:17 - 000000000 ____D C:\Program Files\paint.net
2017-11-05 12:15 - 2017-11-05 12:22 - 000000000 ____D C:\Users\mail\AppData\Local\paint.net
2017-11-05 12:12 - 2017-11-05 12:12 - 000000000 ____D C:\Users\mail\Downloads\paint.net.4.0.10.install
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Geeks3D
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\Program Files (x86)\Geeks3D
2017-11-03 16:53 - 2017-11-03 16:53 - 000000000 ____D C:\Users\mail\Downloads\word
2017-11-03 15:49 - 2017-11-03 15:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-11-02 00:59 - 2017-11-02 00:59 - 000507314 _____ C:\Users\mail\Downloads\Arradon - Untoter Nekromant.pdf
2017-11-02 00:59 - 2017-11-02 00:59 - 000130889 _____ C:\Users\mail\Downloads\Azmalia von Lorstein, die Blutgeweihte.pdf
2017-11-02 00:29 - 2017-11-02 00:29 - 000000000 ___HD C:\OneDriveTemp
2017-11-01 12:58 - 2017-11-01 12:58 - 000051016 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2017-11-01 12:58 - 2017-11-01 12:58 - 000045672 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2017-11-01 12:58 - 2017-11-01 12:58 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2017-11-01 12:58 - 2017-11-01 12:58 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2017-10-24 08:31 - 2017-10-24 08:31 - 000090049 _____ C:\Users\mail\Downloads\Seminarplan.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-15 00:46 - 2017-07-11 14:08 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-15 00:44 - 2016-12-08 15:27 - 000000000 __SHD C:\Users\mail\IntelGraphicsProfiles
2017-11-14 08:25 - 2017-03-18 22:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-14 08:25 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-14 02:15 - 2016-12-09 01:06 - 000000000 ____D C:\Users\mail\AppData\LocalLow\Mozilla
2017-11-14 02:03 - 2017-05-02 19:11 - 000000000 ____D C:\Users\mail\Documents\PF 3rd Party
2017-11-12 19:46 - 2016-12-24 12:51 - 000000000 ____D C:\Users\mail\AppData\Local\Spotify
2017-11-12 19:42 - 2016-12-24 12:50 - 000000000 ____D C:\Users\mail\AppData\Roaming\Spotify
2017-11-12 13:51 - 2017-01-25 15:30 - 000000000 ____D C:\Users\mail\.maptool
2017-11-12 10:42 - 2017-07-11 14:11 - 000000000 ____D C:\Users\mail
2017-11-12 10:36 - 2016-12-08 18:02 - 000000000 ____D C:\ProgramData\Foxit Software
2017-11-11 21:18 - 2017-07-11 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-11-11 13:35 - 2016-12-11 14:39 - 000000000 ____D C:\Users\mail\AppData\Local\CrashDumps
2017-11-10 23:35 - 2016-12-26 23:32 - 000000000 ____D C:\Users\mail\.gimp-2.8
2017-11-10 18:10 - 2017-05-02 19:04 - 000000000 ____D C:\Users\mail\AppData\Roaming\BitTorrent
2017-11-10 17:52 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\VirtualStore
2017-11-10 16:56 - 2017-03-18 12:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-11-10 15:45 - 2016-12-26 23:56 - 000000000 ____D C:\Users\mail\AppData\Local\gtk-2.0
2017-11-08 19:14 - 2016-12-09 01:05 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-08 19:14 - 2016-12-08 15:34 - 000002264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-08 17:46 - 2017-01-25 18:55 - 000000000 ____D C:\Users\mail\AppData\Local\ElevatedDiagnostics
2017-11-08 17:17 - 2017-03-18 22:03 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-11-08 17:17 - 2016-07-16 12:47 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-11-08 00:52 - 2017-03-23 17:58 - 000000000 ____D C:\Users\mail\Documents\Citavi 5
2017-11-07 08:53 - 2017-03-18 22:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-11-07 08:51 - 2016-12-08 19:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-11-07 08:43 - 2016-12-08 15:32 - 000000000 ___RD C:\Users\mail\OneDrive
2017-11-07 08:42 - 2017-07-31 17:24 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-815402739-1259396803-2248114470-1001
2017-11-07 08:42 - 2016-12-08 15:32 - 000002380 _____ C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-11-05 09:05 - 2016-12-08 16:18 - 000000000 ____D C:\Users\mail\AppData\Roaming\NVIDIA
2017-11-04 00:00 - 2017-07-11 14:28 - 002188846 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-11-04 00:00 - 2017-03-20 05:41 - 000987718 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-04 00:00 - 2017-03-20 05:41 - 000213750 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-03 23:53 - 2016-12-09 01:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-03 23:53 - 2016-12-09 01:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-03 15:50 - 2016-12-08 18:04 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-11-02 01:05 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\Packages
2017-10-23 16:35 - 2017-03-18 22:01 - 000000000 ____D C:\WINDOWS\INF
2017-10-23 16:35 - 2016-12-08 17:50 - 000000000 ____D C:\Users\mail\AppData\Local\NVIDIA Corporation
2017-10-18 00:03 - 2016-12-08 16:21 - 000000000 ____D C:\ProgramData\Oracle
2017-10-18 00:02 - 2017-03-18 21:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-17 23:52 - 2016-12-11 15:53 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ () C:\Users\mail\AppData\Local\installer.dat
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ () C:\Users\mail\AppData\Local\recently-used.xbel
2017-07-11 14:06 - 2017-07-11 14:06 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\7Xfck9gu6RaQ.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\a0cihmQ7qOQd.exe
2017-11-08 17:15 - 2017-11-08 17:15 - 002643640 _____ () C:\Users\mail\AppData\Local\Temp\h2wD0yUimdTL.exe
2017-11-08 17:21 - 2017-11-08 17:21 - 064938720 ____N (Kometa LCC) C:\Users\mail\AppData\Local\Temp\jFLhCEqErwDH.exe
2017-10-17 23:50 - 2017-10-17 23:50 - 001856576 _____ (Oracle Corporation) C:\Users\mail\AppData\Local\Temp\jre-8u151-windows-au.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\rsp7enBYwyNL.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000491520 _____ () C:\Users\mail\AppData\Local\Temp\UoR7BXFblh6R.exe
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\yL1LhWraFtvM.exe
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-11-12 11:12
==================== Ende von FRST.txt ============================
Und die Addition.txt Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 12-11-2017 03
durchgeführt von mail (15-11-2017 00:51:25)
Gestartet von C:\Users\mail\Downloads
Windows 10 Pro Version 1703 15063.674 (X64) (2017-07-11 13:40:42)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-815402739-1259396803-2248114470-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-815402739-1259396803-2248114470-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-815402739-1259396803-2248114470-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-815402739-1259396803-2248114470-501 - Limited - Disabled)
mail (S-1-5-21-815402739-1259396803-2248114470-1001 - Administrator - Enabled) => C:\Users\mail
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 378.49 - NVIDIA Corporation) Hidden
AutoREALM Version 2.2.1 (HKLM-x32\...\AutoREALM_is1) (Version: - )
BitTorrent (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\BitTorrent) (Version: 7.10.0.43917 - BitTorrent Inc.)
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.5.0.1 - Swiss Academic Software)
CollageIt 1.9.5 (HKLM-x32\...\{D9757258-30B2-496E-86F2-84920C5858E1}_is1) (Version: 1.9.5 - PearlMountain)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.16.50 - Conexant)
Dark Age of Camelot (HKLM-x32\...\Dark Age of Camelot) (Version: - Electronic Arts)
Discord (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Discord) (Version: 0.0.298 - Discord Inc.)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.2.1 - CEWE Stiftung u Co. KGaA)
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.5.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 38.4.27 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
ELAN Touchpad 11.15.0.18_X64 (HKLM\...\Elantech) (Version: 11.15.0.18 - ELAN Microelectronic Corp.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FastCAD (HKLM-x32\...\FastCAD) (Version: - )
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 8.0.6.909 - Foxit Software Inc.)
Geeks3D FurMark 1.19.1.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version: - Geeks3D)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
IrfanView 4.44 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.44 - Irfan Skiljan)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.15.0414.1 - Vimicro)
Lenovo Service Bridge (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\dda9ca0b023f4c56) (Version: 1.6.4.0 - Lenovo)
Lenovo Solution Center (HKLM\...\{558E50EE-5E2D-479A-A455-8A826191583B}) (Version: 3.3.004.00 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.9 - Thibaut Lauziere)
Malwarebytes Version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.8625.2121 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\OneDriveSetup.exe) (Version: 17.3.7076.1026 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 56.0.2 (x64 de) (HKLM\...\Mozilla Firefox 56.0.2 (x64 de)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 56.0.2.6506 - Mozilla)
Mozilla Thunderbird 52.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.4.0 (x86 de)) (Version: 52.4.0 - Mozilla)
NVIDIA GeForce Experience 3.9.0.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.49 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
PDF Image Extraction Wizard 1.2 (HKLM-x32\...\PDF Image Extraction Wizard 1.2_is1) (Version: - RL Vision)
PDFMate PDF Converter 1.7.5 (HKLM-x32\...\PDFMate PDF Converter_is1) (Version: - pdfmate.com)
Pymapper9 version 9.5 (HKLM-x32\...\{FB6CD2CE-26BF-4F55-A5AD-AC55628AC2DA}_is1) (Version: 9.5 - Toxic Rat Industries)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31222 - Realtek Semiconduct Corp.)
Spotify (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Uthgard Launcher (HKLM-x32\...\Uthgard Launcher) (Version: 1.00.00.00 - Uthgard)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Vulkan Run Time Libraries 1.0.37.0 (HKLM\...\VulkanRT1.0.37.0) (Version: 1.0.37.0 - LunarG, Inc.)
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
XnView 2.41 (HKLM-x32\...\XnView_is1) (Version: 2.41 - Gougelet Pierre-e)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-815402739-1259396803-2248114470-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-08-12] (Foxit Software Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-03] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-01-20] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0C4E832E-F04A-4AEF-B8B2-909B4313E7B8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {167F2551-D0CC-4A6E-87A8-1EE9AAEA0106} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-09-19] (NVIDIA Corporation)
Task: {204C6882-DF25-4A55-8BEE-CAD856479F34} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {30A04931-E773-431F-AF21-55236CBE481B} - System32\Tasks\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F} => C:\WINDOWS\system32\WindowsPowershell\v1.0\powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand IAA7ADsAIAAgACAAOwA7ACAAIAA7ACAAOwAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAPQAiAHMAdABvAHAAIgA7ACQAcwBjAD0AIgBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACIAOwAkAFcAYQByAG4AaQBuAGcAUAByAGUAZgBlAHIA (Der Dateneintrag hat 10072 mehr Zeichen). <==== ACHTUNG
Task: {41FEEF5F-8762-4122-8682-BD10F2C6263D} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {484861FC-9E47-4FFB-B124-AEDDAF9C6C4E} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {4C555743-0F99-4037-B1FE-7CB0765FFE06} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {53E44DE0-EF6E-48EA-83B6-6F43387EBA89} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {5CD983AE-61D1-4F50-85D3-AF7C935DB805} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-09-19] (NVIDIA Corporation)
Task: {6FD57D65-66F5-455A-9D97-DFAA9F693FE8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7159EC6E-08A8-4DA7-BF4F-21B82E68180D} - System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => C:\PROGRA~2\FASTDA~1\FASTDA~1.EXE
Task: {74C25C0E-57E0-4CD9-B312-D7DD4D7D8E4A} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-11-07] (Microsoft Corporation)
Task: {75FE8B99-B0F4-4159-8407-7F76F57D9FCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7E239916-4AD3-4D4D-A09F-A64D620E13C5} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {8C767394-63ED-4D42-A3AA-9CB6B8B78406} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2016-08-24] (Lenovo)
Task: {96B097DB-6A97-4859-91B9-527F63509A0F} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-08-24] (Lenovo)
Task: {9ECBF216-67A3-46B8-B020-C1C06F4C4397} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-815402739-1259396803-2248114470-1001 => "C:\WINDOWS\system32\rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms
Task: {A2B16A6F-6BA9-4217-991D-E6F393680F2B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {B7666FC2-381A-4A6F-9C41-548F1EF694B2} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {BE2E3880-F457-4548-BFD6-8F1C6076AE05} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {C6956744-A8AE-44E1-A213-008E4823F0D6} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [2016-08-24] ()
Task: {D45BA73C-D40C-4BCC-B4A1-0A1421D5032F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {EAD48978-505B-41BE-A0E0-1591E00491C6} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-09-19] (NVIDIA Corporation)
Task: {EE5FB4A5-3756-47BC-AE3A-61F09F0D89AE} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {F759F44B-5A43-4B69-B549-341BC0CE44F7} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-09-19] (NVIDIA Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-12-08 17:46 - 2017-09-19 08:23 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-07-11 14:09 - 2017-01-20 16:13 - 000134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-03-18 21:58 - 2017-03-18 21:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 21:59 - 2017-03-20 05:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-11-10 14:05 - 2017-11-10 14:06 - 000061952 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2017-09-15 00:24 - 2017-09-05 06:19 - 004125088 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll
2017-03-18 21:59 - 2017-03-20 05:43 - 002487712 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll
2017-11-12 10:41 - 2017-11-12 10:56 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-11-12 10:41 - 2017-11-12 10:56 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-11-12 10:41 - 2017-11-12 10:58 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-11-07 14:25 - 2017-11-07 14:26 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\skypert.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2017-11-15 00:45 - 2017-11-15 00:46 - 011817272 _____ () C:\Users\mail\AppData\Local\NVIDIA\NvBackend\Packages\0000adb3\DAO.23132999.exe
2017-11-03 15:48 - 2017-11-01 12:58 - 000724288 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll
2017-11-03 15:48 - 2017-11-01 12:58 - 002002752 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll
2017-11-03 15:48 - 2017-11-01 12:57 - 000100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000020800 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000130512 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001856848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2017-11-03 15:48 - 2017-11-01 12:57 - 000105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000062784 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000040248 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000392656 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000392512 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000026056 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021824 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022856 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000066392 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001796920 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000084424 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 001956152 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 003859264 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000154440 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000521024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000050496 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000042304 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000131384 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000218944 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000204096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000054608 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000100688 _____ () C:\Program Files (x86)\Dropbox\Client\windisplaytoast.compiled._DisplayToast.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000027488 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2017-11-03 15:48 - 2017-11-01 12:57 - 000349128 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000101184 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWinExtras.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000023896 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000025424 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000032600 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd
2017-11-03 15:48 - 2017-11-01 12:58 - 000293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000181056 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2017-11-03 15:48 - 2017-11-01 13:01 - 000030536 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000024368 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL
2017-11-03 15:48 - 2017-11-01 13:01 - 001638200 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2017-11-03 15:48 - 2017-11-01 13:01 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000545080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000359224 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2017-11-03 15:48 - 2017-11-01 13:01 - 000038208 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngine.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\3590F75ABA9E485486C100C1A9D4FF06ZZZ..ZZ.Z..Z...Z:1 [898]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\sharepoint.com -> hxxps://goetheuniversitaet-files.sharepoint.com
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 12:47 - 2017-11-08 17:17 - 000001832 _____ C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 wemsofts.com
127.0.0.1 bongadoom.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 internalcampaigntargets.com
127.0.0.1 bongadoom.com
127.0.0.1 getthefilenow.com
127.0.0.1 bigpicturepop.com
127.0.0.1 wizzcaster.com
127.0.0.1 bestoffersfortoday.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 agent.wizztrakys.com
127.0.0.1 csdimonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 titiaredh.com
127.0.0.1 wepcdisplaysystem.com
127.0.0.1 wepcanalyticsystem.com
127.0.0.1 healthydownload.com
127.0.0.1 leading2download.com
127.0.0.1 dwl0.wizzlabs.com
127.0.0.1 dwl1.wizzlabs.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 dl.smashdl.com
127.0.0.1 downloadmyhost.com
127.0.0.1 lapapahoster.com
127.0.0.1 bratitlamio.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.wizzuniquify.com
127.0.0.1 wizzmonetize.com
127.0.0.1 laserveradedomaina.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mail\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\foto 28.03.16, 03 14 53.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "Discord"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{3264E36F-6CAD-4B11-A1F8-2893FE78CEEB}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{D22A9FB5-F808-42DC-9F87-61A9BBE26BC2}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2E473171-008A-4966-BABB-DCE0C6179FC9}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E9274098-C9DA-40DD-899F-641A24346199}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{895D205B-FEDD-40F7-A600-080C0D8E6B85}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2468923A-D59A-4E55-9DE5-73A657225418}] => (Allow) C:\Users\mail\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [UDP Query User{57E89783-32EB-4A2C-9696-CD35FD2B58EC}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [TCP Query User{D8008437-509B-4D4E-B038-6A54E0D4A6FE}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [UDP Query User{E1F79280-719A-46F8-885D-FCC0C1C48F69}C:\program files (x86)\java\jre1.8.0_111\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\java.exe
FirewallRules: [TCP Query User{97AA1379-DF3A-418B-851C-A4D3C50699F9}C:\program files (x86)\java\jre1.8.0_111\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\java.exe
FirewallRules: [UDP Query User{88429F3F-215F-47A2-BC21-43654ECDBA62}C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe
FirewallRules: [TCP Query User{55B4245A-651A-4F69-8024-8139E9ABE510}C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\javaw.exe
FirewallRules: [{F3A0410E-D389-4C9E-8958-016955C67952}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{8F956C12-421A-476D-8BFB-EE5AF7646D97}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [UDP Query User{CE2B7748-5164-4669-804B-A0F7C18ADBC8}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{8A1F13D8-EE89-426A-924B-80663F58D722}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
FirewallRules: [{208BEC37-BE91-4A52-AD79-3E31C610C2F5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FEB4439F-9E3D-4BEC-A1F8-D7E0C0110D32}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3097BE7C-4898-4CD2-8CF5-E11F0C646C42}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{7A361860-11D4-4D5A-A72C-68BF62AD141C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{637CC52B-1B22-45F0-A2E7-876AC357A025}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4D269292-7786-47CC-866C-79CA978C2FCC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B3D92AB8-4B40-4273-AD07-BADFA50FEAC6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{34A9437D-1B8E-4492-96AE-63F443FFB338}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{BF1443E1-45FB-4752-89A4-83DF4413EE33}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [TCP Query User{8832E6A5-75F0-4395-A870-6D4F48C15467}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [UDP Query User{FD6CBCA4-2B1E-42A3-B308-C7BC2954CDC0}C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [{E103BBA1-D072-41F2-92EB-D5147BB87668}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{F3DDEE16-0CBC-49E9-9D14-DD5D189F6D7B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{FA424D00-0FB7-4D93-9DD9-4AA1A8B2778C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{49A32A26-78E6-4411-8B65-71D746D787F4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{9F687A38-F8D2-4027-9F04-FFBB7210CA33}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{A110D626-2439-4AB6-BA3C-4A849051C53A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{523D7D06-516C-43A1-AA4A-033776286170}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{1832303E-FE07-45B0-A149-40F05DA7BAFC}C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe
FirewallRules: [UDP Query User{A3F26144-D6B1-4C0C-B4A2-BC820789C000}C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\javaw.exe
FirewallRules: [{ECDD42D5-D680-490C-B2E4-CF0EE1CA3745}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{B77E98B8-7242-4510-A5C4-B41102B2C825}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [TCP Query User{6C61D566-EFFC-4FBF-82B3-A5EFB8FD4170}C:\program files (x86)\java\jre1.8.0_151\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\java.exe
FirewallRules: [UDP Query User{11CABD10-F9AA-40F5-9FA1-3810764EAF20}C:\program files (x86)\java\jre1.8.0_151\bin\java.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_151\bin\java.exe
FirewallRules: [TCP Query User{7F34FD3D-B9D8-4B7E-9DDC-5AD363F7794E}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{04FA0F38-75E3-470A-938B-4B09CE73D7A7}C:\users\mail\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\mail\appdata\roaming\spotify\spotify.exe
==================== Wiederherstellungspunkte =========================
31-10-2017 17:46:48 Geplanter Prüfpunkt
10-11-2017 15:48:44 Geplanter Prüfpunkt
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/15/2017 12:46:06 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\mail\Downloads\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 08:16:29 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 08:16:16 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 08:15:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft office\root\office16\odbc drivers\salesforce\lib\libcurl32.dlla\libcurl.dll".
Die abhängige Assemblierung "OpenSSL.DllA,processorArchitecture="*",type="win32",version="1.0.0.4"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/14/2017 08:14:15 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (11/14/2017 08:14:10 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "c:\program files (x86)\eset\eset online scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 04:11:14 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 04:09:56 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft office\root\office16\odbc drivers\salesforce\lib\libcurl32.dlla\libcurl.dll".
Die abhängige Assemblierung "OpenSSL.DllA,processorArchitecture="*",type="win32",version="1.0.0.4"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/14/2017 04:02:51 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (11/14/2017 12:22:16 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Systemfehler:
=============
Error: (11/15/2017 12:44:16 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/15/2017 12:44:16 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/14/2017 12:22:36 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\mail\AppData\Local\Temp\ehdrv.sys
Error: (11/14/2017 12:22:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (11/14/2017 12:22:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (11/14/2017 12:22:36 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\mail\AppData\Local\Temp\ehdrv.sys
Error: (11/14/2017 12:22:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (11/14/2017 12:22:36 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\mail\AppData\Local\Temp\ehdrv.sys
Error: (11/14/2017 12:20:15 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\mail\AppData\Local\Temp\ehdrv.sys
Error: (11/14/2017 12:20:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
CodeIntegrity:
===================================
Date: 2017-11-12 11:12:22.578
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-10 15:16:02.483
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-07 15:42:06.651
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-05 01:49:05.270
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-17 01:58:20.458
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-12 16:36:38.103
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-21 23:31:01.932
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-15 21:20:30.027
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-08-09 16:49:22.963
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-21 17:49:22.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 50%
Installierter physikalischer RAM: 6046.35 MB
Verfügbarer physikalischer RAM: 3010.13 MB
Summe virtueller Speicher: 7156.92 MB
Verfügbarer virtueller Speicher: 3910.79 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:464.65 GB) (Free:344.94 GB) NTFS
Drive d: (o2 CD) (CDROM) (Total:0.36 GB) (Free:0 GB) CDFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1A9999E4)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=464.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=782 MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
15.11.2017, 20:57
| #8 |
| /// TB-Ausbilder | Windows 10: Virus installiert (russische) Software Servus, Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop (Bebilderte Anleitung).
Schritt 2
Schritt 3
Bitte poste mit deiner nächsten Antwort
|
|
16.11.2017, 15:29
| #9 |
| | Windows 10: Virus installiert (russische) Software Stand jetzt (nach Durchführung Deiner Anweisungen) öffnet Chrome noch immer Seiten, die auf AdWare schließen lassen. Es macht den Anschein, als würde jeder Hyperlink im Browser mit einer bestimmten Wahrscheinlichkeit eine Werbeseite öffnen. Die Google-Startseite und jeder andere Werbeframe zeigt stets Anzeigen für Erotik-Websites, die meinem Mitbewohner zufolge vorher nicht angezeigt wurden:  Zusätzlich erscheint ab und an die Fehlermeldung: "Lenovo Service Bridge Error starting local HTTP server for Lenovo Service Bridge. Please check if one of the following ports is available: 50123; 50124" Und hier natürlich auch noch die Logs: Code:
ATTFilter # AdwCleaner 7.0.4.0 - Logfile created on Thu Nov 16 13:52:57 2017
# Updated on 2017/27/10 by Malwarebytes
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support
***** [ Services ] *****
No malicious services deleted.
***** [ Folders ] *****
No malicious folders deleted.
***** [ Files ] *****
No malicious files deleted.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks deleted.
***** [ Registry ] *****
No malicious registry entries deleted.
***** [ Firefox (and derivatives) ] *****
Plugin deleted: Домашняя страница Mail.Ru -
Plugin deleted: Поиск@Mail.Ru - mail.ru
Plugin deleted: __MSG_newtab_chrome_extension_name__ -
Plugin deleted: __MSG_extName__ -
Startpage deleted: https://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries deleted.
*************************
::Tracing keys deleted
::Winsock settings cleared
::Prefetch files deleted
::Proxy settings cleared
::Firewall rules cleared
::IE policies deleted
::Chrome policies deleted
::Additional Actions: 0
*************************
C:/AdwCleaner/AdwCleaner[C0].txt - [4754 B] - [2017/11/10 13:45:18]
C:/AdwCleaner/AdwCleaner[C1].txt - [1634 B] - [2017/11/10 14:6:43]
C:/AdwCleaner/AdwCleaner[S0].txt - [5354 B] - [2017/11/10 13:43:38]
C:/AdwCleaner/AdwCleaner[S1].txt - [1580 B] - [2017/11/10 14:6:30]
C:/AdwCleaner/AdwCleaner[S2].txt - [1579 B] - [2017/11/16 13:51:39]
########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt ##########
Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Protokolldetails-
Scan-Datum: 16.11.17
Scan-Zeit: 15:02
Protokolldatei: d7df7782-cad6-11e7-b1ba-dc0ea1fe1870.json
Administrator: Ja
-Softwaredaten-
Version: 3.3.1.2183
Komponentenversion: 1.0.236
Version des Aktualisierungspakets: 1.0.3271
Lizenz: Testversion
-Systemdaten-
Betriebssystem: Windows 10 (Build 15063.726)
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-39IFTOA\mail
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 412820
Erkannte Bedrohungen: 14
In die Quarantäne verschobene Bedrohungen: 14
Abgelaufene Zeit: 8 Min., 54 Sek.
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
Modul: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 5
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\TASKENG.EXE, In Quarantäne, [5411], [425125],1.0.3271
PUP.Optional.PSScriptLoad.ACMB3, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F}, In Quarantäne, [5411], [-1],0.0.0
PUP.Optional.PSScriptLoad.ACMB3, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{30A04931-E773-431F-AF21-55236CBE481B}, In Quarantäne, [5411], [-1],0.0.0
PUP.Optional.PSScriptLoad.ACMB3, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{30A04931-E773-431F-AF21-55236CBE481B}, In Quarantäne, [5411], [-1],0.0.0
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE, In Quarantäne, [5411], [425124],1.0.3271
Registrierungswert: 3
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\TASKENG.EXE|WINDOWPOSITION, In Quarantäne, [5411], [425125],1.0.3271
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE|WINDOWPOSITION, In Quarantäne, [5411], [425124],1.0.3271
PUP.Optional.PSScriptLoad.ACMB3, HKU\S-1-5-21-815402739-1259396803-2248114470-1001\CONSOLE\%SYSTEMROOT%_SYSTEM32_WINDOWSPOWERSHELL_V1.0_POWERSHELL.EXE|WINDOWPOSITION, In Quarantäne, [5411], [425126],1.0.3271
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
Ordner: 0
(keine bösartigen Elemente erkannt)
Datei: 6
PUP.Optional.PSScriptLoad.ACMB3, C:\WINDOWS\SYSTEM32\TASKS\{0A0A0C47-0F78-090C-0F11-0E7D0E7A117F}, In Quarantäne, [5411], [-1],0.0.0
PUP.Optional.MailRu, C:\USERS\MAIL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\96SQW910.DEFAULT\EXTENSIONS\{A38384B3-2D1D-4F36-BC22-0F7AE402BCD7}.XPI, In Quarantäne, [680], [458842],1.0.3271
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16387], [454819],1.0.3271
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16387], [454819],1.0.3271
PUP.Optional.SearchModule, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [675], [458372],1.0.3271
PUP.Optional.Searching.ShrtCln, C:\USERS\MAIL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Ersetzt, [16387], [454819],1.0.3271
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
(end)
FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-11-2017
durchgeführt von mail (Administrator) auf DESKTOP-39IFTOA (16-11-2017 15:19:08)
Gestartet von C:\Users\mail\Downloads
Geladene Profile: mail (Verfügbare Profile: defaultuser0 & mail)
Platform: Windows 10 Pro Version 1703 15063.726 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Spotify Ltd) C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-11-13] (Dropbox, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Run: [Spotify Web Helper] => C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-27] (Spotify Ltd)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\MountPoints2: {e2da70c1-bd99-11e6-a447-806e6f6e6963} - "D:\o2Start.exe"
Startup: C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2017-11-13]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 141.2.22.74 141.2.149.10
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [DhcpNameServer] 141.2.22.74 141.2.149.10
Tcpip\..\Interfaces\{31f33a9e-6641-11e7-a1db-806e6f6e6963}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{99bca9e2-2395-4ec2-b319-d8253fcec71b}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [DhcpNameServer] 10.216.1.1
Tcpip\..\Interfaces\{d0c1fc48-c0e2-4c01-88e8-8e9d67fda094}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{dcd20406-ab04-403e-8a08-6a9b94c429f7}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{defa2878-05d2-444f-aef2-ac5b1b0fa4da}: [NameServer] 8.8.8.8
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> {B74BA737-8C40-47FF-8801-482874673E45} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-11-07] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-10-20] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: 96sqw910.default
FF ProfilePath: C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default [2017-11-16]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\96sqw910.default -> hxxps://encrypted.google.com
FF Session Restore: Mozilla\Firefox\Profiles\96sqw910.default -> ist aktiviert.
FF NetworkProxy: Mozilla\Firefox\Profiles\96sqw910.default -> type", 0
FF NewTabOverride: Mozilla\Firefox\Profiles\96sqw910.default -> Enabled: "id":"{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi [2017-11-08]
FF Extension: (ProxTube) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\ich@maltegoetz.de.xpi [2017-11-13]
FF Extension: (Suchen und neue Registerkarte von Yahoo) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi [2017-11-13]
FF Extension: (Safe Browsing Version 4 (temporary add-on)) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\sbv4-gradual-rollout@mozilla.com.xpi [2017-10-12] [Legacy]
FF Extension: (Поиск@Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi [2017-11-08] [Legacy]
FF Extension: (Adblock Plus) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-13]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: (Citavi Picker) - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2017-03-23] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default -> Not-active:"chrome-extension://fabhkdeopjkcpkmofliimbjckmocfiom/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://inline.go.mail.ru/search?inline_comp=dse&q={searchTerms}&fr=chxtn12.0.23
CHR DefaultSearchKeyword: Default -> inline.go.mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/chrome?q={searchTerms}
CHR Session Restore: Default -> ist aktiviert.
CHR Profile: C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default [2017-11-16]
CHR Extension: (Präsentationen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-15]
CHR Extension: (Docs) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-15]
CHR Extension: (Google Drive) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-08]
CHR Extension: (YouTube) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-08]
CHR Extension: (OneTab) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2017-07-06]
CHR Extension: (Polarr Photo Editor) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\djonnbgfieijldcieafgjcnhmpcfpmgg [2017-11-16]
CHR Extension: (Yahoo Partner) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-11-08]
CHR Extension: (Tabellen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-15]
CHR Extension: (IRC QuakeNet webchat) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhaphniflbbhhfailihfckiifpbgeokd [2016-12-08]
CHR Extension: (Google Docs Offline) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-09]
CHR Extension: (AdBlock) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-11-13]
CHR Extension: (Stealthy) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2017-10-26]
CHR Extension: (Imagus) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\immpkjjlgappgfkkfieppnmlhakdmaab [2017-10-29]
CHR Extension: (The Great Suspender) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2017-07-06]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-14]
CHR Extension: (Citavi Picker) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2017-03-23]
CHR Extension: (Google Mail) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-08]
CHR Extension: (Chrome Media Router) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-28]
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8063656 2017-10-31] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-11-13] (Dropbox, Inc.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1648840 2016-08-05] (Foxit Software Inc.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273232 2016-08-24] (Lenovo)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-01-20] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-09-19] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-20] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193464 2017-11-16] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2017-11-16] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2017-11-16] (Malwarebytes)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvlddmkm.sys [14427064 2017-01-21] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-09-19] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48064 2017-09-19] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [57792 2017-09-19] (NVIDIA Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [422656 2016-03-09] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-16 15:19 - 2017-11-16 15:20 - 000023125 _____ C:\Users\mail\Downloads\FRST.txt
2017-11-16 15:12 - 2017-11-16 15:12 - 000003591 _____ C:\Users\mail\Desktop\mbam.txt
2017-11-16 15:02 - 2017-11-16 15:02 - 000001794 _____ C:\Users\mail\Desktop\AdwCleaner[C2].txt
2017-11-16 14:51 - 2017-11-16 14:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-11-16 14:38 - 2017-11-16 15:14 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2017-11-16 14:38 - 2017-11-16 15:14 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-11-16 14:38 - 2017-11-16 14:38 - 000193464 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2017-11-15 01:45 - 2017-11-02 06:16 - 002398696 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-11-15 01:45 - 2017-11-02 06:15 - 001239448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2017-11-15 01:45 - 2017-11-02 06:13 - 000546712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-15 01:45 - 2017-11-02 06:13 - 000095640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-11-15 01:45 - 2017-11-02 06:10 - 006557520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-15 01:45 - 2017-11-02 06:04 - 001292360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-15 01:45 - 2017-11-02 06:03 - 000223640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2017-11-15 01:45 - 2017-11-02 05:49 - 001838848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000703056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000613136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000362144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000283544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2017-11-15 01:45 - 2017-11-02 05:45 - 000172952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2017-11-15 01:45 - 2017-11-02 05:45 - 000133896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2017-11-15 01:45 - 2017-11-02 05:44 - 023680000 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-15 01:45 - 2017-11-02 05:44 - 005808640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-15 01:45 - 2017-11-02 05:44 - 000519680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-11-15 01:45 - 2017-11-02 05:43 - 020372896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-11-15 01:45 - 2017-11-02 05:36 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2017-11-15 01:45 - 2017-11-02 05:35 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\VPNv2CSP.dll
2017-11-15 01:45 - 2017-11-02 05:35 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-11-15 01:45 - 2017-11-02 05:34 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-11-15 01:45 - 2017-11-02 05:34 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-11-15 01:45 - 2017-11-02 05:34 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-15 01:45 - 2017-11-02 05:34 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2017-11-15 01:45 - 2017-11-02 05:32 - 008213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-11-15 01:45 - 2017-11-02 05:31 - 020512256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 013381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 002953216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-15 01:45 - 2017-11-02 05:30 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000388096 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-11-15 01:45 - 2017-11-02 05:30 - 000165888 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2017-11-15 01:45 - 2017-11-02 05:29 - 019338240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-15 01:45 - 2017-11-02 05:28 - 023684096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-15 01:45 - 2017-11-02 05:28 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 002078720 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-11-15 01:45 - 2017-11-02 05:27 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 000049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertPKICmdlet.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 008197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 005963776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 002671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 001937408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OnDemandConnRouteHelper.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 012227072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 011888128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 004727808 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 003377664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 007598080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000444928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.Launcher.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 002516480 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000680960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 006254080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 002009600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-11-15 01:45 - 2017-11-02 05:22 - 001884160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 001494528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 004417024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 003653120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-15 01:45 - 2017-10-25 08:40 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-15 01:45 - 2017-10-15 16:09 - 002259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-11-15 01:45 - 2017-10-15 16:03 - 006765728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-11-15 01:45 - 2017-10-15 16:01 - 000583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-11-15 01:45 - 2017-10-15 15:53 - 000387928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-11-15 01:45 - 2017-10-15 15:49 - 000094616 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-11-15 01:45 - 2017-10-15 15:49 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-11-15 01:45 - 2017-10-15 15:45 - 001292288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-11-15 01:45 - 2017-10-15 15:45 - 001248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-11-15 01:45 - 2017-10-15 15:44 - 000636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-11-15 01:45 - 2017-10-15 15:44 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2017-11-15 01:45 - 2017-10-15 15:42 - 005225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-11-15 01:45 - 2017-10-15 15:42 - 003667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-11-15 01:45 - 2017-10-15 15:41 - 004559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-11-15 01:45 - 2017-10-15 15:41 - 001019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-11-15 01:45 - 2017-10-15 15:38 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-11-15 01:45 - 2017-10-15 15:14 - 000037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SEMgrPS.dll
2017-11-15 01:45 - 2017-10-15 15:10 - 001303040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 001578904 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000678808 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000612248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000379288 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000190360 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000136088 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 002032536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 001144728 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 001015704 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000965016 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2017-11-15 01:44 - 2017-11-02 06:20 - 000821656 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000613784 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000543640 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000484248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000469568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000259992 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000034712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2017-11-15 01:44 - 2017-11-02 06:16 - 008319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-15 01:44 - 2017-11-02 06:16 - 002327448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-15 01:44 - 2017-11-02 06:15 - 000503704 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2017-11-15 01:44 - 2017-11-02 06:14 - 000667040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-15 01:44 - 2017-11-02 06:14 - 000067992 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 005477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 002443672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-15 01:44 - 2017-11-02 06:13 - 001345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 000212888 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000727336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000714648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000654976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000643192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000430848 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000412752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2017-11-15 01:44 - 2017-11-02 06:12 - 000144248 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2017-11-15 01:44 - 2017-11-02 06:12 - 000038808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000026472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2017-11-15 01:44 - 2017-11-02 06:11 - 021353200 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-11-15 01:44 - 2017-11-02 06:05 - 000871408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2017-11-15 01:44 - 2017-11-02 06:05 - 000187800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2017-11-15 01:44 - 2017-11-02 05:37 - 003668992 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-15 01:44 - 2017-11-02 05:37 - 001278976 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2017-11-15 01:44 - 2017-11-02 05:37 - 000465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2017-11-15 01:44 - 2017-11-02 05:37 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2017-11-15 01:44 - 2017-11-02 05:37 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2017-11-15 01:44 - 2017-11-02 05:36 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2017-11-15 01:44 - 2017-11-02 05:35 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2017-11-15 01:44 - 2017-11-02 05:35 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2017-11-15 01:44 - 2017-11-02 05:35 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 012803072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000438784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageLiveTileTask.exe
2017-11-15 01:44 - 2017-11-02 05:34 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageHandlers.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertPKICmdlet.dll
2017-11-15 01:44 - 2017-11-02 05:32 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2017-11-15 01:44 - 2017-11-02 05:32 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Storage.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 007339008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000635392 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000601088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Launcher.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SIHClient.exe
2017-11-15 01:44 - 2017-11-02 05:29 - 000757248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-11-15 01:44 - 2017-11-02 05:29 - 000415232 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 001468416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000939008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000799744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000565248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsreg.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000537600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 004445696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 003060224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 002809344 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 000986624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 002052608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-15 01:44 - 2017-11-02 05:25 - 001886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 001713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000877568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-11-15 01:44 - 2017-11-02 05:24 - 004707840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2017-11-15 01:44 - 2017-11-02 05:23 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-15 01:44 - 2017-11-02 05:23 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-15 01:44 - 2017-11-02 05:19 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-15 01:44 - 2017-10-15 15:59 - 000923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-11-15 01:44 - 2017-10-15 15:57 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-11-15 01:44 - 2017-10-15 15:57 - 000409496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-11-15 01:44 - 2017-10-15 15:56 - 000872464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2017-11-15 01:44 - 2017-10-15 15:55 - 007910960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-11-15 01:44 - 2017-10-15 15:53 - 002969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-11-15 01:44 - 2017-10-15 15:51 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2017-11-15 01:44 - 2017-10-15 15:15 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2017-11-15 01:44 - 2017-10-15 15:13 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-11-15 01:44 - 2017-10-15 15:09 - 001878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-11-15 01:44 - 2017-10-15 15:09 - 000527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-11-15 01:44 - 2017-10-15 15:08 - 001260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-11-15 01:44 - 2017-10-15 15:08 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2017-11-15 01:44 - 2017-10-15 15:07 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-11-15 01:44 - 2017-10-15 15:05 - 004396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-11-15 01:44 - 2017-10-15 15:05 - 001293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-11-15 01:44 - 2017-10-15 15:04 - 005557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-11-15 01:44 - 2017-10-15 15:02 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-11-15 01:44 - 2017-10-15 15:00 - 000061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\vss_ps.dll
2017-11-15 00:46 - 2017-11-16 15:18 - 000000000 ____D C:\Users\mail\Downloads\FRST-OlderVersion
2017-11-14 00:19 - 2017-11-14 00:19 - 000000000 ____D C:\Program Files (x86)\ESET
2017-11-14 00:15 - 2017-11-14 00:15 - 002870984 _____ (ESET) C:\Users\mail\Downloads\esetsmartinstaller_deu.exe
2017-11-13 11:26 - 2017-11-13 11:26 - 000051016 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2017-11-13 11:26 - 2017-11-13 11:26 - 000045672 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2017-11-13 11:26 - 2017-11-13 11:26 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2017-11-13 11:26 - 2017-11-13 11:26 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ C:\Users\mail\AppData\Local\recently-used.xbel
2017-11-10 17:57 - 2017-11-10 17:57 - 000000000 ____D C:\Program Files (x86)\ProFantasy
2017-11-10 17:48 - 2017-11-10 17:49 - 000000000 ____D C:\Program Files\ProFantasy
2017-11-10 17:15 - 2017-11-10 17:16 - 011699519 ____R (ProFantasy Software ) C:\Users\mail\Desktop\CC3Patch7.exe
2017-11-10 14:41 - 2017-11-16 14:52 - 000000000 ____D C:\AdwCleaner
2017-11-10 14:40 - 2017-11-10 14:41 - 008261584 _____ (Malwarebytes) C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
2017-11-10 14:06 - 2017-11-16 15:19 - 000000000 ____D C:\FRST
2017-11-09 14:28 - 2017-11-16 14:52 - 000000008 __RSH C:\Users\mail\ntuser.pol
2017-11-08 18:07 - 2017-11-08 18:07 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\Program Files\Malwarebytes
2017-11-08 18:07 - 2017-11-01 08:54 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-11-08 18:01 - 2017-11-16 15:18 - 002392576 _____ (Farbar) C:\Users\mail\Downloads\FRST64.exe
2017-11-08 17:56 - 2017-11-08 17:56 - 078346672 _____ (Malwarebytes ) C:\Users\mail\Downloads\mb3-setup-consumer-3.3.1.2183.exe
2017-11-08 17:40 - 2017-11-08 19:28 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-11-08 17:38 - 2017-11-08 19:23 - 000508936 _____ C:\WINDOWS\ntbtlog.txt
2017-11-08 17:18 - 2017-11-08 17:18 - 000003720 _____ C:\WINDOWS\System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C}
2017-11-08 17:17 - 2017-11-16 14:52 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ C:\Users\mail\AppData\Local\installer.dat
2017-11-08 00:53 - 2017-11-08 00:53 - 000214380 _____ C:\Users\mail\Desktop\Wiz20.pdf
2017-11-07 16:04 - 2017-11-07 16:05 - 113493996 _____ C:\Users\mail\Downloads\CA54_JonRobertsDungeon.exe
2017-11-07 15:23 - 2017-11-07 15:23 - 000000000 ____D C:\Users\mail\Downloads\-Getintopc.com-Campaign_Cartographer_3
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\Pymapper9
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pymapper9
2017-11-07 12:06 - 2017-11-07 12:06 - 000051621 _____ C:\WINDOWS\uninstaller.dat
2017-11-06 19:59 - 2017-11-06 19:59 - 000060450 _____ C:\Users\mail\Downloads\Alternatives Giftsystem.pdf
2017-11-05 12:17 - 2017-11-05 12:17 - 000001160 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2017-11-05 12:17 - 2017-11-05 12:17 - 000000000 ____D C:\Program Files\paint.net
2017-11-05 12:15 - 2017-11-05 12:22 - 000000000 ____D C:\Users\mail\AppData\Local\paint.net
2017-11-05 12:12 - 2017-11-05 12:12 - 000000000 ____D C:\Users\mail\Downloads\paint.net.4.0.10.install
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Geeks3D
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\Program Files (x86)\Geeks3D
2017-11-03 16:53 - 2017-11-03 16:53 - 000000000 ____D C:\Users\mail\Downloads\word
2017-11-02 00:59 - 2017-11-02 00:59 - 000507314 _____ C:\Users\mail\Downloads\Arradon - Untoter Nekromant.pdf
2017-11-02 00:59 - 2017-11-02 00:59 - 000130889 _____ C:\Users\mail\Downloads\Azmalia von Lorstein, die Blutgeweihte.pdf
2017-11-02 00:29 - 2017-11-02 00:29 - 000000000 ___HD C:\OneDriveTemp
2017-10-24 08:31 - 2017-10-24 08:31 - 000090049 _____ C:\Users\mail\Downloads\Seminarplan.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-16 15:20 - 2017-07-11 14:28 - 002282236 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-11-16 15:20 - 2017-03-20 05:41 - 001038544 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-16 15:20 - 2017-03-20 05:41 - 000227958 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-16 15:20 - 2016-12-09 01:06 - 000000000 ____D C:\Users\mail\AppData\LocalLow\Mozilla
2017-11-16 15:15 - 2016-12-08 15:27 - 000000000 __SHD C:\Users\mail\IntelGraphicsProfiles
2017-11-16 15:14 - 2017-07-11 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-11-16 15:14 - 2017-07-11 14:08 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-16 15:13 - 2017-03-18 12:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-11-16 14:55 - 2016-12-11 14:39 - 000000000 ____D C:\Users\mail\AppData\Local\CrashDumps
2017-11-16 14:52 - 2017-07-11 14:11 - 000000000 ____D C:\Users\mail
2017-11-16 14:47 - 2016-12-08 18:04 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-11-16 14:43 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-16 14:41 - 2016-12-08 15:27 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-11-16 14:39 - 2017-03-18 22:01 - 000000000 ____D C:\WINDOWS\INF
2017-11-16 14:38 - 2016-12-08 18:02 - 000000000 ____D C:\ProgramData\Foxit Software
2017-11-16 14:37 - 2017-07-11 14:00 - 000387384 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\Provisioning
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-11-15 11:29 - 2017-07-11 14:29 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-11-15 11:29 - 2017-07-11 14:29 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-11-15 01:58 - 2017-03-18 21:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-14 08:25 - 2017-03-18 22:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-14 02:03 - 2017-05-02 19:11 - 000000000 ____D C:\Users\mail\Documents\PF 3rd Party
2017-11-12 19:46 - 2016-12-24 12:51 - 000000000 ____D C:\Users\mail\AppData\Local\Spotify
2017-11-12 19:42 - 2016-12-24 12:50 - 000000000 ____D C:\Users\mail\AppData\Roaming\Spotify
2017-11-12 13:51 - 2017-01-25 15:30 - 000000000 ____D C:\Users\mail\.maptool
2017-11-10 23:35 - 2016-12-26 23:32 - 000000000 ____D C:\Users\mail\.gimp-2.8
2017-11-10 18:10 - 2017-05-02 19:04 - 000000000 ____D C:\Users\mail\AppData\Roaming\BitTorrent
2017-11-10 17:52 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\VirtualStore
2017-11-10 15:45 - 2016-12-26 23:56 - 000000000 ____D C:\Users\mail\AppData\Local\gtk-2.0
2017-11-08 19:14 - 2016-12-09 01:05 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-08 19:14 - 2016-12-08 15:34 - 000002264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-08 17:46 - 2017-01-25 18:55 - 000000000 ____D C:\Users\mail\AppData\Local\ElevatedDiagnostics
2017-11-08 17:17 - 2017-03-18 22:03 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-11-08 00:52 - 2017-03-23 17:58 - 000000000 ____D C:\Users\mail\Documents\Citavi 5
2017-11-07 08:53 - 2017-03-18 22:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-11-07 08:51 - 2016-12-08 19:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-11-07 08:43 - 2016-12-08 15:32 - 000000000 ___RD C:\Users\mail\OneDrive
2017-11-07 08:42 - 2017-07-31 17:24 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-815402739-1259396803-2248114470-1001
2017-11-07 08:42 - 2016-12-08 15:32 - 000002380 _____ C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-11-05 09:05 - 2016-12-08 16:18 - 000000000 ____D C:\Users\mail\AppData\Roaming\NVIDIA
2017-11-05 02:40 - 2017-03-18 22:06 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-05 02:40 - 2017-03-18 22:06 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-03 23:53 - 2016-12-09 01:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-03 23:53 - 2016-12-09 01:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-02 01:05 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\Packages
2017-10-23 16:35 - 2016-12-08 17:50 - 000000000 ____D C:\Users\mail\AppData\Local\NVIDIA Corporation
2017-10-18 00:03 - 2016-12-08 16:21 - 000000000 ____D C:\ProgramData\Oracle
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-17 23:53 - 2016-12-11 15:53 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-17 23:52 - 2016-12-11 15:53 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ () C:\Users\mail\AppData\Local\installer.dat
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ () C:\Users\mail\AppData\Local\recently-used.xbel
2017-07-11 14:06 - 2017-07-11 14:06 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\7Xfck9gu6RaQ.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\a0cihmQ7qOQd.exe
2017-11-08 17:15 - 2017-11-08 17:15 - 002643640 _____ () C:\Users\mail\AppData\Local\Temp\h2wD0yUimdTL.exe
2017-11-08 17:21 - 2017-11-08 17:21 - 064938720 ____N (Kometa LCC) C:\Users\mail\AppData\Local\Temp\jFLhCEqErwDH.exe
2017-10-17 23:50 - 2017-10-17 23:50 - 001856576 _____ (Oracle Corporation) C:\Users\mail\AppData\Local\Temp\jre-8u151-windows-au.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\rsp7enBYwyNL.exe
2017-11-08 17:22 - 2017-11-08 17:22 - 000491520 _____ () C:\Users\mail\AppData\Local\Temp\UoR7BXFblh6R.exe
2017-11-08 17:23 - 2017-11-08 17:23 - 000000000 _____ () C:\Users\mail\AppData\Local\Temp\yL1LhWraFtvM.exe
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-11-12 11:12
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-11-2017
durchgeführt von mail (16-11-2017 15:22:02)
Gestartet von C:\Users\mail\Downloads
Windows 10 Pro Version 1703 15063.726 (X64) (2017-07-11 13:40:42)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-815402739-1259396803-2248114470-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-815402739-1259396803-2248114470-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-815402739-1259396803-2248114470-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-815402739-1259396803-2248114470-501 - Limited - Disabled)
mail (S-1-5-21-815402739-1259396803-2248114470-1001 - Administrator - Enabled) => C:\Users\mail
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 378.49 - NVIDIA Corporation) Hidden
AutoREALM Version 2.2.1 (HKLM-x32\...\AutoREALM_is1) (Version: - )
BitTorrent (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\BitTorrent) (Version: 7.10.0.43917 - BitTorrent Inc.)
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.5.0.1 - Swiss Academic Software)
CollageIt 1.9.5 (HKLM-x32\...\{D9757258-30B2-496E-86F2-84920C5858E1}_is1) (Version: 1.9.5 - PearlMountain)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.16.50 - Conexant)
Dark Age of Camelot (HKLM-x32\...\Dark Age of Camelot) (Version: - Electronic Arts)
Discord (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Discord) (Version: 0.0.298 - Discord Inc.)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.2.1 - CEWE Stiftung u Co. KGaA)
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.5.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 39.4.49 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
ELAN Touchpad 11.15.0.18_X64 (HKLM\...\Elantech) (Version: 11.15.0.18 - ELAN Microelectronic Corp.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FastCAD (HKLM-x32\...\FastCAD) (Version: - )
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 8.0.6.909 - Foxit Software Inc.)
Geeks3D FurMark 1.19.1.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version: - Geeks3D)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
IrfanView 4.44 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.44 - Irfan Skiljan)
Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.15.0414.1 - Vimicro)
Lenovo Service Bridge (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\dda9ca0b023f4c56) (Version: 1.6.4.0 - Lenovo)
Lenovo Solution Center (HKLM\...\{558E50EE-5E2D-479A-A455-8A826191583B}) (Version: 3.3.004.00 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.9 - Thibaut Lauziere)
Malwarebytes Version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.8625.2121 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\OneDriveSetup.exe) (Version: 17.3.7076.1026 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 56.0.2 (x64 de) (HKLM\...\Mozilla Firefox 56.0.2 (x64 de)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 56.0.2.6506 - Mozilla)
Mozilla Thunderbird 52.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.4.0 (x86 de)) (Version: 52.4.0 - Mozilla)
NVIDIA GeForce Experience 3.9.0.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.49 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8625.2121 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
PDF Image Extraction Wizard 1.2 (HKLM-x32\...\PDF Image Extraction Wizard 1.2_is1) (Version: - RL Vision)
PDFMate PDF Converter 1.7.5 (HKLM-x32\...\PDFMate PDF Converter_is1) (Version: - pdfmate.com)
Pymapper9 version 9.5 (HKLM-x32\...\{FB6CD2CE-26BF-4F55-A5AD-AC55628AC2DA}_is1) (Version: 9.5 - Toxic Rat Industries)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31222 - Realtek Semiconduct Corp.)
Spotify (HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Uthgard Launcher (HKLM-x32\...\Uthgard Launcher) (Version: 1.00.00.00 - Uthgard)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Vulkan Run Time Libraries 1.0.37.0 (HKLM\...\VulkanRT1.0.37.0) (Version: 1.0.37.0 - LunarG, Inc.)
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
XnView 2.41 (HKLM-x32\...\XnView_is1) (Version: 2.41 - Gougelet Pierre-e)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-815402739-1259396803-2248114470-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-08-12] (Foxit Software Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-13] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-03] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-01-20] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0C4E832E-F04A-4AEF-B8B2-909B4313E7B8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {167F2551-D0CC-4A6E-87A8-1EE9AAEA0106} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-09-19] (NVIDIA Corporation)
Task: {204C6882-DF25-4A55-8BEE-CAD856479F34} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {41FEEF5F-8762-4122-8682-BD10F2C6263D} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {484861FC-9E47-4FFB-B124-AEDDAF9C6C4E} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {4C555743-0F99-4037-B1FE-7CB0765FFE06} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {53E44DE0-EF6E-48EA-83B6-6F43387EBA89} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {5CD983AE-61D1-4F50-85D3-AF7C935DB805} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-09-19] (NVIDIA Corporation)
Task: {6FD57D65-66F5-455A-9D97-DFAA9F693FE8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7159EC6E-08A8-4DA7-BF4F-21B82E68180D} - System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => C:\PROGRA~2\FASTDA~1\FASTDA~1.EXE
Task: {74C25C0E-57E0-4CD9-B312-D7DD4D7D8E4A} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-11-07] (Microsoft Corporation)
Task: {75FE8B99-B0F4-4159-8407-7F76F57D9FCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-11-07] (Microsoft Corporation)
Task: {7E239916-4AD3-4D4D-A09F-A64D620E13C5} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-08] (Dropbox, Inc.)
Task: {8C767394-63ED-4D42-A3AA-9CB6B8B78406} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2016-08-24] (Lenovo)
Task: {96B097DB-6A97-4859-91B9-527F63509A0F} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-08-24] (Lenovo)
Task: {9ECBF216-67A3-46B8-B020-C1C06F4C4397} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-815402739-1259396803-2248114470-1001 => "C:\WINDOWS\system32\rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms
Task: {A2B16A6F-6BA9-4217-991D-E6F393680F2B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {B7666FC2-381A-4A6F-9C41-548F1EF694B2} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-26] ()
Task: {BE2E3880-F457-4548-BFD6-8F1C6076AE05} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-08] (Google Inc.)
Task: {C6956744-A8AE-44E1-A213-008E4823F0D6} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [2016-08-24] ()
Task: {D45BA73C-D40C-4BCC-B4A1-0A1421D5032F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-31] (Microsoft Corporation)
Task: {EAD48978-505B-41BE-A0E0-1591E00491C6} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-09-19] (NVIDIA Corporation)
Task: {EE5FB4A5-3756-47BC-AE3A-61F09F0D89AE} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {F759F44B-5A43-4B69-B549-341BC0CE44F7} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-09-19] (NVIDIA Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2017-07-11 14:09 - 2017-01-20 16:13 - 000134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-11-08 18:07 - 2017-11-01 08:55 - 002299344 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2016-12-08 17:46 - 2017-09-19 08:23 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-03-18 21:58 - 2017-03-18 21:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 21:59 - 2017-03-20 05:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-11-10 14:05 - 2017-11-10 14:06 - 000061952 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2017-11-12 10:41 - 2017-11-12 10:56 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-11-12 10:41 - 2017-11-12 10:56 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-11-12 10:41 - 2017-11-12 10:58 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-11-07 14:25 - 2017-11-07 14:26 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\skypert.dll
2017-11-12 10:41 - 2017-11-12 10:42 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-28 09:15 - 2017-09-21 08:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2017-11-15 01:44 - 2017-10-15 15:51 - 004125080 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll
2017-11-16 14:50 - 2017-11-13 11:26 - 000725312 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll
2017-11-16 14:50 - 2017-11-13 11:26 - 002075456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll
2017-11-16 14:50 - 2017-11-13 11:26 - 000100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000020800 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000130512 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 001856848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2017-11-16 14:50 - 2017-11-13 11:26 - 000105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000040248 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000062784 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000392656 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2017-11-16 14:50 - 2017-11-13 11:26 - 000020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000392512 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000026056 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000021824 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000066392 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000022856 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 001796920 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000084424 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 001956152 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 003859264 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000155464 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000521024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000050496 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000042304 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000131384 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000218944 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000204096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000054608 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000100688 _____ () C:\Program Files (x86)\Dropbox\Client\windisplaytoast.compiled._DisplayToast.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000027488 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000349128 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000101184 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWinExtras.pyd
2017-11-16 14:50 - 2017-11-13 11:29 - 000023896 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000025424 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2017-11-16 14:50 - 2017-11-13 11:28 - 000032600 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd
2017-11-16 14:50 - 2017-11-13 11:26 - 000293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll
2017-11-16 14:50 - 2017-11-13 11:28 - 000181056 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2017-11-16 14:50 - 2017-11-13 11:29 - 000030536 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000024368 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL
2017-11-16 14:50 - 2017-11-13 11:28 - 001638200 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2017-11-16 14:50 - 2017-11-13 11:29 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000545080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000359224 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2017-11-16 14:50 - 2017-11-13 11:28 - 000038208 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngine.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\3590F75ABA9E485486C100C1A9D4FF06ZZZ..ZZ.Z..Z...Z:1 [898]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\sharepoint.com -> hxxps://goetheuniversitaet-files.sharepoint.com
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 12:47 - 2017-11-08 17:17 - 000001832 _____ C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 wemsofts.com
127.0.0.1 bongadoom.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 internalcampaigntargets.com
127.0.0.1 bongadoom.com
127.0.0.1 getthefilenow.com
127.0.0.1 bigpicturepop.com
127.0.0.1 wizzcaster.com
127.0.0.1 bestoffersfortoday.com
127.0.0.1 wepcmainsystem.com
127.0.0.1 agent.wizztrakys.com
127.0.0.1 csdimonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 titiaredh.com
127.0.0.1 wepcdisplaysystem.com
127.0.0.1 wepcanalyticsystem.com
127.0.0.1 healthydownload.com
127.0.0.1 leading2download.com
127.0.0.1 dwl0.wizzlabs.com
127.0.0.1 dwl1.wizzlabs.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.azalee.site
127.0.0.1 dl.smashdl.com
127.0.0.1 downloadmyhost.com
127.0.0.1 lapapahoster.com
127.0.0.1 bratitlamio.com
127.0.0.1 mess1.wizzmonetize.com
127.0.0.1 dl.wizzuniquify.com
127.0.0.1 wizzmonetize.com
127.0.0.1 laserveradedomaina.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mail\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\foto 28.03.16, 03 14 53.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\StartupApproved\Run: => "Discord"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{290B1E59-15D4-4D23-9C0D-B81F4A0B8BA7}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{A8E36044-B28D-4FDD-81F1-026D28D01F5F}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{730B2AF5-30C2-4CB0-B36D-F465B6678BCA}C:\program files (x86)\dropbox\client\dropbox.exe] => (Allow) C:\program files (x86)\dropbox\client\dropbox.exe
FirewallRules: [UDP Query User{22501998-C9B1-45B5-BF3C-A9D238A9F057}C:\program files (x86)\dropbox\client\dropbox.exe] => (Allow) C:\program files (x86)\dropbox\client\dropbox.exe
==================== Wiederherstellungspunkte =========================
10-11-2017 15:48:44 Geplanter Prüfpunkt
15-11-2017 01:48:22 Windows Update
15-11-2017 01:50:05 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/16/2017 02:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_7.0.4.0.exe, Version: 7.0.4.0, Zeitstempel: 0x59f3de9c
Name des fehlerhaften Moduls: adwcleaner_7.0.4.0.exe, Version: 7.0.4.0, Zeitstempel: 0x59f3de9c
Ausnahmecode: 0xc000041d
Fehleroffset: 0x0007a21a
ID des fehlerhaften Prozesses: 0x2a0c
Startzeit der fehlerhaften Anwendung: 0x01d35ee13bcd07b1
Pfad der fehlerhaften Anwendung: C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
Pfad des fehlerhaften Moduls: C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
Berichtskennung: 205dc048-6499-4b38-9c28-11c424fe78ec
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/16/2017 02:53:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-39IFTOA)
Description: Bei der Aktivierung der App „Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/16/2017 02:53:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_7.0.4.0.exe, Version: 7.0.4.0, Zeitstempel: 0x59f3de9c
Name des fehlerhaften Moduls: adwcleaner_7.0.4.0.exe, Version: 7.0.4.0, Zeitstempel: 0x59f3de9c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0007a21a
ID des fehlerhaften Prozesses: 0x2a0c
Startzeit der fehlerhaften Anwendung: 0x01d35ee13bcd07b1
Pfad der fehlerhaften Anwendung: C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
Pfad des fehlerhaften Moduls: C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
Berichtskennung: 7baf8f06-074a-4ece-92da-df2bf3b39867
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/15/2017 04:50:28 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft office\root\office16\odbc drivers\salesforce\lib\libcurl32.dlla\libcurl.dll".
Die abhängige Assemblierung "OpenSSL.DllA,processorArchitecture="*",type="win32",version="1.0.0.4"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/15/2017 04:49:25 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (11/15/2017 02:52:33 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-39IFTOA)
Description: Bei der Aktivierung der App „Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/15/2017 02:52:24 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-39IFTOA)
Description: Bei der Aktivierung der App „Microsoft.Windows.Photos_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/15/2017 12:46:06 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\mail\Downloads\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 08:16:29 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (11/14/2017 08:16:16 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Systemfehler:
=============
Error: (11/16/2017 03:20:37 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Manager für heruntergeladene Karten" wurde nicht richtig gestartet.
Error: (11/16/2017 03:15:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (11/16/2017 03:15:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst FontCache3.0.0.0 erreicht.
Error: (11/16/2017 03:14:53 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/16/2017 03:14:53 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (11/16/2017 03:14:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SAService" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.
Error: (11/16/2017 03:14:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CldFlt" wurde aufgrund folgenden Fehlers nicht gestartet:
Die Anforderung wird nicht unterstützt.
Error: (11/16/2017 02:58:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (11/16/2017 02:58:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst FontCache3.0.0.0 erreicht.
Error: (11/16/2017 02:58:12 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
und der APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
CodeIntegrity:
===================================
Date: 2017-11-12 11:12:22.578
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-10 15:16:02.483
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-07 15:42:06.651
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-05 01:49:05.270
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-17 01:58:20.458
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-10-12 16:36:38.103
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-21 23:31:01.932
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-09-15 21:20:30.027
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-08-09 16:49:22.963
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-21 17:49:22.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 56%
Installierter physikalischer RAM: 6046.35 MB
Verfügbarer physikalischer RAM: 2607.95 MB
Summe virtueller Speicher: 7006.35 MB
Verfügbarer virtueller Speicher: 3357.77 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:464.65 GB) (Free:350.33 GB) NTFS
Drive d: (o2 CD) (CDROM) (Total:0.36 GB) (Free:0 GB) CDFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1A9999E4)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=464.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=782 MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
17.11.2017, 21:45
| #10 |
| /// TB-Ausbilder | Windows 10: Virus installiert (russische) Software Servus, Schritt 1
Schritt 2 Bitte setze deine Brower wie folgt zurück: IE ::: Setze folgendermassen den Internet Explorer zurück:
EDGE ::: Edge zurücksetzen FF ::: Firefox zurücksetzen CHR::: Chrome zurücksetzen OPR:: Opera zurücksetzen Schritt 3
Schritt 4
Bitte poste mit deiner nächsten Antwort
Geändert von M-K-D-B (17.11.2017 um 22:07 Uhr) |
|
20.11.2017, 20:33
| #11 |
| /// TB-Ausbilder | Windows 10: Virus installiert (russische) Software Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM inklusive Link zum Thema an mich falls du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
|
22.11.2017, 15:27
| #12 |
| | Windows 10: Virus installiert (russische) Software Hier die Log-Dateien: Code:
ATTFilter Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 19-11-2017
durchgeführt von mail (21-11-2017 21:58:15) Run:1
Gestartet von C:\Users\mail\Downloads
Geladene Profile: mail (Verfügbare Profile: defaultuser0 & mail)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
CloseProcesses:
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\96sqw910.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\96sqw910.default -> hxxps://encrypted.google.com
FF Session Restore: Mozilla\Firefox\Profiles\96sqw910.default -> ist aktiviert.
FF NetworkProxy: Mozilla\Firefox\Profiles\96sqw910.default -> type", 0
FF NewTabOverride: Mozilla\Firefox\Profiles\96sqw910.default -> Enabled: "id":"{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi [2017-11-08]
FF Extension: (Suchen und neue Registerkarte von Yahoo) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi [2017-11-13]
FF Extension: (Поиск@Mail.Ru) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi [2017-11-08] [Legacy]
Task: {7159EC6E-08A8-4DA7-BF4F-21B82E68180D} - System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => C:\PROGRA~2\FASTDA~1\FASTDA~1.EXE
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
CMD: dir "%CommonProgramFiles(x86)%"
CMD: dir "%CommonProgramW6432%"
CMD: dir "%UserProfile%"
CMD: dir "C:\"
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
*****************
Prozesse erfolgreich geschlossen.
Firefox DefaultSearchEngine erfolgreich entfernt
Firefox SelectedSearchEngine erfolgreich entfernt
Firefox "homepage" erfolgreich entfernt
FF Session Restore: -> erfolgreich entfernt
Firefox Proxy-Einstellungen wurden zurückgesetzt
Firefox NewTabOverride ("id":"{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7) erfolgreich entfernt
C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi => erfolgreich verschoben
C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\jid1-16aeif9OQIRKxA@jetpack.xpi => erfolgreich verschoben
C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7159EC6E-08A8-4DA7-BF4F-21B82E68180D} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7159EC6E-08A8-4DA7-BF4F-21B82E68180D} => Schlüssel erfolgreich entfernt
C:\WINDOWS\System32\Tasks\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{4470CDB7-030E-EEF0-F7F6-23E87951872C} => Schlüssel erfolgreich entfernt
========= dir "%ProgramFiles%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Program Files
10.11.2017 17:56 <DIR> .
10.11.2017 17:56 <DIR> ..
11.12.2016 15:26 <DIR> 7-Zip
11.07.2017 14:14 <DIR> Common Files
11.07.2017 14:07 <DIR> CONEXANT
01.04.2017 20:52 <DIR> dm
11.07.2017 14:06 <DIR> Dolby Digital Plus
11.07.2017 14:05 <DIR> Elantech
26.12.2016 23:29 <DIR> GIMP 2
11.07.2017 14:05 <DIR> Intel
15.09.2017 02:20 <DIR> Internet Explorer
08.12.2016 16:17 <DIR> Lenovo
08.11.2017 18:07 <DIR> Malwarebytes
08.12.2016 19:03 <DIR> Microsoft Office 15
11.07.2017 14:30 <DIR> MSBuild
10.10.2017 13:24 <DIR> NVIDIA Corporation
05.11.2017 12:17 <DIR> paint.net
10.11.2017 17:49 <DIR> ProFantasy
11.07.2017 14:30 <DIR> Reference Assemblies
30.06.2017 02:10 <DIR> UNP
12.07.2017 20:12 <DIR> Windows Defender
11.07.2017 14:39 <DIR> Windows Defender Advanced Threat Protection
15.09.2017 02:20 <DIR> Windows Mail
11.07.2017 14:39 <DIR> Windows Media Player
18.03.2017 22:03 <DIR> Windows Multimedia Platform
11.07.2017 14:39 <DIR> Windows NT
15.11.2017 12:42 <DIR> Windows Photo Viewer
18.03.2017 22:03 <DIR> Windows Portable Devices
18.03.2017 22:03 <DIR> Windows Security
18.03.2017 22:03 <DIR> WindowsPowerShell
0 Datei(en), 0 Bytes
30 Verzeichnis(se), 375.634.665.472 Bytes frei
========= Ende von CMD: =========
========= dir "%ProgramFiles(x86)%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Program Files (x86)
15.11.2017 11:29 <DIR> .
15.11.2017 11:29 <DIR> ..
18.04.2017 16:16 <DIR> AnvSoft
18.01.2017 22:01 <DIR> AutoREALM
23.03.2017 17:51 <DIR> Citavi 5
02.10.2017 01:22 <DIR> CollageIt
07.11.2017 08:53 <DIR> Common Files
16.11.2017 14:47 <DIR> Dropbox
18.01.2017 20:07 <DIR> Electronic Arts
14.11.2017 00:19 <DIR> ESET
08.12.2016 18:01 <DIR> Foxit Software
05.11.2017 09:03 <DIR> Geeks3D
08.12.2016 15:34 <DIR> Google
15.09.2017 02:20 <DIR> Internet Explorer
14.09.2017 17:24 <DIR> IrfanView
17.10.2017 23:53 <DIR> Java
05.10.2017 20:50 <DIR> LinuxLive USB Creator
27.12.2016 00:08 <DIR> McAfee
07.11.2017 08:51 <DIR> Microsoft Office
11.07.2017 14:14 <DIR> Microsoft.NET
03.11.2017 23:53 <DIR> Mozilla Firefox
03.11.2017 23:53 <DIR> Mozilla Maintenance Service
11.10.2017 23:47 <DIR> Mozilla Thunderbird
11.07.2017 14:30 <DIR> MSBuild
10.10.2017 13:24 <DIR> NVIDIA Corporation
18.04.2017 16:36 <DIR> PDF Image Extraction Wizard 1.2
10.11.2017 17:57 <DIR> ProFantasy
11.07.2017 14:30 <DIR> Reference Assemblies
11.07.2017 14:09 <DIR> USB Camera
18.01.2017 20:45 <DIR> Uthgard
07.06.2017 22:00 <DIR> VideoLAN
26.01.2017 00:06 <DIR> VulkanRT
12.07.2017 20:12 <DIR> Windows Defender
15.09.2017 02:20 <DIR> Windows Mail
11.07.2017 14:39 <DIR> Windows Media Player
18.03.2017 22:03 <DIR> Windows Multimedia Platform
18.03.2017 22:03 <DIR> Windows NT
15.11.2017 12:42 <DIR> Windows Photo Viewer
18.03.2017 22:03 <DIR> Windows Portable Devices
18.03.2017 22:03 <DIR> WindowsPowerShell
14.09.2017 17:27 <DIR> XnView
0 Datei(en), 0 Bytes
41 Verzeichnis(se), 375.634.665.472 Bytes frei
========= Ende von CMD: =========
========= dir "%ProgramData%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\ProgramData
16.07.2016 12:47 <DIR> Comms
11.07.2017 14:06 <DIR> Conexant
08.12.2016 18:03 <DIR> Dropbox
08.12.2016 18:03 <DIR> Foxit ContentPlatform
16.11.2017 14:38 <DIR> Foxit Software
08.10.2017 13:35 <DIR> Hewlett-Packard
04.01.2017 00:44 <DIR> HP
01.04.2017 21:00 <DIR> hps
18.01.2017 20:50 <DIR> IsolatedStorage
08.12.2016 16:18 <DIR> Lenovo
08.11.2017 18:07 <DIR> Malwarebytes
27.12.2016 00:05 <DIR> McAfee
11.07.2017 14:46 <DIR> Microsoft OneDrive
21.11.2017 21:58 <DIR> NVIDIA
10.10.2017 14:08 <DIR> NVIDIA Corporation
18.10.2017 00:03 <DIR> Oracle
18.01.2017 20:43 <DIR> Package Cache
02.10.2017 01:22 <DIR> PearlMountain
07.11.2017 08:53 <DIR> regid.1991-06.com.microsoft
18.03.2017 22:03 <DIR> SoftwareDistribution
23.03.2017 17:52 <DIR> Swiss Academic Software
28.09.2017 23:41 <DIR> tmp
11.07.2017 14:11 <DIR> USOPrivate
11.07.2017 14:11 <DIR> USOShared
20.03.2017 05:43 <DIR> WindowsHolographicDevices
0 Datei(en), 0 Bytes
25 Verzeichnis(se), 375.634.665.472 Bytes frei
========= Ende von CMD: =========
========= dir "%Appdata%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Users\mail\AppData\Roaming
08.11.2017 19:11 <DIR> .
08.11.2017 19:11 <DIR> ..
08.12.2016 15:27 <DIR> Adobe
18.04.2017 16:17 <DIR> AnvsoftPdfTools
10.11.2017 18:10 <DIR> BitTorrent
18.09.2017 16:54 <DIR> discord
08.12.2016 18:05 <DIR> Dropbox
19.01.2017 00:26 <DIR> Electronic Arts
08.12.2016 18:02 <DIR> Foxit AgentInformation
04.04.2017 15:05 <DIR> Foxit Software
20.05.2017 19:48 <DIR> Google
14.09.2017 17:24 <DIR> IrfanView
08.12.2016 16:18 <DIR> Lenovo
26.12.2016 10:48 <DIR> Macromedia
09.12.2016 01:05 <DIR> Mozilla
05.11.2017 09:05 <DIR> NVIDIA
02.10.2017 01:22 <DIR> PearlMountain
27.12.2016 10:52 <DIR> RenPy
08.12.2016 15:32 <DIR> Skype
12.11.2017 19:42 <DIR> Spotify
08.12.2016 16:22 <DIR> Sun
23.03.2017 18:10 <DIR> Swiss Academic Software
08.12.2016 18:04 <DIR> Thunderbird
18.01.2017 20:54 <DIR> Uthgard
04.10.2017 11:47 <DIR> vlc
14.09.2017 17:28 <DIR> XnView
0 Datei(en), 0 Bytes
26 Verzeichnis(se), 375.634.595.840 Bytes frei
========= Ende von CMD: =========
========= dir "%LocalAppdata%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Users\mail\AppData\Local
21.11.2017 21:51 <DIR> .
21.11.2017 21:51 <DIR> ..
25.12.2016 23:48 <DIR> Adobe
11.04.2017 14:48 <DIR> Apps
24.12.2016 12:51 <DIR> CEF
08.12.2016 15:29 <DIR> Comms
13.10.2017 13:16 <DIR> ConnectedDevicesPlatform
16.11.2017 14:55 <DIR> CrashDumps
11.07.2017 14:44 <DIR> DBG
18.09.2017 16:53 <DIR> Discord
23.03.2017 17:45 <DIR> Downloaded Installations
25.09.2017 09:44 <DIR> Dropbox
08.11.2017 17:46 <DIR> ElevatedDiagnostics
26.12.2016 23:32 <DIR> fontconfig
26.12.2016 23:32 <DIR> gegl-0.2
08.12.2016 15:44 <DIR> Google
10.11.2017 15:45 <DIR> gtk-2.0
08.11.2017 17:17 140.800 installer.dat
18.04.2017 19:30 <DIR> JDownloader v2.0
08.12.2016 16:19 <DIR> Lenovo
08.12.2016 16:17 <DIR> LenovoServiceBridge
26.12.2016 10:48 <DIR> Macromedia
08.11.2017 17:57 <DIR> Microsoft
11.07.2017 14:44 <DIR> MicrosoftEdge
09.12.2016 01:30 <DIR> Mozilla
08.12.2016 22:48 <DIR> NetworkTiles
25.01.2017 23:24 <DIR> NVIDIA
23.10.2017 16:35 <DIR> NVIDIA Corporation
02.11.2017 01:05 <DIR> Packages
08.12.2016 15:51 <DIR> PackageStaging
05.11.2017 12:22 <DIR> paint.net
08.12.2016 18:07 <DIR> PeerDistRepub
08.12.2016 17:50 <DIR> Programs
08.12.2016 15:28 <DIR> Publishers
10.11.2017 23:34 10.141 recently-used.xbel
27.12.2016 10:17 <DIR> speech
26.12.2016 02:24 <DIR> Spin_the_bottle__Tom_
12.11.2017 19:46 <DIR> Spotify
25.01.2017 18:44 <DIR> SquirrelTemp
21.11.2017 21:58 <DIR> Temp
08.12.2016 18:12 <DIR> Thunderbird
08.12.2016 15:27 <DIR> TileDataLayer
16.06.2017 13:18 <DIR> UNP
10.11.2017 17:52 <DIR> VirtualStore
2 Datei(en), 150.941 Bytes
42 Verzeichnis(se), 375.634.661.376 Bytes frei
========= Ende von CMD: =========
========= dir "%CommonProgramFiles(x86)%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Program Files (x86)\Common Files
07.11.2017 08:53 <DIR> .
07.11.2017 08:53 <DIR> ..
07.11.2017 08:53 <DIR> DESIGNER
11.07.2017 14:05 <DIR> Intel
17.10.2017 23:53 <DIR> Java
07.11.2017 08:53 <DIR> Microsoft Shared
18.03.2017 22:03 <DIR> Services
20.03.2017 05:41 <DIR> System
0 Datei(en), 0 Bytes
8 Verzeichnis(se), 375.634.661.376 Bytes frei
========= Ende von CMD: =========
========= dir "%CommonProgramW6432%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Program Files\Common Files
11.07.2017 14:14 <DIR> .
11.07.2017 14:14 <DIR> ..
11.07.2017 14:09 <DIR> Atheros
26.12.2016 00:00 <DIR> Intel
27.12.2016 00:07 <DIR> McAfee
11.07.2017 14:14 <DIR> microsoft shared
18.03.2017 22:03 <DIR> Services
20.03.2017 05:41 <DIR> System
0 Datei(en), 0 Bytes
8 Verzeichnis(se), 375.634.661.376 Bytes frei
========= Ende von CMD: =========
========= dir "%UserProfile%" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\Users\mail
16.11.2017 14:52 <DIR> .
16.11.2017 14:52 <DIR> ..
10.11.2017 23:35 <DIR> .gimp-2.8
08.12.2016 16:18 <DIR> .LSC
12.11.2017 13:51 <DIR> .maptool
08.12.2016 16:18 <DIR> .QtWebEngineProcess
26.12.2016 23:36 <DIR> .thumbnails
31.07.2017 17:49 <DIR> .tokentool
16.11.2017 14:41 <DIR> Contacts
16.11.2017 15:24 <DIR> Desktop
16.11.2017 14:41 <DIR> Documents
21.11.2017 21:58 <DIR> Downloads
14.10.2017 18:21 <DIR> Dropbox
16.11.2017 14:41 <DIR> Favorites
16.11.2017 14:41 <DIR> Links
16.11.2017 14:41 <DIR> Music
07.11.2017 08:43 <DIR> OneDrive
16.11.2017 14:41 <DIR> Pictures
16.11.2017 14:41 <DIR> Saved Games
16.11.2017 14:41 <DIR> Searches
21.11.2017 21:52 <DIR> Videos
11.12.2016 15:38 <DIR> wekafiles
0 Datei(en), 0 Bytes
22 Verzeichnis(se), 375.634.657.280 Bytes frei
========= Ende von CMD: =========
========= dir "C:\" =========
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: EAA2-2BC5
Verzeichnis von C:\
30.06.2016 09:38 <DIR> 3590F75ABA9E485486C100C1A9D4FF06ZZZ..ZZ.Z..Z...Z
16.11.2017 14:52 <DIR> AdwCleaner
25.12.2016 23:48 30 AVScanner.ini
08.12.2016 17:50 <DIR> Drivers
20.11.2016 18:15 <DIR> EGVP
08.12.2016 13:21 <DIR> ESD
21.11.2017 22:00 <DIR> FRST
08.09.2016 11:46 <DIR> Intel
22.08.2016 11:45 <DIR> Logs
08.11.2017 17:19 <DIR> Microsoft
08.12.2016 17:09 <DIR> NVIDIA
18.03.2017 22:03 <DIR> PerfLogs
10.11.2017 17:56 <DIR> Program Files
15.11.2017 11:29 <DIR> Program Files (x86)
07.11.2017 15:03 <DIR> Pymapper9
04.11.2015 00:00 <DIR> swwork
11.07.2017 14:09 <DIR> temp
11.07.2017 14:11 <DIR> Users
16.11.2017 15:23 <DIR> Windows
13.07.2016 21:27 <DIR> Windows10Upgrade
1 Datei(en), 30 Bytes
19 Verzeichnis(se), 375.634.657.280 Bytes frei
========= Ende von CMD: =========
================== ExportKey: ===================
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths]
"C:\WINDOWS\uninstaller.dat"="0"
"C:\WINDOWS\732544d0d69ee4681b6b07707b6a652c.exe"="0"
"C:\WINDOWS\System32\drivers\052de766620c6e51c4ee60f88d618b2b.sys"="0"
"C:\Program Files\0417403daac781b09224837cc2b08bbe"="0"
"C:\WINDOWS\ad0bac7e89c025620fe2c59cee788b06.ps1"="0"
"C:\WINDOWS\ad0bac7e89c025620fe2c59cee788b06.xml"="0"
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths]
=== Ende von ExportKey ===
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
========= Ende von RemoveProxy: =========
========= ipconfig /flushdns =========
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
========= Ende von CMD: =========
========= netsh winsock reset =========
Der Winsock-Katalog wurde zurckgesetzt.
Sie mssen den Computer neu starten, um den Vorgang abzuschlieáen.
========= Ende von CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 11034624 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 107456440 B
Java, Flash, Steam htmlcache => 26688 B
Windows/system/drivers => 314662265 B
Edge => 540341 B
Chrome => 450548331 B
Firefox => 387073860 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 20480 B
NetworkService => 61340 B
defaultuser0 => 0 B
mail => 744557588 B
RecycleBin => 3208996959 B
EmptyTemp: => 4.9 GB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 22:07:22 ====
Code:
ATTFilter Farbar Recovery Scan Tool (x64) Version: 19-11-2017
durchgeführt von mail (21-11-2017 22:18:39)
Gestartet von C:\Users\mail\Downloads
Start-Modus: Normal
================== Datei-Suche: "SearchAll: Mail.Ru;FASTDA;Gosearchq;FastData;Microleaves;System Healer;SystemHealer;Kometa;PCCLEANPLUS
" =============
Datei:
========
C:\Users\mail\Downloads\Please_Bang_My_Wife__Atelier_Sakura__MangaGamer__\Please Bang My Wife\fastdata1.arc
[2017-02-21 16:53][2016-12-14 21:27] 051094259 _____ () C4F01D41A8B1FB96ACCFDE14FF6DF656 [Datei ist nicht signiert]
C:\Users\mail\AppData\Local\JDownloader v2.0\cfg\subconf_cloud.mail.ru.ejs
[2017-04-18 19:30][2017-04-18 19:30] 000000016 _____ () B557FB11C99FFA5039EC63AD4317B3FE [Datei ist nicht signiert]
C:\FRST\Quarantine\C\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\homepage@mail.ru.xpi.xBAD
[2017-11-08 17:15][2017-11-08 17:15] 000133582 _____ () 30F1FBCFCDF4CAFD81EF2EDEADB2BC7C [Datei ist nicht signiert]
C:\FRST\Quarantine\C\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\96sqw910.default\Extensions\search@mail.ru.xpi.xBAD
[2017-11-08 17:15][2017-11-08 17:15] 000112210 _____ () D86EEA3ACF8DE4821DFE665838E21A00 [Datei ist nicht signiert]
C:\AdwCleaner\Quarantine\IDCdJOyapn\Mail.Ru Агент - используй для общения!.url
[2017-11-10 14:45][2017-11-08 17:15] 000000210 _____ () C748E3C222863E590BED515BAA1FD2BB [Datei ist nicht signiert]
C:\AdwCleaner\Quarantine\bbSqWy6yhK\Mail.Ru.url
[2017-11-10 14:45][2017-11-08 17:15] 000000152 _____ () C48288674AF90AB27B68ECB1F025A6A5 [Datei ist nicht signiert]
Ordner:
========
2017-11-21 22:23 - 2017-11-21 22:23 _____ C:\Users\mail\Desktop\Alte Firefox-Daten\96sqw910.default\browser-extension-data\homepage@mail.ru
2017-11-21 22:23 - 2017-11-21 22:23 _____ C:\Users\mail\Desktop\Alte Firefox-Daten\96sqw910.default\browser-extension-data\search@mail.ru
Registry:
========
===================== Suchergebnis für "Mail.Ru" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSync]
"AllowMailTruncation"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP]
"120"="S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
MailRuUpdater
C:\Users\mail\AppData\Local\Mail.Ru\MailRuUpdater.exe uninstall"
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Google\Chrome\NativeMessagingHosts\ru.mail.go.ext_info_host]
""="C:\Users\mail\AppData\Local\Mail.Ru\GoChromiumNativeHost\manifest.json"
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\ActiveSync\Partners\{A249374A-BB1F-4C9C-86DD-596C0E0F9896}]
"AllowMailTruncation"="0"
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Mozilla\NativeMessagingHosts\ru.mail.go.ext_info_host]
""="C:\Users\mail\AppData\Local\Mail.Ru\GoChromiumNativeHost\manifest_ff.json"
===================== Suchergebnis für "FASTDA" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP]
"123"="Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
FastDataX_is1
"C:\Program Files (x86)\FastDataX\unins000.exe""
===================== Suchergebnis für "Gosearchq" ==========
===================== Suchergebnis für "FastData" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP]
"123"="Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
FastDataX_is1
"C:\Program Files (x86)\FastDataX\unins000.exe""
===================== Suchergebnis für "Microleaves" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\436F6625D7B77354DBCD89DDC6CFAB1A\SourceList]
"LastUsedSource"="n;1;C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\436F6625D7B77354DBCD89DDC6CFAB1A\SourceList\Net]
"1"="C:\Users\mail\AppData\Roaming\Microleaves\Online Application 2.7.0\install\CFCBAA1\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Microleaves\Online Application\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Microleaves\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\"=""
[HKEY_USERS\.DEFAULT\Software\Caphyon\Advanced Updater\{F039D4A9-14D3-4425-A4FA-F2F9D5B0E014}]
"C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe"="0"
===================== Suchergebnis für "System Healer" ==========
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows\CurrentVersion\UFH\SHC]
"40"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Healer\Launch System Healer.lnk
C:\Program Files (x86)\SystemHealer\SystemHealer.exe
"
===================== Suchergebnis für "SystemHealer" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP]
"121"="Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
SystemHealer_is1
"C:\Program Files (x86)\SystemHealer\unins000.exe""
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows\CurrentVersion\UFH\SHC]
"40"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Healer\Launch System Healer.lnk
C:\Program Files (x86)\SystemHealer\SystemHealer.exe
"
===================== Suchergebnis für "Kometa" ==========
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows\CurrentVersion\UFH\SHC]
"43"="C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Боковая панель - Комета\Панель запуска.lnk
C:\Users\mail\AppData\Local\Kometa\Panel\KometaLaunchPanel.exe
"
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Users\mail\AppData\Local\Temp\t5d1473f1\kometamini.exe"="0x5341435001000000000000000700000028000000E040AE0294A6AE0201000000000000000000000A00210000E63F486B2AA0D20100000000000000000200000028000000000000000000000000000000000000000000000000000000F1060100000000000100000001000000"
[HKEY_USERS\S-1-5-21-815402739-1259396803-2248114470-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Users\mail\AppData\Local\Kometa\Panel\KometaLaunchPanel.exe"="0x534143500100000000000000070000002800000060A43E0071813F0001000000000000000000000A00210000E63F486B2AA0D2010000000000000000"
===================== Suchergebnis für "PCCLEANPLUS
" ==========
====== Ende von Suche ======
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 19-11-2017
durchgeführt von mail (Administrator) auf DESKTOP-39IFTOA (22-11-2017 15:21:15)
Gestartet von C:\Users\mail\Downloads
Geladene Profile: mail (Verfügbare Profile: defaultuser0 & mail)
Platform: Windows 10 Pro Version 1703 15063.726 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Spotify Ltd) C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo) C:\Users\mail\AppData\Local\Apps\2.0\XN8WOZ2K.D1V\WP5PNMPP.86D\lsb...tion_2d7b41b05b24775e_0001.0006_589ac911618caaca\LSB.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39091.16340.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-11-13] (Dropbox, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\Run: [Spotify Web Helper] => C:\Users\mail\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-27] (Spotify Ltd)
HKU\S-1-5-21-815402739-1259396803-2248114470-1001\...\MountPoints2: {e2da70c1-bd99-11e6-a447-806e6f6e6963} - "D:\o2Start.exe"
Startup: C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2017-11-16]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 141.2.22.74 141.2.149.10
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{2addfc52-bddc-4fc0-8547-909eb04df9dd}: [DhcpNameServer] 141.2.22.74 141.2.149.10
Tcpip\..\Interfaces\{31f33a9e-6641-11e7-a1db-806e6f6e6963}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{99bca9e2-2395-4ec2-b319-d8253fcec71b}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{c5cdf0d2-d37a-4562-aa40-e302ef28631a}: [DhcpNameServer] 10.216.1.1
Tcpip\..\Interfaces\{d0c1fc48-c0e2-4c01-88e8-8e9d67fda094}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{dcd20406-ab04-403e-8a08-6a9b94c429f7}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{defa2878-05d2-444f-aef2-ac5b1b0fa4da}: [NameServer] 8.8.8.8
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
SearchScopes: HKU\S-1-5-21-815402739-1259396803-2248114470-1001 -> {B74BA737-8C40-47FF-8801-482874673E45} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-11-21] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-10-20] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll [2017-03-18] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-11-07] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-11-07] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: zh2v4ey5.default-1511299404213
FF ProfilePath: C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\zh2v4ey5.default-1511299404213 [2017-11-22]
FF Homepage: Mozilla\Firefox\Profiles\zh2v4ey5.default-1511299404213 -> hxxps://inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=11956636
FF Extension: (ProxTube) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\zh2v4ey5.default-1511299404213\Extensions\ich@maltegoetz.de.xpi [2017-11-21]
FF Extension: (Adblock Plus) - C:\Users\mail\AppData\Roaming\Mozilla\Firefox\Profiles\zh2v4ey5.default-1511299404213\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-21]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: (Citavi Picker) - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2017-03-23] [Lagacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-25] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-07-28] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default -> Not-active:"chrome-extension://fabhkdeopjkcpkmofliimbjckmocfiom/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://inline.go.mail.ru/search?inline_comp=dse&q={searchTerms}&fr=chxtn12.0.23
CHR DefaultSearchKeyword: Default -> inline.go.mail.ru
CHR DefaultSuggestURL: Default -> hxxp://suggests.go.mail.ru/chrome?q={searchTerms}
CHR Session Restore: Default -> ist aktiviert.
CHR Profile: C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default [2017-11-22]
CHR Extension: (Präsentationen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-15]
CHR Extension: (Docs) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-15]
CHR Extension: (Google Drive) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-08]
CHR Extension: (YouTube) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-08]
CHR Extension: (OneTab) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2017-07-06]
CHR Extension: (Polarr Photo Editor) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\djonnbgfieijldcieafgjcnhmpcfpmgg [2017-11-16]
CHR Extension: (Yahoo Partner) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-11-08]
CHR Extension: (Tabellen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-15]
CHR Extension: (IRC QuakeNet webchat) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhaphniflbbhhfailihfckiifpbgeokd [2016-12-08]
CHR Extension: (Google Docs Offline) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-09]
CHR Extension: (AdBlock) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-11-13]
CHR Extension: (Stealthy) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2017-10-26]
CHR Extension: (Imagus) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\immpkjjlgappgfkkfieppnmlhakdmaab [2017-11-21]
CHR Extension: (The Great Suspender) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2017-07-06]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-14]
CHR Extension: (Citavi Picker) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2017-03-23]
CHR Extension: (Google Mail) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-08]
CHR Extension: (Chrome Media Router) - C:\Users\mail\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-22]
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8063656 2017-11-02] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-08] (Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-11-13] (Dropbox, Inc.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1648840 2016-08-05] (Foxit Software Inc.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273232 2016-08-24] (Lenovo)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-09-19] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-01-20] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-09-19] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-20] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193464 2017-11-16] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2017-11-22] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2017-11-22] (Malwarebytes)
R1 MpKsl68199531; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{19B36654-801F-4D93-AD04-4BB207D0D2DE}\MpKsl68199531.sys [58120 2017-11-22] (Microsoft Corporation)
R1 MpKslebb2e8aa; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6F7D8EB8-8062-4AB7-8C1D-E57479D3FC27}\MpKslebb2e8aa.sys [58120 2017-11-21] (Microsoft Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_80f146cdb11c45d2\nvlddmkm.sys [14427064 2017-01-21] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-09-19] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48064 2017-09-19] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [57792 2017-09-19] (NVIDIA Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [422656 2016-03-09] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-21 22:23 - 2017-11-21 22:23 - 000000000 ____D C:\Users\mail\Desktop\Alte Firefox-Daten
2017-11-21 22:18 - 2017-11-21 22:40 - 000006822 _____ C:\Users\mail\Desktop\Search.txt
2017-11-21 21:58 - 2017-11-21 22:07 - 000019603 _____ C:\Users\mail\Desktop\Fixlog.txt
2017-11-16 15:34 - 2017-11-16 15:34 - 000993915 _____ C:\Users\mail\Downloads\pg27942-images.epub
2017-11-16 15:22 - 2017-11-16 15:23 - 000049650 _____ C:\Users\mail\Downloads\Addition.txt
2017-11-16 15:19 - 2017-11-22 15:22 - 000022359 _____ C:\Users\mail\Downloads\FRST.txt
2017-11-16 15:12 - 2017-11-16 15:12 - 000003591 _____ C:\Users\mail\Desktop\mbam.txt
2017-11-16 15:02 - 2017-11-16 15:02 - 000001794 _____ C:\Users\mail\Desktop\AdwCleaner[C2].txt
2017-11-16 14:51 - 2017-11-16 14:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-11-16 14:38 - 2017-11-22 10:14 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2017-11-16 14:38 - 2017-11-22 10:14 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-11-16 14:38 - 2017-11-16 14:38 - 000193464 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2017-11-15 01:45 - 2017-11-02 06:16 - 002398696 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-11-15 01:45 - 2017-11-02 06:15 - 001239448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2017-11-15 01:45 - 2017-11-02 06:13 - 000546712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-15 01:45 - 2017-11-02 06:13 - 000095640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-11-15 01:45 - 2017-11-02 06:10 - 006557520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-15 01:45 - 2017-11-02 06:04 - 001292360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-15 01:45 - 2017-11-02 06:03 - 000223640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2017-11-15 01:45 - 2017-11-02 05:49 - 001838848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000703056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000613136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000362144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-11-15 01:45 - 2017-11-02 05:45 - 000283544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2017-11-15 01:45 - 2017-11-02 05:45 - 000172952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2017-11-15 01:45 - 2017-11-02 05:45 - 000133896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2017-11-15 01:45 - 2017-11-02 05:44 - 023680000 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-15 01:45 - 2017-11-02 05:44 - 005808640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-15 01:45 - 2017-11-02 05:44 - 000519680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-11-15 01:45 - 2017-11-02 05:43 - 020372896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-11-15 01:45 - 2017-11-02 05:36 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2017-11-15 01:45 - 2017-11-02 05:35 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\VPNv2CSP.dll
2017-11-15 01:45 - 2017-11-02 05:35 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-11-15 01:45 - 2017-11-02 05:34 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-11-15 01:45 - 2017-11-02 05:34 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-11-15 01:45 - 2017-11-02 05:34 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-15 01:45 - 2017-11-02 05:34 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2017-11-15 01:45 - 2017-11-02 05:32 - 008213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-11-15 01:45 - 2017-11-02 05:31 - 020512256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 013381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 002953216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-15 01:45 - 2017-11-02 05:30 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000388096 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-11-15 01:45 - 2017-11-02 05:30 - 000165888 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2017-11-15 01:45 - 2017-11-02 05:30 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2017-11-15 01:45 - 2017-11-02 05:29 - 019338240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-11-15 01:45 - 2017-11-02 05:29 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-15 01:45 - 2017-11-02 05:28 - 023684096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-15 01:45 - 2017-11-02 05:28 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 002078720 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-11-15 01:45 - 2017-11-02 05:27 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2017-11-15 01:45 - 2017-11-02 05:27 - 000049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertPKICmdlet.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 008197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 005963776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 002671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 001937408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-11-15 01:45 - 2017-11-02 05:26 - 000068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OnDemandConnRouteHelper.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 012227072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 011888128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 004727808 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 003377664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-11-15 01:45 - 2017-11-02 05:25 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 007598080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000444928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.Launcher.dll
2017-11-15 01:45 - 2017-11-02 05:24 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 002516480 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000680960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-15 01:45 - 2017-11-02 05:23 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 006254080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 002009600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-11-15 01:45 - 2017-11-02 05:22 - 001884160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2017-11-15 01:45 - 2017-11-02 05:22 - 001494528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 004417024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 003653120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-11-15 01:45 - 2017-11-02 05:21 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-15 01:45 - 2017-10-25 08:40 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-15 01:45 - 2017-10-15 16:09 - 002259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-11-15 01:45 - 2017-10-15 16:03 - 006765728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-11-15 01:45 - 2017-10-15 16:01 - 000583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-11-15 01:45 - 2017-10-15 15:53 - 000387928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-11-15 01:45 - 2017-10-15 15:49 - 000094616 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-11-15 01:45 - 2017-10-15 15:49 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-11-15 01:45 - 2017-10-15 15:45 - 001292288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-11-15 01:45 - 2017-10-15 15:45 - 001248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-11-15 01:45 - 2017-10-15 15:44 - 000636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-11-15 01:45 - 2017-10-15 15:44 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2017-11-15 01:45 - 2017-10-15 15:42 - 005225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-11-15 01:45 - 2017-10-15 15:42 - 003667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-11-15 01:45 - 2017-10-15 15:41 - 004559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-11-15 01:45 - 2017-10-15 15:41 - 001019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-11-15 01:45 - 2017-10-15 15:38 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-11-15 01:45 - 2017-10-15 15:14 - 000037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SEMgrPS.dll
2017-11-15 01:45 - 2017-10-15 15:10 - 001303040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 001578904 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000678808 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000612248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000379288 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000190360 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2017-11-15 01:44 - 2017-11-02 06:21 - 000136088 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 002032536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 001144728 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 001015704 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000965016 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2017-11-15 01:44 - 2017-11-02 06:20 - 000821656 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000613784 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000543640 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-11-15 01:44 - 2017-11-02 06:20 - 000484248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000469568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000259992 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2017-11-15 01:44 - 2017-11-02 06:20 - 000034712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2017-11-15 01:44 - 2017-11-02 06:16 - 008319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-15 01:44 - 2017-11-02 06:16 - 002327448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-15 01:44 - 2017-11-02 06:15 - 000503704 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2017-11-15 01:44 - 2017-11-02 06:14 - 000667040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-15 01:44 - 2017-11-02 06:14 - 000067992 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 005477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 002443672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-15 01:44 - 2017-11-02 06:13 - 001345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-15 01:44 - 2017-11-02 06:13 - 000212888 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000727336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000714648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000654976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000643192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000430848 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000412752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2017-11-15 01:44 - 2017-11-02 06:12 - 000319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2017-11-15 01:44 - 2017-11-02 06:12 - 000144248 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2017-11-15 01:44 - 2017-11-02 06:12 - 000038808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2017-11-15 01:44 - 2017-11-02 06:12 - 000026472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2017-11-15 01:44 - 2017-11-02 06:11 - 021353200 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-11-15 01:44 - 2017-11-02 06:05 - 000871408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2017-11-15 01:44 - 2017-11-02 06:05 - 000187800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2017-11-15 01:44 - 2017-11-02 05:37 - 003668992 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-15 01:44 - 2017-11-02 05:37 - 001278976 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2017-11-15 01:44 - 2017-11-02 05:37 - 000465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2017-11-15 01:44 - 2017-11-02 05:37 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2017-11-15 01:44 - 2017-11-02 05:37 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2017-11-15 01:44 - 2017-11-02 05:36 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2017-11-15 01:44 - 2017-11-02 05:35 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2017-11-15 01:44 - 2017-11-02 05:35 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2017-11-15 01:44 - 2017-11-02 05:35 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 012803072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000438784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageLiveTileTask.exe
2017-11-15 01:44 - 2017-11-02 05:34 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2017-11-15 01:44 - 2017-11-02 05:34 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageHandlers.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-11-15 01:44 - 2017-11-02 05:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertPKICmdlet.dll
2017-11-15 01:44 - 2017-11-02 05:32 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2017-11-15 01:44 - 2017-11-02 05:32 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Storage.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2017-11-15 01:44 - 2017-11-02 05:31 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 007339008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000635392 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000601088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Launcher.dll
2017-11-15 01:44 - 2017-11-02 05:30 - 000229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SIHClient.exe
2017-11-15 01:44 - 2017-11-02 05:29 - 000757248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-11-15 01:44 - 2017-11-02 05:29 - 000415232 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 001468416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000939008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000799744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2017-11-15 01:44 - 2017-11-02 05:28 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000565248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsreg.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000537600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2017-11-15 01:44 - 2017-11-02 05:27 - 000179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 004445696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 003060224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 002809344 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-11-15 01:44 - 2017-11-02 05:26 - 000986624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 002052608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-15 01:44 - 2017-11-02 05:25 - 001886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 001713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000877568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2017-11-15 01:44 - 2017-11-02 05:25 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-11-15 01:44 - 2017-11-02 05:24 - 004707840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2017-11-15 01:44 - 2017-11-02 05:23 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-15 01:44 - 2017-11-02 05:23 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-15 01:44 - 2017-11-02 05:19 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-15 01:44 - 2017-10-15 15:59 - 000923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-11-15 01:44 - 2017-10-15 15:57 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-11-15 01:44 - 2017-10-15 15:57 - 000409496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-11-15 01:44 - 2017-10-15 15:56 - 000872464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2017-11-15 01:44 - 2017-10-15 15:55 - 007910960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-11-15 01:44 - 2017-10-15 15:53 - 002969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-11-15 01:44 - 2017-10-15 15:51 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2017-11-15 01:44 - 2017-10-15 15:15 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2017-11-15 01:44 - 2017-10-15 15:13 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-11-15 01:44 - 2017-10-15 15:09 - 001878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-11-15 01:44 - 2017-10-15 15:09 - 000527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-11-15 01:44 - 2017-10-15 15:08 - 001260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-11-15 01:44 - 2017-10-15 15:08 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2017-11-15 01:44 - 2017-10-15 15:07 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-11-15 01:44 - 2017-10-15 15:05 - 004396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-11-15 01:44 - 2017-10-15 15:05 - 001293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-11-15 01:44 - 2017-10-15 15:04 - 005557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-11-15 01:44 - 2017-10-15 15:02 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-11-15 01:44 - 2017-10-15 15:00 - 000061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\vss_ps.dll
2017-11-15 00:46 - 2017-11-21 21:56 - 000000000 ____D C:\Users\mail\Downloads\FRST-OlderVersion
2017-11-14 00:19 - 2017-11-14 00:19 - 000000000 ____D C:\Program Files (x86)\ESET
2017-11-14 00:15 - 2017-11-14 00:15 - 002870984 _____ (ESET) C:\Users\mail\Downloads\esetsmartinstaller_deu.exe
2017-11-13 11:26 - 2017-11-13 11:26 - 000051016 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2017-11-13 11:26 - 2017-11-13 11:26 - 000045672 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2017-11-13 11:26 - 2017-11-13 11:26 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2017-11-13 11:26 - 2017-11-13 11:26 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ C:\Users\mail\AppData\Local\recently-used.xbel
2017-11-10 17:57 - 2017-11-10 17:57 - 000000000 ____D C:\Program Files (x86)\ProFantasy
2017-11-10 17:48 - 2017-11-10 17:49 - 000000000 ____D C:\Program Files\ProFantasy
2017-11-10 17:15 - 2017-11-10 17:16 - 011699519 ____R (ProFantasy Software ) C:\Users\mail\Desktop\CC3Patch7.exe
2017-11-10 14:41 - 2017-11-16 14:52 - 000000000 ____D C:\AdwCleaner
2017-11-10 14:40 - 2017-11-10 14:41 - 008261584 _____ (Malwarebytes) C:\Users\mail\Downloads\adwcleaner_7.0.4.0.exe
2017-11-10 14:06 - 2017-11-22 15:21 - 000000000 ____D C:\FRST
2017-11-09 14:28 - 2017-11-16 14:52 - 000000008 __RSH C:\Users\mail\ntuser.pol
2017-11-08 18:07 - 2017-11-08 18:07 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-11-08 18:07 - 2017-11-08 18:07 - 000000000 ____D C:\Program Files\Malwarebytes
2017-11-08 18:07 - 2017-11-01 08:54 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-11-08 18:01 - 2017-11-21 21:55 - 002391552 _____ (Farbar) C:\Users\mail\Downloads\FRST64.exe
2017-11-08 17:56 - 2017-11-08 17:56 - 078346672 _____ (Malwarebytes ) C:\Users\mail\Downloads\mb3-setup-consumer-3.3.1.2183.exe
2017-11-08 17:40 - 2017-11-08 19:28 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-11-08 17:38 - 2017-11-08 19:23 - 000508936 _____ C:\WINDOWS\ntbtlog.txt
2017-11-08 17:17 - 2017-11-16 14:52 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ C:\Users\mail\AppData\Local\installer.dat
2017-11-08 00:53 - 2017-11-08 00:53 - 000214380 _____ C:\Users\mail\Desktop\Wiz20.pdf
2017-11-07 16:04 - 2017-11-07 16:05 - 113493996 _____ C:\Users\mail\Downloads\CA54_JonRobertsDungeon.exe
2017-11-07 15:23 - 2017-11-07 15:23 - 000000000 ____D C:\Users\mail\Downloads\-Getintopc.com-Campaign_Cartographer_3
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\Pymapper9
2017-11-07 15:03 - 2017-11-07 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pymapper9
2017-11-07 12:06 - 2017-11-07 12:06 - 000051621 _____ C:\WINDOWS\uninstaller.dat
2017-11-06 19:59 - 2017-11-06 19:59 - 000060450 _____ C:\Users\mail\Downloads\Alternatives Giftsystem.pdf
2017-11-05 12:17 - 2017-11-05 12:17 - 000001160 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2017-11-05 12:17 - 2017-11-05 12:17 - 000000000 ____D C:\Program Files\paint.net
2017-11-05 12:15 - 2017-11-05 12:22 - 000000000 ____D C:\Users\mail\AppData\Local\paint.net
2017-11-05 12:12 - 2017-11-05 12:12 - 000000000 ____D C:\Users\mail\Downloads\paint.net.4.0.10.install
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Geeks3D
2017-11-05 09:03 - 2017-11-05 09:03 - 000000000 ____D C:\Program Files (x86)\Geeks3D
2017-11-03 16:53 - 2017-11-03 16:53 - 000000000 ____D C:\Users\mail\Downloads\word
2017-11-02 00:59 - 2017-11-02 00:59 - 000507314 _____ C:\Users\mail\Downloads\Arradon - Untoter Nekromant.pdf
2017-11-02 00:59 - 2017-11-02 00:59 - 000130889 _____ C:\Users\mail\Downloads\Azmalia von Lorstein, die Blutgeweihte.pdf
2017-11-02 00:29 - 2017-11-02 00:29 - 000000000 ___HD C:\OneDriveTemp
2017-10-24 08:31 - 2017-10-24 08:31 - 000090049 _____ C:\Users\mail\Downloads\Seminarplan.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-11-22 14:59 - 2017-07-11 14:08 - 000000000 ____D C:\ProgramData\NVIDIA
2017-11-22 14:57 - 2016-12-09 01:06 - 000000000 ____D C:\Users\mail\AppData\LocalLow\Mozilla
2017-11-22 14:56 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-11-22 14:54 - 2016-12-08 15:27 - 000000000 __SHD C:\Users\mail\IntelGraphicsProfiles
2017-11-22 12:07 - 2017-07-11 14:11 - 000000000 ____D C:\Users\mail
2017-11-22 10:14 - 2016-12-08 18:02 - 000000000 ____D C:\ProgramData\Foxit Software
2017-11-22 10:13 - 2017-07-11 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-11-22 10:13 - 2016-12-09 01:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-22 10:13 - 2016-12-09 01:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-22 08:47 - 2016-12-08 15:34 - 000002264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-21 23:20 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\rescache
2017-11-21 22:42 - 2017-03-18 22:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-21 22:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-21 22:24 - 2016-12-08 18:04 - 000000000 ____D C:\Users\mail\AppData\Roaming\Mozilla
2017-11-21 22:23 - 2016-12-09 01:05 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-21 22:16 - 2017-07-11 14:28 - 002313366 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-11-21 22:16 - 2017-03-20 05:41 - 001055486 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-21 22:16 - 2017-03-20 05:41 - 000232694 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-21 22:16 - 2017-03-18 22:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-11-21 22:08 - 2017-03-18 12:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-11-21 22:07 - 2016-12-08 19:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-11-21 22:03 - 2017-07-07 11:30 - 000000000 ____D C:\Users\mail\AppData\LocalLow\Temp
2017-11-21 22:01 - 2016-12-09 02:02 - 000545440 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-11-16 14:55 - 2016-12-11 14:39 - 000000000 ____D C:\Users\mail\AppData\Local\CrashDumps
2017-11-16 14:47 - 2016-12-08 18:04 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-11-16 14:41 - 2016-12-08 15:27 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-11-16 14:39 - 2017-03-18 22:01 - 000000000 ____D C:\WINDOWS\INF
2017-11-16 14:37 - 2017-07-11 14:00 - 000387384 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\Provisioning
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-11-15 12:42 - 2017-03-18 22:03 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-11-15 11:29 - 2017-07-11 14:29 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-11-15 11:29 - 2017-07-11 14:29 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-11-15 01:58 - 2017-03-18 21:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-14 02:03 - 2017-05-02 19:11 - 000000000 ____D C:\Users\mail\Documents\PF 3rd Party
2017-11-12 19:46 - 2016-12-24 12:51 - 000000000 ____D C:\Users\mail\AppData\Local\Spotify
2017-11-12 19:42 - 2016-12-24 12:50 - 000000000 ____D C:\Users\mail\AppData\Roaming\Spotify
2017-11-12 13:51 - 2017-01-25 15:30 - 000000000 ____D C:\Users\mail\.maptool
2017-11-10 23:35 - 2016-12-26 23:32 - 000000000 ____D C:\Users\mail\.gimp-2.8
2017-11-10 18:10 - 2017-05-02 19:04 - 000000000 ____D C:\Users\mail\AppData\Roaming\BitTorrent
2017-11-10 17:52 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\VirtualStore
2017-11-10 15:45 - 2016-12-26 23:56 - 000000000 ____D C:\Users\mail\AppData\Local\gtk-2.0
2017-11-08 17:46 - 2017-01-25 18:55 - 000000000 ____D C:\Users\mail\AppData\Local\ElevatedDiagnostics
2017-11-08 17:17 - 2017-03-18 22:03 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-11-08 00:52 - 2017-03-23 17:58 - 000000000 ____D C:\Users\mail\Documents\Citavi 5
2017-11-07 08:43 - 2016-12-08 15:32 - 000000000 ___RD C:\Users\mail\OneDrive
2017-11-07 08:42 - 2017-07-31 17:24 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-815402739-1259396803-2248114470-1001
2017-11-07 08:42 - 2016-12-08 15:32 - 000002380 _____ C:\Users\mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-11-05 09:05 - 2016-12-08 16:18 - 000000000 ____D C:\Users\mail\AppData\Roaming\NVIDIA
2017-11-05 02:40 - 2017-03-18 22:06 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-05 02:40 - 2017-03-18 22:06 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-02 01:05 - 2016-12-08 15:27 - 000000000 ____D C:\Users\mail\AppData\Local\Packages
2017-10-23 16:35 - 2016-12-08 17:50 - 000000000 ____D C:\Users\mail\AppData\Local\NVIDIA Corporation
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-11-08 17:17 - 2017-11-08 17:17 - 000140800 _____ () C:\Users\mail\AppData\Local\installer.dat
2017-11-10 23:34 - 2017-11-10 23:34 - 000010141 _____ () C:\Users\mail\AppData\Local\recently-used.xbel
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-11-21 23:01
==================== Ende von FRST.txt ============================
|
|
22.11.2017, 15:28
| #13 |
| | Windows 10: Virus installiert (russische) Software Und hier auch noch die Addition.txt: Code:
ATTFilter
|
|
22.11.2017, 21:34
| #14 |
| /// TB-Ausbilder | Windows 10: Virus installiert (russische) Software Servus, Schritt 1
Schritt 2
Schritt 3
Wie sieht es jetzt aus? In welchem Browser hast du noch Probleme? Ist es immer noch so schlimm? Bitte poste mit deiner nächsten Antwort
|
|
26.11.2017, 13:12
| #15 |
| /// TB-Ausbilder | Windows 10: Virus installiert (russische) Software Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM inklusive Link zum Thema an mich falls du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
|
| Themen zu Windows 10: Virus installiert (russische) Software |
| .dll, administrator, defender, explorer, geforce, google, homepage, mozilla, node.js, nvidia, ordner, problem, programme, prozesse, registry, router, rundll, scan, services.exe, software, svchost.exe, system, usb, virus, windows, windowsapps, winlogon.exe |
Linear-Darstellung
