| Schnuckibaer | 07.01.2017 17:08 |
Tune Up ist runter Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 07-01-2017
durchgeführt von Denise (Administrator) auf WOMBAT (07-01-2017 16:59:17)
Gestartet von C:\Users\Denise\Desktop\Trojanerboard
Geladene Profile: UpdatusUser & Denise & (Verfügbare Profile: UpdatusUser & Denise)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-28] (NVIDIA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-19] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1360600 2013-10-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AppLauncher] => C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\MountPoints2: {a3baa892-5369-11e6-828f-0c8bfddd15ac} - "F:\windows\Data\setup.exe"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a3baa892-5369-11e6-828f-0c8bfddd15ac} - "F:\windows\Data\setup.exe"
HKU\S-1-5-18\...\Run: [AppLauncher] => C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NeroDesktopSwitcher.scf [2014-01-09] ()
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D7D7085-9498-4093-AC34-2DBFD52ED2F0}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-10-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-07-26] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-07-26] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default [2017-01-07]
FF Homepage: Mozilla\Firefox\Profiles\ytdyifhp.default -> www.google.de
FF Extension: (Firefox Hotfix) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-08-31]
FF Extension: (Video DownloadHelper) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-04]
FF Extension: (Adblock Plus) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internet-Manager\Bin\addon => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-11] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-11] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-07-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2014-07-24] (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2016-12-25]
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2016-11-01] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [Datei ist nicht signiert]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-28] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [118728 2013-09-18] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-01-07] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3607520 2013-10-14] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-19] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-19] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 HSPADataCardusbmdm; \SystemRoot\system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; \SystemRoot\system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; \SystemRoot\system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 massfilter; \SystemRoot\System32\drivers\massfilter.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-01-06 18:53 - 2017-01-06 18:53 - 00852720 _____ C:\Users\Denise\Downloads\SecurityCheck.exe
2017-01-06 15:32 - 2017-01-06 15:32 - 02870984 _____ (ESET) C:\Users\Denise\Downloads\esetsmartinstaller_deu.exe
2017-01-05 21:25 - 2017-01-05 21:25 - 00001471 _____ C:\Users\Denise\Desktop\JRT.txt
2017-01-05 21:22 - 2017-01-05 21:22 - 01663040 _____ (Malwarebytes) C:\Users\Denise\Downloads\JRT.exe
2017-01-05 21:09 - 2017-01-05 21:10 - 03977168 _____ C:\Users\Denise\Downloads\AdwCleaner_6.041.exe
2017-01-05 14:58 - 2017-01-05 15:01 - 00235758 _____ C:\TDSSKiller.3.1.0.12_05.01.2017_14.58.41_log.txt
2017-01-05 14:11 - 2017-01-05 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-01-05 14:07 - 2017-01-05 14:07 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Denise\Downloads\tdsskiller31012.exe
2017-01-05 14:06 - 2017-01-05 14:06 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Denise\Downloads\mbar-1.09.3.1001.exe
2017-01-04 20:50 - 2017-01-07 16:59 - 00000000 ____D C:\Users\Denise\Desktop\Trojanerboard
2017-01-04 20:24 - 2017-01-04 20:24 - 00000000 ____D C:\Users\Denise\Downloads\FRST-OlderVersion
2017-01-04 19:30 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\8663r261o3m395
2016-12-29 20:49 - 2016-12-29 20:52 - 00000000 ____D C:\Users\Denise\Desktop\Handy Urlaub
2016-12-27 21:55 - 2016-12-27 21:55 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Internet-Manager
2016-12-26 17:46 - 2017-01-07 16:59 - 00000000 ____D C:\FRST
2016-12-26 16:46 - 2017-01-07 15:31 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-26 16:45 - 2017-01-05 14:35 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-12-26 16:45 - 2016-12-26 17:18 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-12-26 15:53 - 2017-01-05 21:17 - 00000000 ____D C:\AdwCleaner
2016-12-26 15:12 - 2016-12-25 22:34 - 00001282 _____ C:\Windows\system32\Drivers\etc\hosts.20161226-151245.backup
2016-12-26 12:47 - 2016-12-26 17:18 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 17:18 - 00001063 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-26 12:44 - 2016-12-26 12:44 - 00243720 _____ C:\Users\Denise\Downloads\Firefox Setup Stub 50.1.0.exe
2016-12-25 22:46 - 2017-01-06 15:20 - 00066358 _____ C:\Windows\PFRO.log
2016-12-25 22:46 - 2016-12-27 21:59 - 00477328 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-25 22:38 - 2016-12-25 22:41 - 00001058 _____ C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-25 22:36 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2016-12-25 22:36 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2016-12-25 22:36 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2016-12-25 22:33 - 2017-01-05 13:19 - 00000000 ____D C:\Program Files (x86)\Drowiing
2016-12-25 22:33 - 2016-12-25 22:46 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Dripied
2016-12-25 22:33 - 2016-12-25 22:34 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Profiles
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\Documents\eRightSoft
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\AppData\Local\Steqiwardeadom
2016-12-25 22:33 - 2016-05-05 12:23 - 00556216 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avutil-lav-55.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00537784 __RSH (FFmpeg Project) C:\Windows\SysWOW64\swscale-lav-4.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00405176 __RSH (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00276152 __RSH C:\Windows\SysWOW64\libbluray.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00000493 __RSH C:\Windows\SysWOW64\LAVFilters.Dependencies.manifest
2016-12-25 22:33 - 2016-05-05 12:22 - 10766520 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avcodec-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 01699000 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avformat-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00188088 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avfilter-lav-6.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00160440 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avresample-lav-3.dll
2016-12-25 22:33 - 2004-10-10 08:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2016-12-25 22:33 - 2004-07-02 16:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2016-12-25 22:32 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\93066184d64t1179994
2016-12-25 22:32 - 2016-12-25 22:44 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2016-12-25 22:32 - 2016-12-25 22:43 - 00000000 ____D C:\Windows\system32\SSL
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ___HD C:\Users\Denise\AppData\Roaming\DIFX
2016-12-25 22:06 - 2017-01-02 08:51 - 00000000 ____D C:\Users\Denise\Desktop\DVD Player Auto
2016-12-23 21:22 - 2016-12-23 21:22 - 00000000 ____D C:\ProgramData\Oracle
2016-12-23 21:21 - 2016-10-27 14:22 - 59890688 _____ (Ravensburger AG) C:\Users\Denise\Desktop\tiptoi_3.1.6.exe
2016-12-23 15:40 - 2016-12-23 15:40 - 00026306 _____ C:\Users\Denise\Desktop\Gutschein.docx
2016-12-22 14:13 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-18 11:54 - 2016-12-18 11:54 - 00106441 _____ C:\Users\Denise\Downloads\PMP_Order_1.pdf
2016-12-18 07:44 - 2017-01-06 15:21 - 00014219 _____ C:\Windows\setupact.log
2016-12-18 07:44 - 2016-12-18 07:44 - 00000000 _____ C:\Windows\setuperr.log
2016-12-17 08:31 - 2017-01-07 08:23 - 00072539 ____H C:\Users\Denise\AppData\Local\IconCache.db
2016-12-16 11:43 - 2016-12-26 17:18 - 00001219 _____ C:\Users\Public\Desktop\Ashampoo Snap 2017.lnk
2016-12-16 11:43 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2016-12-16 11:39 - 2016-12-16 11:40 - 54653776 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Denise\Downloads\ashampoo_snap_2017_23536.exe
2016-12-16 11:19 - 2016-12-16 11:19 - 00292995 _____ C:\Users\Denise\Downloads\mp3DC222.exe
2016-12-16 07:54 - 2016-12-16 07:54 - 02586928 _____ C:\Users\Denise\Downloads\Adaware_Installer(1).exe
2016-12-15 14:20 - 2016-12-26 17:17 - 00002276 _____ C:\Users\Denise\Desktop\Kindle.lnk
2016-12-15 14:20 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2016-12-15 14:20 - 2016-12-15 14:21 - 00000000 ____D C:\Users\Denise\Documents\My Kindle Content
2016-12-15 14:20 - 2016-12-15 14:20 - 00000000 ____D C:\Users\Denise\AppData\Local\Amazon
2016-12-15 14:19 - 2016-12-15 14:20 - 66693792 _____ (Amazon.com) C:\Users\Denise\Downloads\KindleForPC-installer-1.17.44183.exe
2016-12-15 13:28 - 2016-12-15 13:28 - 00045532 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_03-11-2016_0635.pdf
2016-12-15 13:28 - 2016-12-15 13:28 - 00042838 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_05-12-2016_0620.pdf
2016-12-14 07:58 - 2016-12-01 15:13 - 00869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:13 - 00678592 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00536768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-10-20 14:14 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2016-12-14 07:58 - 2016-10-20 14:10 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2016-12-14 07:56 - 2016-11-19 22:24 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 07:56 - 2016-11-19 22:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 07:56 - 2016-11-19 20:29 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-14 07:56 - 2016-11-19 19:44 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 07:56 - 2016-11-16 22:49 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 07:56 - 2016-11-12 22:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-14 07:56 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 07:56 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 07:56 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-14 07:56 - 2016-11-12 19:23 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 07:56 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:45 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 07:56 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-14 07:56 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-14 07:56 - 2016-11-11 03:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 07:56 - 2016-11-09 18:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 07:56 - 2016-11-05 21:46 - 00422744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2016-12-14 07:56 - 2016-11-05 19:35 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-14 07:56 - 2016-11-05 18:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 07:56 - 2016-11-05 18:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 07:56 - 2016-11-05 16:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-14 07:56 - 2016-11-05 16:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-14 07:56 - 2016-10-28 03:56 - 01380048 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-14 07:56 - 2016-10-27 15:28 - 01097728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-14 07:56 - 2016-10-12 22:49 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-12-14 07:56 - 2016-10-12 22:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2016-12-14 07:56 - 2016-10-11 17:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-12-14 07:56 - 2016-10-11 00:31 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-12-14 07:56 - 2016-10-10 19:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-14 07:56 - 2016-10-10 19:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2016-12-14 07:56 - 2016-10-09 15:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2016-12-14 07:56 - 2016-10-08 23:24 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:31 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:10 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-12-14 07:56 - 2016-10-05 15:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\system32\locale.nls
2016-12-14 07:56 - 2016-10-05 05:15 - 01969944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 01613528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-14 07:56 - 2016-09-27 21:16 - 00445873 _____ C:\Windows\system32\ApnDatabase.xml
2016-12-14 07:56 - 2016-09-20 23:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-12-14 07:56 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2016-12-12 12:09 - 2016-12-12 12:19 - 01037434 _____ C:\Users\Denise\Downloads\20161108_214140.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00944227 _____ C:\Users\Denise\Downloads\20161108_214126.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00905302 _____ C:\Users\Denise\Downloads\20161108_214019.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00810842 _____ C:\Users\Denise\Downloads\20161108_214004.jpg
2016-12-12 11:53 - 2016-12-12 11:53 - 00431690 _____ C:\Users\Denise\Downloads\3907_buildinginstruction
2016-12-11 21:32 - 2016-12-11 21:32 - 00117357 _____ C:\Users\Denise\Downloads\ZIAUFEIN_1481058355529JAOOW1ESAIGW.pdf
2016-12-11 16:05 - 2016-12-11 16:05 - 00104263 _____ C:\Users\Denise\Downloads\PMP_Order_19(1).pdf
2016-12-10 21:34 - 2016-12-10 21:34 - 00104266 _____ C:\Users\Denise\Downloads\PMP_Order_19.pdf
2016-12-08 13:26 - 2016-12-08 13:26 - 00049590 _____ C:\Users\Denise\Downloads\KleinunternehmerUmsatzsteuerrecht.pdf
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-01-07 16:25 - 2016-11-20 07:49 - 00000000 ____D C:\Users\Denise\AppData\LocalLow\Mozilla
2017-01-07 16:06 - 2016-07-19 21:46 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-07 16:06 - 2016-07-19 21:46 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-07 16:06 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\tracing
2017-01-07 16:05 - 2016-11-19 19:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-07 15:58 - 2016-08-20 13:36 - 00000000 ____D C:\Users\Denise\AppData\Roaming\vlc
2017-01-07 15:31 - 2016-07-19 21:54 - 00000000 ___RD C:\Users\Denise\Dropbox
2017-01-06 15:25 - 2013-09-12 12:28 - 00766620 _____ C:\Windows\system32\perfh007.dat
2017-01-06 15:25 - 2013-09-12 12:28 - 00159902 _____ C:\Windows\system32\perfc007.dat
2017-01-06 15:25 - 2013-09-12 12:00 - 01780340 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-06 15:25 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2017-01-06 15:21 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-06 15:20 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\security
2017-01-05 21:43 - 2016-07-19 21:11 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3531133450-1765533330-4211851364-1002
2017-01-05 14:33 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-01-05 13:42 - 2016-10-19 17:36 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-01-05 13:40 - 2016-10-19 17:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-01-04 19:16 - 2016-07-19 21:12 - 00000000 ___DO C:\Users\Denise\SkyDrive
2017-01-02 16:34 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\registration
2017-01-01 21:20 - 2016-10-07 11:46 - 00000000 ____D C:\Users\Denise\Documents\Calibre Bibliothek
2016-12-31 22:01 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Pictures
2016-12-28 11:17 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Music
2016-12-27 21:59 - 2013-08-22 14:36 - 00000000 __RSD C:\Windows\Fonts
2016-12-27 21:56 - 2016-07-27 19:10 - 00000000 ____D C:\Windows\SysWOW64\SupportAppZXH
2016-12-27 21:56 - 2013-08-22 16:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2016-12-27 20:10 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\CyberLink
2016-12-26 22:30 - 2016-07-24 08:40 - 00000000 ____D C:\Users\Denise\dwhelper
2016-12-26 22:26 - 2016-09-02 08:21 - 00000000 ____D C:\Users\Denise\Desktop\Tupperware
2016-12-26 17:18 - 2016-11-27 00:10 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-11-27 00:10 - 00002065 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-08-20 13:35 - 00001084 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-12-26 17:18 - 2016-07-25 21:32 - 00002923 _____ C:\Users\Public\Desktop\Nero 2015.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager Deinstallationsprogramm.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002000 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi.lnk
2016-12-26 17:18 - 2016-07-21 20:13 - 00001081 _____ C:\Users\Public\Desktop\XMedia Recode.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:07 - 00000970 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001394 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001325 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002497 _____ C:\Users\Denise\Desktop\Word 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002493 _____ C:\Users\Denise\Desktop\Excel 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002383 _____ C:\Users\Denise\Desktop\Outlook 2013.lnk
2016-12-26 17:17 - 2016-07-19 21:06 - 00001057 _____ C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-26 17:16 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\schemas
2016-12-26 17:15 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2016-12-26 15:55 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 15:12 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Drivers\etc
2016-12-26 15:12 - 2013-08-22 14:25 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts
2016-12-26 12:12 - 2016-07-19 22:35 - 00000000 ____D C:\Users\Denise\Documents\Outlook-Dateien
2016-12-26 12:11 - 2016-08-26 07:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2016-12-26 12:11 - 2016-07-25 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2016-12-26 12:11 - 2016-07-21 20:19 - 00000000 ____D C:\Maus
2016-12-26 08:47 - 2013-11-26 14:46 - 00000000 ___RD C:\Users\UpdatusUser\Desktop
2016-12-26 07:38 - 2016-11-25 17:17 - 00000000 ____D C:\Users\Denise\AppData\Roaming\ActivePresenter
2016-12-26 07:38 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise
2016-12-26 00:27 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\assembly
2016-12-26 00:26 - 2013-08-22 16:31 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-26 00:14 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\wbem
2016-12-26 00:08 - 2016-07-23 10:49 - 00000000 ____D C:\Program Files (x86)\Ravensburger tiptoi
2016-12-26 00:08 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\AppData\Local\Adobe_Systems_Incorporate
2016-12-26 00:08 - 2013-11-13 15:58 - 00000000 ____D C:\ProgramData\ashampoo
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Windows Defender
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-26 00:07 - 2016-08-13 15:42 - 00000000 ____D C:\Windows\system32\appraiser
2016-12-26 00:07 - 2016-07-26 07:43 - 00000000 ____D C:\Users\Denise\AppData\Roaming\XMedia Recode
2016-12-26 00:07 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager
2016-12-26 00:07 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 00:07 - 2013-11-15 17:10 - 00000000 ___HD C:\Windows\system32\WLANProfiles
2016-12-26 00:07 - 2013-09-20 10:35 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 __RSD C:\Windows\Media
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SystemResources
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Microsoft
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\CodeIntegrity
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-12-26 00:07 - 2013-08-22 16:33 - 00000000 ____D C:\Windows\system32\Drivers\UMDF
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\oobe
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\migration
2016-12-25 22:57 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Logs
2016-12-25 22:46 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\debug
2016-12-25 22:33 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Documents
2016-12-25 22:32 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Microsoft
2016-12-25 15:13 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2016-12-24 22:14 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Packages
2016-12-24 22:10 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\Documents\My Digital Editions
2016-12-23 21:24 - 2016-07-23 10:49 - 00000000 ____D C:\Users\Denise\AppData\Roaming\RavensburgerTipToi3
2016-12-23 21:23 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\RavensburgerTipToi3
2016-12-22 14:14 - 2016-07-19 21:46 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 08:33 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-12-20 08:32 - 2016-07-19 22:23 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-12-17 07:04 - 2013-11-13 16:04 - 00000000 ____D C:\ProgramData\install_clap
2016-12-17 07:04 - 2013-09-12 12:52 - 00000000 ____D C:\Windows\Panther
2016-12-16 13:32 - 2016-08-23 20:20 - 00217600 ___SH C:\Users\Denise\Desktop\Thumbs.db
2016-12-16 11:43 - 2013-11-13 15:56 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2016-12-15 09:47 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TMContainer00000000000000000001.regtrans-ms
2016-12-15 09:47 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TM.blf
2016-12-14 08:02 - 2016-07-23 14:30 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 08:00 - 2013-11-15 16:01 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 07:40 - 2016-07-19 21:16 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CD913E81-9733-4F87-B61C-593DA3D3B538}
2016-12-12 00:00 - 2016-11-10 07:59 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:00 - 2016-11-10 07:59 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-10 22:10 - 2016-07-19 21:05 - 00000000 ___SD C:\Users\Denise\AppData\Roaming\Microsoft
2016-12-09 23:40 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-09 15:35 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2016-11-25 16:39 - 2016-11-25 16:48 - 0003584 _____ () C:\Users\Denise\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-26 14:54 - 2013-11-26 14:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-13 16:08 - 2013-11-13 16:09 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-11-13 16:09 - 2013-11-13 16:10 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-11-13 16:04 - 2013-11-13 16:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-11-13 16:02 - 2013-11-13 16:02 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-11-13 16:07 - 2013-11-13 16:08 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-11-13 16:02 - 2013-11-13 16:04 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-11-13 16:06 - 2013-11-13 16:06 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log
Einige Dateien in TEMP:
====================
C:\Users\Denise\AppData\Local\Temp\AppLauncher.exe
C:\Users\Denise\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Denise\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Denise\AppData\Local\Temp\libeay32.dll
C:\Users\Denise\AppData\Local\Temp\msvcr120.dll
C:\Users\Denise\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Denise\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Denise\AppData\Local\Temp\sqlite3.dll
C:\Users\Denise\AppData\Local\Temp\TUUUninstallHelper.exe
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-01-04 07:56
==================== Ende von FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 07-01-2017
durchgeführt von Denise (07-01-2017 17:00:16)
Gestartet von C:\Users\Denise\Desktop\Trojanerboard
Windows 8.1 (Update) (X64) (2016-07-19 20:05:43)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3531133450-1765533330-4211851364-500 - Administrator - Disabled)
Denise (S-1-5-21-3531133450-1765533330-4211851364-1002 - Administrator - Enabled) => C:\Users\Denise
Gast (S-1-5-21-3531133450-1765533330-4211851364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3531133450-1765533330-4211851364-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3531133450-1765533330-4211851364-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.1 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Ashampoo Snap 2017 (HKLM-x32\...\{0A11EA01-F22C-84C3-9723-53CA58DB6F9C}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
calibre (HKLM-x32\...\{F6BB454A-E737-4A1C-A5D4-0E2834E24905}) (Version: 2.62.0 - Kovid Goyal)
ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version: - DownloadHelper)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4885.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0 - Mozilla)
Nero 2015 (HKLM-x32\...\{847D6818-3BA4-4F41-B5B7-4505D8E012B7}) (Version: 16.0.01300 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1002 - Nero AG)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
tiptoi® Manager 3.1.6 (HKLM-x32\...\9978-5763-2995-5228) (Version: 3.1.6 - Ravensburger AG)
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
XMedia Recode Version 3.3.3.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.3.3 - XMedia Recode)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0C353ECE-7C42-4EDF-9E78-7F60D3E609D4} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-05-20] (Nero AG)
Task: {6DD7B98D-691E-4C99-A942-BB379DBA5CD9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {98209A60-AC79-456E-8CFB-EA8D24C38CDD} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-19] (Synaptics Incorporated)
Task: {AE3A986E-65D2-4E77-82E1-2D9546986C36} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {BCEDF6AA-DC6E-47EE-A7A8-CAC36707ADC2} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {E0948293-2279-4D6B-8E77-F3AA3CA9A980} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {E1189ACB-8FE2-4F21-B9A3-00274A542B91} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {E7A91B92-EF72-4400-A58F-7BA85A14B0CB} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {FEA5CC20-2042-4BC8-A122-F29B40BF89BC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\Denise\AppData\Local\Microsoft\Windows\ConnectedSearch\History\site_1691182358_de-de.lnk -> hxxp://www.windowssearch.com:80/suggestions?qry=spotify&cc=DE&setlang=de-DE&inlang=de-DE&adlt=moderate&scale=100&contrast=none&hw=768%2C1366&CVID=7075BBFFD9B4452CA755DE3838E3C42
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2013-11-20 15:17 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-07-26 06:27 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-11-20 15:17 - 2013-09-02 16:15 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-11-20 15:17 - 2010-12-17 15:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2013-11-20 15:17 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-11-20 15:17 - 2013-07-18 16:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2013-11-15 16:39 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-11-20 15:17 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-11-20 15:17 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2016-12-16 07:56 - 2016-11-11 21:36 - 00035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00123856 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-12-22 14:12 - 2016-11-11 21:37 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-12-16 07:56 - 2016-11-11 21:38 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00021312 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-12-22 14:12 - 2016-11-11 21:38 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00025424 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00246592 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00241104 _____ () C:\Program Files (x86)\Dropbox\Client\_jpegtran.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-12-22 14:12 - 2016-11-11 21:35 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-12-22 14:12 - 2016-12-21 19:26 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01972528 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00133424 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00224056 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020288 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32._winffi_user32.pyd
2016-12-22 14:12 - 2016-11-11 21:42 - 00017864 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll
2016-12-22 14:12 - 2016-11-11 21:42 - 01631184 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00042808 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00171320 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7922 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7922 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123simsen.com -> www.123simsen.com
Da befinden sich 7922 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123simsen.com -> www.123simsen.com
Da befinden sich 7922 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123simsen.com -> www.123simsen.com
Da befinden sich 7922 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2016-12-26 15:12 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 clients2.google.com
127.0.0.1 v1.ff.avast.com
127.0.0.1 vlcproxy.ff.avast.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
Da befinden sich 15582 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Denise\Pictures\Fotos 2016\Kalender\10\20161001_113903.jpg
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Denise\Pictures\Fotos 2016\Kalender\10\20161001_113903.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\StartupFolder: => "MCtlSvc.lnk"
HKLM\...\StartupApproved\StartupFolder: => "NeroDesktopSwitcher.scf"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "Nvtmru"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{C6681879-51CB-4FD8-9A84-483DBB792DD9}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BF03DCCD-DD4D-400A-83DE-6EBD26343BBF}] => LPort=2869
FirewallRules: [{DF5F9400-8B73-4381-B95F-52AF8036BC90}] => LPort=1900
FirewallRules: [{6AE7B4B4-D8EC-4095-9EDE-1D0407493CB4}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{77936D80-6A89-494F-A543-3C0D774614C7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{8C8323B7-A320-497D-AA70-C0FD492FAAC6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{7C57A8A5-6887-4930-B692-5BDA66AD2CE3}] => C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{BC1581EF-EB52-4DB3-806D-6AB1A096F9F0}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B090FAC3-34CA-4D99-8374-176423707E40}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{BD8567CD-18AF-4F3B-9890-47FAD209DC7A}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AD3D86C8-9D08-4282-B600-06D66D58F91E}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{B1D6920A-FDB1-460D-8785-F074E9A97829}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5C60FF39-F4AA-45AB-8D65-47390638EE55}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{97D0BC8D-D025-4BD4-B9AB-97DA6D31A164}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{571B4EB1-F5A3-479F-B707-957C19186B6D}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C8EB4CB1-D30F-4E62-A13B-8B9D04B9CB27}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{ECDACF61-2598-47B3-9446-18AF27FA44EA}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{AF658A1F-622E-4246-9E9F-4386AA84635B}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{F1F82B8E-47E1-4734-B764-1BE0D30FF586}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{FB3533A3-2370-4DFE-83B1-5AA7E5DCC5D6}] => C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{896FE7D5-BB83-4ADA-BAE8-190C9C93425A}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [{590C04BB-BEBC-4F39-A26E-CA240E6AEABB}] => C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{9226EE8C-D70E-46CB-86C6-FEF3B19528C5}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{5AE195CA-2F53-41A0-9EE8-7EFE42A428B2}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{4393D29C-BCFA-4D99-BDFB-D052C7BABC30}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{E6BD649F-7312-477E-B04C-F531D47FFFE9}] => C:\Windows\system32\rundll32.exe
FirewallRules: [{DDE35257-478B-4C15-830C-F3BCA8B62E5F}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{16749CA5-9553-44D1-976F-2CA2CD95A67B}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{434BD66E-2F89-474B-A37A-C056D1C7F5CA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DBC6CABE-2B06-434E-B577-9497E53E549C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3B7F349-F50C-4684-939B-1D3CACE158F2}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{DEC7CDB3-D197-4AC7-955C-EC896BD4D87A}] => C:\Windows\System32\rundll32.exe
==================== Wiederherstellungspunkte =========================
05-01-2017 13:38:00 AA11
05-01-2017 14:32:06 Malwarebytes Anti-Rootkit Restore Point
05-01-2017 21:23:16 JRT Pre-Junkware Removal
07-01-2017 16:57:26 TuneUp Utilities 2014 wird entfernt
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (01/07/2017 08:18:10 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "c:\users\denise\downloads\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (01/06/2017 10:34:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WOMBAT)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/06/2017 10:34:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WOMBAT)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/06/2017 06:51:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (01/06/2017 06:50:50 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (01/06/2017 06:49:57 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Microsoft Office 15\root\office15\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (01/06/2017 06:49:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "c:\program files (x86)\eset\eset online scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (01/06/2017 03:34:44 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Error: (01/06/2017 03:33:05 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Microsoft Office 15\root\office15\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (01/06/2017 03:33:02 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
Systemfehler:
=============
Error: (01/07/2017 04:14:09 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/07/2017 04:13:39 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/07/2017 03:43:19 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/07/2017 03:42:49 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/06/2017 10:34:08 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.4" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/06/2017 10:34:08 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.1" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (01/06/2017 03:32:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (01/06/2017 03:32:52 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Denise\AppData\Local\Temp\ehdrv.sys
Error: (01/06/2017 03:32:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (01/06/2017 03:32:51 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Denise\AppData\Local\Temp\ehdrv.sys
CodeIntegrity:
===================================
Date: 2017-01-04 20:43:31.246
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-12-26 17:22:16.672
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-12-26 16:34:58.481
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-12-26 16:13:53.405
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-12-26 16:12:21.560
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-12-25 22:41:42.989
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-25 22:41:42.739
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-25 22:41:42.489
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-25 22:41:41.942
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-12-25 22:41:41.692
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 34%
Installierter physikalischer RAM: 8100.68 MB
Verfügbarer physikalischer RAM: 5274.67 MB
Summe virtueller Speicher: 9380.68 MB
Verfügbarer virtueller Speicher: 6192.41 MB
==================== Laufwerke ================================
Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:437.79 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:42.06 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F2E9FFFD)
Partition: GPT.
==================== Ende von Addition.txt ============================
Und wie geht es nun weiter oder sind wir fertig? :glaskugel: |
