Powerwalk | 11.09.2017 16:09 | Code:
Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-09-2017
durchgeführt von Powerwalk (10-09-2017 18:24:01) Run:2
Gestartet von C:\Users\Powerwalk\Desktop
Geladene Profile: Powerwalk & DefaultAppPool (Verfügbare Profile: Powerwalk & DefaultAppPool)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
CloseProcesses:
C:\Users\Powerwalk\Downloads\DriverToolkitInstaller.exe
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\67ad14cd_0
DeleteKey: HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files (x86)\iLivid
DeleteKey: HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\iLivid
EmptyTemp:
*****************
Prozesse erfolgreich geschlossen.
C:\Users\Powerwalk\Downloads\DriverToolkitInstaller.exe => erfolgreich verschoben
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\67ad14cd_0 => Schlüssel erfolgreich entfernt
HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files (x86)\iLivid => Schlüssel erfolgreich entfernt
HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\iLivid => Schlüssel erfolgreich entfernt
=========== EmptyTemp: ==========
BITS transfer queue => 9199616 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 9615682 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => -20049 B
Edge => 0 B
Chrome => 61314902 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 818 B
NetworkService => 0 B
Powerwalk => 41769514 B
DefaultAppPool => 0 B
RecycleBin => 121671 B
EmptyTemp: => 116.4 MB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 18:26:29 ==== Code:
Code:
HitmanPro 3.7.20.286
www.hitmanpro.com
Computer name . . . . : POWERWALK-PC
Windows . . . . . . . : 10.0.0.15063.X64/2
User name . . . . . . : Powerwalk-PC\Powerwalk
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2017-09-10 18:52:14
Scan mode . . . . . . : Normal
Scan duration . . . . : 36m 39s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 19
Objects scanned . . . : 2.462.832
Files scanned . . . . : 113.939
Remnants scanned . . : 724.696 files / 1.624.197 keys
Suspicious files ____________________________________________________________
C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\Downloads\FRST64.exe
Size . . . . . . . : 2.395.648 bytes
Age . . . . . . . : 4.0 days (2017-09-06 18:03:53)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 3A0DD3CC5A3AF8F77E2DFE27765BFC712CEF4536CCC3C6B27A9C5A790A3CAE0B
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
Forensic Cluster
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\Downloads\
-0.6s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\Downloads\Addition.txt
-0.2s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\Downloads\FRST.txt
0.0s C:\Users\Powerwalk\AppData\Local\Microsoft\Windows\FileHistory\Data\1982\C\Users\Powerwalk\Downloads\FRST64.exe
C:\Users\Powerwalk\Desktop\FRST-OlderVersion\FRST64.exe
Size . . . . . . . : 2.395.648 bytes
Age . . . . . . . : 4.1 days (2017-09-06 17:29:48)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 3A0DD3CC5A3AF8F77E2DFE27765BFC712CEF4536CCC3C6B27A9C5A790A3CAE0B
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
C:\Users\Powerwalk\Desktop\FRST64.exe
Size . . . . . . . : 2.396.160 bytes
Age . . . . . . . : 0.0 days (2017-09-10 18:22:53)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 50CD666732FB9573284BE3C2D578434AB57AC2DDB5CB4CA066E87A51467944C4
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
Forensic Cluster
0.0s C:\Users\Powerwalk\Desktop\FRST64.exe
1.3s C:\Users\Powerwalk\Desktop\FRST-OlderVersion\
Potential Unwanted Programs _________________________________________________
HKLM\SOFTWARE\Classes\driverscanner\ (DriverScanner)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DA5BD2D3CA2D6943A1A233CD3F88CE7\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC9EFC5C3366B4DB850DAB49330C52\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E98451C7CA808F47AFE467BDABD02FA\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BFD11FD45FC7B9E46A8F4B69F3A66E35\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D5979AD63CA2D6943A1A233CD3F88CE7\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF9BD2952384A9C49B4A5D3D95329890\ (GiantSavings)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FABA2A33488410A4AA40489BD2224282\ (GiantSavings)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Internet Explorer\AboutURLs\Tabs (CertifiedToolbar)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{2EECD738-5844-4A99-B4B6-146BF802613B} (Claro)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079a25-328f-4bd4-be04-00955acaa0a7},\ (SearchQU)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4f12-8568-69135F087DB0},\ (SearchQU)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\AskTB5.6 (AskBar)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\Mobogenie\ (Rocketfuel)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QSqlDriverFactoryInterface:\C:\Program Files (x86)\Mobogenie\ (Rocketfuel)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files (x86)\Mobogenie\ (Rocketfuel)
Code:
C:\AdwCleaner\Quarantine\files\takskpnnsuxlnzlcsrvcolvylrtsfuda\1.11_0\BUSolution.dll Variante von Win32/Toolbar.Babylon.P eventuell unerwünschte Anwendung
C:\Program Files (x86)\AudioConverter\AudioConverter.exe Variante von Win32/SweetIM.B eventuell unerwünschte Anwendung
C:\Program Files (x86)\AudioConverter\Uninstall\__Uninstall_.exe Variante von Win32/InstallCore.MB eventuell unerwünschte Anwendung
C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_19438\blabbers-ch.crx Win32/BrowserCompanion.G eventuell unerwünschte Anwendung
C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_19438\CRX_INSTALL\witmain.js Win32/BrowserCompanion.G eventuell unerwünschte Anwendung
C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_9110\DealPly.crx Win32/DealPly.J eventuell unerwünschte Anwendung
C:\Users\Powerwalk\Documents\Moz Backup\Firefox 22.0 (de) - 2013-07-08.pcv JS/Toolbar.Crossrider.AS eventuell unerwünschte Anwendung,JS/Toolbar.Crossrider.G eventuell unerwünschte Anwendung,ist OK
C:\Users\Powerwalk\Documents\Moz Backup\Firefox 5.0 (de) - 2011-07-18.pcv Win32/Toolbar.Conduit.AT eventuell unerwünschte Anwendung
C:\Users\Powerwalk\Documents\Moz Backup\Firefox 7.0.1 (de) - 2011-10-25.pcv Win32/Toolbar.Conduit eventuell unerwünschte Anwendung,Win32/Toolbar.Conduit.AT eventuell unerwünschte Anwendung
C:\Users\Powerwalk\Documents\Moz Backup\Firefox 9.0.1 (de) - 2012-01-09.pcv Win32/Toolbar.Conduit eventuell unerwünschte Anwendung,Win32/Toolbar.Conduit.AT eventuell unerwünschte Anwendung
C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll Variante von Win32/Toolbar.Linkury.G eventuell unerwünschte Anwendung
C:\Windows\assembly\GAC_32\System.Data.SQLite\1.0.66.0__db937bc2d44ff139\System.Data.SQLite.dll Variante von MSIL/Toolbar.Linkury.BM eventuell unerwünschte Anwendung
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll Variante von Win32/Toolbar.Linkury.G eventuell unerwünschte Anwendung
C:\Windows\Installer\70352a.msi Variante von Win32/Toolbar.Babylon.Q eventuell unerwünschte Anwendung,Variante von Win32/Toolbar.Babylon.P eventuell unerwünschte Anwendung
Autostart-Speicherorte Variante von Win32/SweetIM.B eventuell unerwünschte Anwendung Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-09-2017
durchgeführt von Powerwalk (11-09-2017 16:39:06)
Gestartet von C:\Users\Powerwalk\Desktop
Windows 10 Home Version 1703 (X64) (2017-05-16 01:54:13)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2978788035-3705852035-3635699130-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2978788035-3705852035-3635699130-503 - Limited - Disabled)
Gast (S-1-5-21-2978788035-3705852035-3635699130-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2978788035-3705852035-3635699130-1006 - Limited - Enabled)
Powerwalk (S-1-5-21-2978788035-3705852035-3635699130-1000 - Administrator - Enabled) => C:\Users\Powerwalk
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Kaspersky Internet Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Kaspersky Internet Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.04 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 26 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Adobe Flash Player 26 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.9.199 - Adobe Systems, Inc.)
Alcor Micro USB Card Reader (HKLM-x32\...\{331C520E-D8C3-4AB9-ADF7-A666A3561922}) (Version: 1.3.17.25001 - Alcor Micro Corp.) Hidden
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{331C520E-D8C3-4AB9-ADF7-A666A3561922}) (Version: 1.3.17.25001 - Alcor Micro Corp.)
AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)
ASUS AI Recovery (HKLM-x32\...\{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}) (Version: 1.0.6 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.20 - ASUS)
ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS)
ASUS MultiFrame (HKLM-x32\...\{9D48531D-2135-49FC-BC29-ACCDA5396A76}) (Version: 1.0.0019 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}) (Version: 1.1.22 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0007 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.19 - asus)
ATK Generic Function Service (HKLM-x32\...\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}) (Version: 1.00.0008 - ATK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0040 - ASUS)
Audio Converter (HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Audio Converter) (Version: - )
Audio Converter Packages (HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Audio Converter Packages) (Version: - ) <==== ACHTUNG
Brother Product Research and Support Program (HKLM-x32\...\{8040527F-DD74-4B45-8A06-C4BF145B6C76}) (Version: 2.1.2.0001 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.33 - Piriform)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Dropbox) (Version: 34.4.20 - Dropbox, Inc.)
Easy RM to MP3 Converter 2.7.3.700 2006.09.29 (HKLM-x32\...\Easy RM to MP3 Converter_is1) (Version: - Mini-stream Software, Inc.)
ELAN Touchpad 15.9.6.1_X64_WHQL (HKLM\...\Elantech) (Version: 15.9.6.1 - ELAN Microelectronic Corp.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.2.17437 - Landesfinanzdirektion Thüringen)
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.2 - ASUS)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FreeFileSync 9.1 (HKLM-x32\...\FreeFileSync_is1) (Version: 9.1 - www.FreeFileSync.org)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.79 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{ECF2E224-42F5-4E50-B58E-94CA70E85697}) (Version: 7.3.0.3832 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
Internet-TV für Windows Media Center (HKLM-x32\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 4.2.2.0 - Microsoft Corporation)
Java 8 Update 144 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Java 8 Update 144 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (HKLM-x32\...\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\{E27B1D7B-3B34-43A2-9FC0-9828D5DF46E2}) (Version: 17.0.0.611 - Kaspersky Lab) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{E27B1D7B-3B34-43A2-9FC0-9828D5DF46E2}) (Version: 17.0.0.611 - Kaspersky Lab)
KeePass Password Safe 1.33 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.33 - Dominik Reichl)
Malwarebytes Version 3.2.2.2018 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2018 - Malwarebytes)
MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\OneDriveSetup.exe) (Version: 17.3.6966.0824 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 55.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 55.0.3 (x86 de)) (Version: 55.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.3 - Mozilla)
Mozilla Thunderbird 52.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.3.0 (x86 de)) (Version: 52.3.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Net4Switch (HKLM-x32\...\{9D6D7811-43B3-463C-BC79-5D1755269989}) (Version: 1.00.0019 - ASUS)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.8.0.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.8.0.89 - NVIDIA Corporation)
NVIDIA Grafiktreiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.3 (HKLM-x32\...\{8D5FCC56-BB9F-4122-923C-71753F50F6F5}) (Version: 4.13.9783 - Apache Software Foundation)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.3.0 - Prolific Technology INC)
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6392 - Realtek Semiconductor Corp.)
Samsung Kies3 (HKLM-x32\...\{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16084.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16084.2 - Samsung Electronics Co., Ltd.)
Samsung Link 1.8.0.1401171024 (HKLM\...\8474-7877-9059-0204) (Version: 1.8.0.1401171024 - Copyright 2013 SAMSUNG)
Samsung Story Album Viewer (HKLM-x32\...\{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.61.0 - Samsung Electronics Co., Ltd.)
Scansoft PDF Professional (HKLM-x32\...\{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}) (Version: - ) Hidden
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Smart View (HKLM-x32\...\{E4C4D089-BC03-4A08-9FD1-4E8ACE795C9B}) (Version: 1.0.0.0 - Samsung )
swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17387 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Center Add-in for Silverlight (HKLM-x32\...\{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}) (Version: 4.7.3.0 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.14 - ASUS)
WISO steuer:Start 2015 (HKLM-x32\...\{1F3E72C5-B8FC-4F28-A0F6-AB1A179B138F}) (Version: 22.00.8811 - Buhl Data Service GmbH)
WISO steuer:Start 2016 (HKLM-x32\...\{A8EDF4A5-ED7A-45AA-97CC-FAFC960FFB62}) (Version: 23.00.1146 - Buhl Data Service GmbH)
WISO steuer:Start 2017 (HKLM-x32\...\{39A1993A-5845-450E-A6F7-903BB4676160}) (Version: 24.00.1375 - Buhl Data Service GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [Kaspersky Anti-Virus 17.0.0] -> {39C9FA89-7012-4573-A92D-BFD1F8CA542D} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\shellex.dll [2017-03-13] (AO Kaspersky Lab)
ContextMenuHandlers2: [Kaspersky Anti-Virus 17.0.0] -> {39C9FA89-7012-4573-A92D-BFD1F8CA542D} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\shellex.dll [2017-03-13] (AO Kaspersky Lab)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-21] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [Kaspersky Anti-Virus 17.0.0] -> {39C9FA89-7012-4573-A92D-BFD1F8CA542D} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\shellex.dll [2017-03-13] (AO Kaspersky Lab)
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> Keine Datei
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2016-11-14] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [Kaspersky Anti-Virus 17.0.0] -> {39C9FA89-7012-4573-A92D-BFD1F8CA542D} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\shellex.dll [2017-03-13] (AO Kaspersky Lab)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-21] (Malwarebytes)
ContextMenuHandlers1_S-1-5-21-2978788035-3705852035-3635699130-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ContextMenuHandlers4_S-1-5-21-2978788035-3705852035-3635699130-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
ContextMenuHandlers5_S-1-5-21-2978788035-3705852035-3635699130-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-09-06] (Dropbox, Inc.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {01C995FF-D178-4E7B-AC4A-9E950006A207} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {06098BC9-BA88-4CC4-89E5-9D3511032D62} - System32\Tasks\WC3 => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2009-11-12] ()
Task: {0837D897-84CB-4E30-A8DD-807937A81DFC} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {0AC82F2D-401D-4E1D-8971-93E41BB11296} - System32\Tasks\{16DD6A08-C65C-4982-8B6B-559560F22969} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageLauncher.exe" -d "C:\Program Files (x86)\Acronis\TrueImageHome\"
Task: {0F1FC558-90E6-41AA-8D37-4FBE69053762} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {148318FC-5974-4508-A415-B3AFD16E5DDB} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {1602B2B1-A4C5-48F5-A750-A0A4E49A361B} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {1E0BB009-8E39-42A0-83B9-952C56A527D4} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-05-18] (ASUS)
Task: {201606D1-4C47-4C59-B1D6-D06BFC55EA11} - System32\Tasks\{6456C6BF-23CC-4A6D-9ECD-2E5B3DD33B77} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/7.2.0.103/de/abandoninstall?page=tsProgressBar
Task: {29308477-8F7E-4D4F-92D5-F1534E61B6F5} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {34E53757-0410-41F5-AAD5-E7D6A5C1E8AF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {3AF41610-1F12-4BFA-A4D1-4DFD79FE3C90} - System32\Tasks\P4GIntlCtrl => C:\Program Files\P4G\IntlCtrl.exe [2009-08-11] (TODO: <Company name>)
Task: {3B45ECF0-8D41-4A46-A54F-BF8C205335EC} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {3C9616B2-742C-4820-AFAE-F3D2459E9677} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {3D966D87-5FE5-4FBC-8E90-DB0F48E454DB} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {3E3E65EA-6693-4ACC-947D-206853F50D65} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {405AAF8D-7B9C-4A33-8050-7B85E40BD352} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-07-26] (NVIDIA Corporation)
Task: {42145BE5-4059-431F-919A-1A381C5966DE} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {45B7C4E1-5232-406B-B120-F3BC71D161B2} - System32\Tasks\{5B0F67CD-1F24-4C98-9EE7-16385AE028F2} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.29.80.102/de/go/help.faq.installer?LastError=1603
Task: {49DA8963-CA43-48FB-B2D2-CEF3A9423353} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {503997EF-06F5-422A-BEAD-2C551E14EDEF} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-07-26] (NVIDIA Corporation)
Task: {6CA8D54C-DA73-4B8F-B05D-4625EB61EE9A} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_26_0_0_151_pepper.exe [2017-08-10] (Adobe Systems Incorporated)
Task: {6FECF9BE-AED8-4627-80ED-91FF5361960F} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {720B1A33-801D-472F-8C74-2329BB854312} - System32\Tasks\{4FF41C7F-C0BE-4721-BBC8-5263918F26B9} => C:\Windows\system32\pcalua.exe -a C:\Users\Powerwalk\Desktop\HiJackThis204.exe -d C:\Users\Powerwalk\Desktop
Task: {773492A6-4F08-4DAF-9C1B-778BC17ACAED} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {78588675-6CF3-4E50-B5B1-1EC34EAA2F6B} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {7A55C0D9-74E5-4E42-9C4B-92E84B26CF09} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-08-23] (Adobe Systems Incorporated)
Task: {7DDF9673-8D0B-4652-B795-1BEAD1206B65} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {81BA9853-25CD-4E6B-B78F-A0B3F37D46AF} - System32\Tasks\{F371C98D-7010-4793-AA16-9D71449DD42D} => C:\Windows\system32\pcalua.exe -a C:\Users\Powerwalk\Downloads\Touchpad_Elantech_WIN7_64_7057\setup.exe -d C:\Users\Powerwalk\Downloads\Touchpad_Elantech_WIN7_64_7057
Task: {83A75991-7888-4C89-81E4-A0E6826EFBA5} - System32\Tasks\{6EB38DFD-0C84-4180-9C6B-BCB8FFF31928} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.29.80.102/de/go/help.faq.installer?LastError=1603
Task: {892A943A-1506-46BC-A62C-1362D00EAC8F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-08-03] (Piriform Ltd)
Task: {8AA5066F-35A2-4B37-B0B3-B0C94B1BF578} - System32\Tasks\{8E1012B2-E251-4F31-A8C8-0A78D9B4181F} => C:\Windows\system32\pcalua.exe -a C:\Users\Powerwalk\Downloads\epson30796eu.exe -d C:\Users\Powerwalk\Downloads
Task: {8E7E0B50-F880-4209-9F60-FDF4D03AD691} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-07-26] (NVIDIA Corporation)
Task: {984E47C9-2823-41C5-BC1D-729481171807} - System32\Tasks\{97CD4A47-40CF-4E6C-93DE-EFA41AA1899F} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.29.80.102/de/go/help.faq.installer?LastError=1603
Task: {A036C412-3C7D-4CE3-A1B6-B6B563B203E8} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-07-26] (NVIDIA Corporation)
Task: {A9AF698B-8E83-42A9-B709-FC908FE1C5B0} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {A9B22B55-BCE0-4DEB-ABE4-7FC6C42272D9} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2978788035-3705852035-3635699130-1000Core1d2376afd007e86 => C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {AA7803EC-108C-4B85-869B-9BCB65E2390E} - System32\Tasks\Powerwalk => C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe
Task: {AA921623-B84A-4EC8-A6DA-5D46323FC6D9} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {AAA485E4-BA27-4EB5-8B3D-D9D209E14987} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-07-26] (NVIDIA Corporation)
Task: {AF911A00-B2A8-4B4F-8774-DB06208EA4D4} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {B1E2D903-C5F3-4CE7-A38D-3C92E8E4B4AD} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2009-08-28] (ATK)
Task: {C3C5773A-0CE4-4125-8CD8-16669486004F} - System32\Tasks\{DE7BCFE8-D751-4225-862C-245ABB6CA852} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/7.2.0.103/de/go/help.faq.installer?LastError=1601
Task: {C778374C-94FE-41B0-B705-5FC952201AC0} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {CCEC342E-766E-453E-AC27-449270A65140} - System32\Tasks\Powerwalk Local Autobackup => C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe
Task: {D1EF6ECC-5B94-446B-A84F-468D8DA059E6} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-07-26] (NVIDIA Corporation)
Task: {D2BD0ACD-2B0E-4FEF-86D6-F67FBCD7B63A} - System32\Tasks\P4G Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {D8AE1661-01DD-4817-9F65-090886AF5575} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {D8CD6025-61CE-4C70-A0AE-C6D600B1700D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {DD548504-31EE-43FF-A573-1E9BCB56DC76} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {E5F845F5-EEB5-4100-AEDB-8FBC510AAF0A} - System32\Tasks\Net4Switch => C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe [2007-11-20] (ASUS)
Task: {E959E007-A71C-4952-8EA8-22DE146D6227} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {EA1E9421-DEA1-4AC9-A0A0-89BDC38A69FD} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-07-26] (NVIDIA Corporation)
Task: {EDA72619-5422-40D4-8754-AE19F8A3D54C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {F0496437-71B1-4E96-9E9C-3BC2F52CDE46} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {F9907F19-85AE-495B-B049-AD567D7A4377} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2978788035-3705852035-3635699130-1000UA1d2376afd2dcb6c => C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {F9F635D2-C556-4310-BD98-6484FBFB8847} - System32\Tasks\{1A9A2572-B1A7-4F23-8C03-9FE405545557} => C:\WINDOWS\system32\pcalua.exe -a E:\paperport\PP12Installer.exe -d E:\paperport
Task: {FACB8164-0888-403B-B4E6-7F59329EA90F} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FBC8485F-A585-489F-8E2C-C65FEABC1BEF} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {FCD5CAAC-285E-4846-BDAF-6A70A39EAE4A} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-07-26] (NVIDIA Corporation)
Task: {FFEE4F98-789F-4BC5-9EBF-91D4AC658C46} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2978788035-3705852035-3635699130-1000Core1d2376afd007e86.job => C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2978788035-3705852035-3635699130-1000UA1d2376afd2dcb6c.job => C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}.job => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2017-02-12 15:46 - 2017-07-26 19:09 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-09-07 18:13 - 2017-08-24 11:27 - 002264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2009-11-12 10:10 - 2009-11-12 10:10 - 001597440 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
2017-03-18 22:58 - 2017-03-18 22:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2009-08-28 15:00 - 2009-08-28 15:00 - 000041984 _____ () C:\Program Files\P4G\DevMng.dll
2009-08-28 11:43 - 2009-08-28 11:43 - 000029184 _____ () C:\Program Files\P4G\OvrClk.dll
2011-06-29 17:18 - 2007-11-30 11:20 - 000051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
2017-03-18 22:59 - 2017-03-20 06:36 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-09-06 19:14 - 2017-09-04 10:12 - 002692440 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\swiftshader\libglesv2.dll
2017-09-06 19:14 - 2017-09-04 10:12 - 000138584 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\swiftshader\libegl.dll
2017-05-23 19:23 - 2017-05-23 19:23 - 003139496 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11707.1001.23.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2017-08-25 17:49 - 2017-08-25 17:50 - 010600960 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11707.1001.23.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2017-08-25 17:49 - 2017-08-25 17:50 - 002640896 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11707.1001.23.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common.Mobile.dll
2016-06-28 00:19 - 2016-06-28 00:19 - 000865232 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\kpcengine.2.3.dll
2011-06-29 19:10 - 2007-07-27 15:10 - 000049152 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ResItf.dll
2011-06-29 19:10 - 2009-07-03 13:04 - 000084992 _____ () C:\Program Files (x86)\ASUS\Net4Switch\cxcmrt.dll
2011-06-29 19:10 - 2009-07-03 13:13 - 000074752 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswobj.dll
2011-06-29 19:10 - 2009-07-01 16:46 - 000461824 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswresmgr.dll
2011-06-29 19:10 - 2009-07-03 13:12 - 000049152 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswhlp.dll
2011-06-29 19:10 - 2009-07-08 11:24 - 000167424 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipsw_cfgmgr.dll
2011-06-29 19:10 - 2009-07-03 13:12 - 000089088 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswds.dll
2011-06-29 19:10 - 2009-07-03 13:12 - 000065024 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswgblset.dll
2011-06-29 19:10 - 2009-07-03 13:40 - 000085504 _____ () C:\Program Files (x86)\ASUS\Net4Switch\LogonStartup.dll
2011-06-29 19:10 - 2009-07-09 17:41 - 000222720 ____N () C:\Program Files (x86)\ASUS\Net4Switch\ipswsysmon.dll
2011-06-29 19:10 - 2009-07-03 13:21 - 000042496 _____ () C:\Program Files (x86)\ASUS\Net4Switch\iphelper.dll
2011-06-29 19:10 - 2009-07-03 13:11 - 000267264 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswcore.dll
2011-06-29 19:10 - 2009-07-03 13:13 - 000297984 _____ () C:\Program Files (x86)\ASUS\Net4Switch\ipswui.dll
2017-02-12 15:46 - 2017-07-26 19:09 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2017-08-11 15:54 - 000000834 _____ C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Control Panel\Desktop\\Wallpaper -> c:\users\public\pictures\pictures\myspace & metal\grafiken & gimmiks\bc31e0780614fd68de852962dc67d402_full.jpg
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 80.69.96.12 - 81.210.129.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AFBAgent => 2
MSCONFIG\Services: AllShare Framework DMS => 2
MSCONFIG\Services: ASLDRService => 2
MSCONFIG\Services: ATKGFNEXSrv => 2
MSCONFIG\Services: EPSON_PM_RPCV4_01 => 3
MSCONFIG\Services: ETDService => 3
MSCONFIG\Services: gupdate => 3
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: klvssbrigde64 => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NvContainerLocalSystem => 2
MSCONFIG\Services: NvContainerNetworkService => 3
MSCONFIG\Services: nvsvc => 3
MSCONFIG\Services: NvTelemetryContainer => 2
MSCONFIG\Services: PDFProFiltSrvPP => 3
MSCONFIG\Services: Samsung Link Service => 2
MSCONFIG\Services: ss_conn_service => 3
MSCONFIG\Services: Stereo Service => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Powerwalk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
MSCONFIG\startupreg: ATKMEDIA => C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
MSCONFIG\startupreg: ATKOSD2 => C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: ETDCtrl => %ProgramFiles%\Elantech\ETDCtrl.exe
MSCONFIG\startupreg: ETDWare => C:\Program Files\Elantech\ETDCtrl.exe
MSCONFIG\startupreg: fssui => "C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe" -autorun
MSCONFIG\startupreg: HControlUser => C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: KeePass Password Safe => "C:\Program Files (x86)\KeePass Password Safe\KeePass.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesHelper => C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPDLR.exe => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SMASH => "C:\Program Files (x86)\Ashampoo\Ashampoo Office 2010\smash.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\...\StartupApproved\StartupFolder: => "McAfee Security Scan Plus.lnk"
HKLM\...\StartupApproved\Run: => "RtHDVCpl"
HKLM\...\StartupApproved\Run: => "AmIcoSinglun64"
HKLM\...\StartupApproved\Run: => "Samsung Link"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "PPort12reminder"
HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"
HKLM\...\StartupApproved\Run32: => "PDFHook"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\Run: => "Dropbox Update"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\Run: => "Kies3PDLR.exe"
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\StartupApproved\Run: => "Uninstall C:\Users\Powerwalk\AppData\Local\Microsoft\OneDrive\17.3.5892.0626_1\amd64"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{4433D4E5-4B9D-4E73-A030-42454B05E469}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{AB3C873A-7965-4300-81EB-AD84308B57BD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{48F659A5-B902-48CA-BBC9-F1C4075546C5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{2EF66158-EADE-495C-90B2-EE8587DC5138}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{0DF1721F-9658-4C3C-AB67-FD25D3EE74DF}] => (Allow) LPort=54925
FirewallRules: [{C819A6D8-8456-40A4-B3C4-B342952A621A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{22641DC7-8901-4902-BD4E-16A5E13F70A3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{548F3361-F60B-4F6D-867F-0AAB33083FD4}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{230C53AD-019E-49CC-81E0-5AFD919B5791}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [TCP Query User{77957C1A-6D9D-4033-A94B-1DF03082B4DD}C:\users\powerwalk\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\powerwalk\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B9D6BE51-C40F-4D48-BC35-37A9EBDE51FB}C:\users\powerwalk\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\powerwalk\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{66ABB200-6848-46B5-8109-1FDD7F6AEF23}] => (Allow) C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{D6E160A5-49CE-4A0B-99FC-EFCBC70B0C61}] => (Allow) C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{723D6D9E-5DC5-4981-B29F-09C30D273E70}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AAA109A9-65FB-477E-B8BF-ABF7216F6BF6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C9E6A5AB-CBB3-4ACD-B099-0675C2578B6E}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{243C96A2-A76E-4FA0-95D5-BAA1499883AA}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{839EB8A3-49FD-4740-B288-F6CB59A3EE25}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{D432C48D-AC47-4177-80D8-B297D0DB9AD3}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{6FC96B8F-AD8B-4BF4-9F9A-C2E964A3F2C8}] => (Allow) LPort=8743
FirewallRules: [{10DA6345-EA4D-47CA-B325-1F631EBB8F82}] => (Allow) LPort=8643
FirewallRules: [{C2CD2B2B-FCB8-4BEC-8EAA-13D46E645A56}] => (Allow) LPort=7676
FirewallRules: [{4E3FF4B5-05BE-48A2-AF9F-326B82383339}] => (Allow) LPort=7679
FirewallRules: [{1DDCE149-163E-4BBC-A626-512FAC406512}] => (Allow) LPort=24234
FirewallRules: [{9D5E0E95-6441-4EB4-A24A-028537522AE0}] => (Allow) LPort=7900
FirewallRules: [{471441A1-F7A2-4F8A-A81E-3216B2479906}] => (Allow) LPort=1900
FirewallRules: [{197661A0-29E8-4F42-99CD-2539AF3E095E}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
FirewallRules: [{E904AAE3-B8FD-4E84-8A07-D81B3B586F05}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
FirewallRules: [{3A1EF19C-709C-43B6-A86D-9ED5DB466430}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6657953B-1C82-4E50-A620-E4C850681AE6}] => (Allow) LPort=2869
FirewallRules: [{C3D74ED0-9B11-4FD8-9086-8A2F24A37237}] => (Allow) LPort=1900
FirewallRules: [{4AFD2904-9679-4C5A-8D4E-3503020D080A}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{D2A98AA2-A8C9-4CBD-8341-981F90E5E9A3}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
FirewallRules: [{8A65BEA0-73F4-4B93-88B5-2C6624667599}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
FirewallRules: [{4E28DE22-CAE9-4069-A8B9-FDE4828E232D}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
FirewallRules: [{410F0973-3316-49C8-B500-8C978E6D62F6}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
FirewallRules: [{E737EB76-E506-43CD-860B-5D1BCF871729}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{F535ED05-F29F-468C-BBB9-04D810A1C9D6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{FE921663-E8BC-4F8C-B070-B48C27B29169}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{7780602F-6AA4-429C-8874-C570C12396AE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{BC9B9E86-0189-4749-AA87-02194FB95007}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{516D88B4-F2DB-487D-A4F0-CA19AF997535}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Wiederherstellungspunkte =========================
07-09-2017 16:56:28 Windows Update
10-09-2017 17:39:36 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (09/11/2017 02:53:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Powerwalk-PC)
Description: Bei der Aktivierung der App „Microsoft.Windows.Photos_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (09/11/2017 02:51:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Powerwalk-PC)
Description: Das Paket „Microsoft.Windows.Photos_2017.35071.13510.0_x64__8wekyb3d8bbwe+App“ wurde beendet, da das Anhalten zu lange dauerte.
Error: (09/11/2017 02:21:05 PM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 01:22:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Powerwalk-PC)
Description: Bei der Aktivierung der App „Microsoft.Windows.Photos_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (09/11/2017 11:02:59 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 11:02:25 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 11:02:23 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 11:02:19 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 11:02:09 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Error: (09/11/2017 11:02:08 AM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.
Systemfehler:
=============
Error: (09/11/2017 02:54:03 PM) (Source: DCOM) (EventID: 10010) (User: Powerwalk-PC)
Description: Der Server "Microsoft.Windows.Photos_2017.35071.13510.0_x64__8wekyb3d8bbwe!App.AppXy9rh3t8m2jfpvhhxp6y2ksgeq77vymbq.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (09/11/2017 07:06:30 AM) (Source: DCOM) (EventID: 10010) (User: Powerwalk-PC)
Description: Der Server "Microsoft.Windows.Photos_2017.35071.13510.0_x64__8wekyb3d8bbwe!App.AppXy9rh3t8m2jfpvhhxp6y2ksgeq77vymbq.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (09/11/2017 01:18:57 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Manager für heruntergeladene Karten" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/10/2017 08:05:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (09/10/2017 08:05:31 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\POWERW~1\AppData\Local\Temp\ehdrv.sys
Error: (09/10/2017 08:05:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (09/10/2017 08:05:30 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\POWERW~1\AppData\Local\Temp\ehdrv.sys
Error: (09/10/2017 08:05:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (09/10/2017 08:05:30 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\POWERW~1\AppData\Local\Temp\ehdrv.sys
Error: (09/10/2017 08:05:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
CodeIntegrity:
===================================
Date: 2017-08-19 12:48:30.841
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Windows signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM)2 Duo CPU T5900 @ 2.20GHz
Prozentuale Nutzung des RAM: 55%
Installierter physikalischer RAM: 4095.27 MB
Verfügbarer physikalischer RAM: 1828.52 MB
Summe virtueller Speicher: 8191.27 MB
Verfügbarer virtueller Speicher: 5437.82 MB
==================== Laufwerke ================================
Drive c: (OS) (Fixed) (Total:282.95 GB) (Free:37.82 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive d: (RECOVERY) (Fixed) (Total:14.63 GB) (Free:4.36 GB) FAT32 ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive h: () (Removable) (Total:0.94 GB) (Free:0.25 GB) FAT
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 76692CA8)
Partition 1: (Not Active) - (Size=14.6 GB) - (Type=0C)
Partition 2: (Active) - (Size=283 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=499 MB) - (Type=27)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 967.5 MB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=967 MB) - (Type=06)
==================== Ende von Addition.txt ============================ Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 11-09-2017
durchgeführt von Powerwalk (Administrator) auf POWERWALK-PC (11-09-2017 16:27:48)
Gestartet von C:\Users\Powerwalk\Desktop
Geladene Profile: Powerwalk (Verfügbare Profile: Powerwalk & DefaultAppPool)
Platform: Windows 10 Home Version 1703 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(brother Industries Ltd) C:\Windows\SysWOW64\BRSVC01A.EXE
(brother Industries Ltd) C:\Windows\SysWOW64\BRSS01A.EXE
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avpui.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Brother Industries Ltd.) C:\Brother\BPRSP\resources\BrSupSsp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11707.1001.23.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe
(Dropbox, Inc.) C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [3738336 2015-10-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-08-12] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [600928 2014-01-17] (Copyright 2013 SAMSUNG)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort12reminder] => "C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Run: [Dropbox Update] => C:\Users\Powerwalk\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Run: [Kies3PDLR.exe] => C:\Program Files (x86)\Samsung\Kies3\FirmwareUpdate\Kies3PDLR.exe [1023664 2016-03-25] (Samsung)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9832152 2017-08-03] (Piriform Ltd)
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\...\Policies\Explorer: [NoDrives] 00000000
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Brother BPFSP.lnk [2017-01-20]
ShortcutTarget: Brother BPFSP.lnk -> C:\Windows\Installer\{8040527F-DD74-4B45-8A06-C4BF145B6C76}\BrSupSsp.exe_6861D01CB00C428FAA7298BB572A9511.exe (Flexera Software LLC)
Startup: C:\Users\Powerwalk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-21]
ShortcutTarget: Dropbox.lnk -> C:\Users\Powerwalk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 80.69.96.12 81.210.129.4
Tcpip\..\Interfaces\{d57f803a-132b-418b-8d0f-47fd988fdc60}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{df32bf3b-80b9-4856-b8d3-6085e758aea5}: [DhcpNameServer] 80.69.96.12 81.210.129.4
Tcpip\..\Interfaces\{f8858fba-d1b7-4144-bd58-747a29238ab0}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2978788035-3705852035-3635699130-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=620947&OCID=AVRES000&pc=UE00
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000 -> DefaultScope {AC6AE391-2600-41BF-A23D-9F91C72CE046} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000 -> {9FE95E77-B87C-4A27-83D5-B92780874D3B} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&intl=de&fr=yset_ie_syc_oracle&type=orcl_default
SearchScopes: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000 -> {AC6AE391-2600-41BF-A23D-9F91C72CE046} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2016-12-06] (AO Kaspersky Lab)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-08-18] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-18] (Oracle Corporation)
BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2016-12-06] (AO Kaspersky Lab)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\ssv.dll [2017-08-18] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-18] (Oracle Corporation)
Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2016-12-06] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2016-12-06] (AO Kaspersky Lab)
Toolbar: HKU\S-1-5-21-2978788035-3705852035-3635699130-1000 -> Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2016-12-06] (AO Kaspersky Lab)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Keine Datei
FireFox:
========
FF ProfilePath: C:\Users\Powerwalk\AppData\Roaming\Postbox\Profiles\cee6kj2r.default [2016-08-06]
FF ProfilePath: C:\Users\Powerwalk\AppData\Roaming\Mozilla\Firefox\Profiles\evkzgjtr.default-1475093968745 [2017-09-08]
FF Homepage: Mozilla\Firefox\Profiles\evkzgjtr.default-1475093968745 -> www.google.de
FF NetworkProxy: Mozilla\Firefox\Profiles\evkzgjtr.default-1475093968745 -> type", 0
FF HKLM\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2017-07-19]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru => nicht gefunden
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll [2017-08-23] ()
FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [Keine Datei]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll [2017-08-23] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1229199.dll [2017-03-31] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://www.google.de/
CHR Session Restore: Default -> ist aktiviert.
CHR Profile: C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default [2017-09-11]
CHR Extension: (Kaspersky Protection) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhoibnponjcgjgcnfacekaijdbbplhib [2017-01-28]
CHR Extension: (Skype) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-08-02]
CHR Extension: (Skyrim Theme) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpamhoiaakdgllnldcapkcgoeimodnle [2016-10-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-25]
CHR Extension: (Chrome Media Router) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-07]
CHR Profile: C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-09-08]
CHR Extension: (Adobe Acrobat) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-07-25]
CHR Extension: (Kaspersky Protection) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fhoibnponjcgjgcnfacekaijdbbplhib [2017-07-25]
CHR Extension: (Yahoo Partner) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kpdmjodecdegfglgaapafjleomjjlpnh [2017-07-25]
CHR Extension: (Skype) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-07-25]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-25]
CHR Extension: (Chrome Media Router) - C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-25]
CHR Profile: C:\Users\Powerwalk\AppData\Local\Google\Chrome\User Data\System Profile [2017-09-08]
CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [kpdmjodecdegfglgaapafjleomjjlpnh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 ALG; C:\WINDOWS\System32\alg.exe [92672 2017-03-18] (Microsoft Corporation)
S4 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [Datei ist nicht signiert]
S4 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [Datei ist nicht signiert]
R2 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab)
R2 Brother XP spl Service; C:\WINDOWS\SysWOW64\brsvc01a.exe [57344 2002-04-12] (brother Industries Ltd) [Datei ist nicht signiert]
R2 CDPUserSvc_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation)
R2 CDPUserSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation)
S3 DevicesFlowUserSvc_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 DevicesFlowUserSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S4 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION) [Datei ist nicht signiert]
S4 ETDService; C:\Program Files\Elantech\ETDService.exe [144104 2015-10-31] (ELAN Microelectronics Corp.)
S3 Fax; C:\WINDOWS\system32\fxssvc.exe [637440 2017-03-18] (Microsoft Corporation)
S4 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\vssbridge64.exe [77328 2016-06-28] (AO Kaspersky Lab)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-21] (Malwarebytes)
S3 MessagingService_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 MessagingService_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 MSDTC; C:\WINDOWS\System32\msdtc.exe [147456 2017-03-18] (Microsoft Corporation)
S3 msiserver; C:\WINDOWS\System32\msiexec.exe [66048 2017-03-18] (Microsoft Corporation)
S3 msiserver; C:\WINDOWS\SysWOW64\msiexec.exe [59392 2017-03-18] (Microsoft Corporation)
R2 MSMQ; C:\WINDOWS\system32\mqsvc.exe [26112 2017-05-16] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-07-26] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-07-26] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-07-26] (NVIDIA Corporation)
R2 OneSyncSvc_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation)
R2 OneSyncSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S3 PimIndexMaintenanceSvc_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 PimIndexMaintenanceSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 RpcLocator; C:\WINDOWS\system32\locator.exe [11264 2017-03-18] (Microsoft Corporation)
R2 SamSs; C:\WINDOWS\system32\lsass.exe [58488 2017-07-07] (Microsoft Corporation)
S4 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [609632 2014-01-17] (Copyright 2013 SAMSUNG)
R2 SecurityHealthService; C:\WINDOWS\system32\SecurityHealthService.exe [336320 2017-07-07] (Microsoft Corporation)
S3 SensorDataService; C:\WINDOWS\System32\SensorDataService.exe [1284608 2017-03-18] (Microsoft Corporation)
S3 SNMPTRAP; C:\WINDOWS\System32\snmptrap.exe [15872 2017-05-20] (Microsoft Corporation)
S3 spectrum; C:\WINDOWS\system32\spectrum.exe [891904 2017-03-18] (Microsoft Corporation)
R2 Spooler; C:\WINDOWS\System32\spoolsv.exe [757760 2017-03-18] (Microsoft Corporation)
S2 sppsvc; C:\WINDOWS\system32\sppsvc.exe [4574192 2017-03-18] (Microsoft Corporation)
S4 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
S3 TieringEngineService; C:\WINDOWS\system32\TieringEngineService.exe [302592 2017-03-18] (Microsoft Corporation)
S3 UI0Detect; C:\WINDOWS\system32\UI0Detect.exe [43008 2017-03-18] (Microsoft Corporation)
S3 UnistoreSvc_3e334; C:\WINDOWS\System32\svchost.exe [47664 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 UnistoreSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 UserDataSvc_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 UserDataSvc_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation) <==== ACHTUNG (kein ServiceDLL)
S3 vds; C:\WINDOWS\System32\vds.exe [643072 2017-03-18] (Microsoft Corporation)
S3 VSS; C:\WINDOWS\system32\vssvc.exe [1550848 2017-03-18] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
R2 WpnUserService_3e334; C:\WINDOWS\system32\svchost.exe [47664 2017-03-18] (Microsoft Corporation)
R2 WpnUserService_3e334; C:\WINDOWS\SysWOW64\svchost.exe [40904 2017-03-18] (Microsoft Corporation)
R2 WSearch; C:\WINDOWS\system32\SearchIndexer.exe [933376 2017-06-03] (Microsoft Corporation)
R2 WSearch; C:\WINDOWS\SysWOW64\SearchIndexer.exe [797184 2017-06-03] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-08-24] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-05-22] () [Datei ist nicht signiert]
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R0 klbackupdisk; C:\WINDOWS\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-07] (AO Kaspersky Lab)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab)
R2 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [78216 2016-05-31] (AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [28792 2016-03-31] (AO Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [197312 2017-07-19] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [520152 2017-07-19] (AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP17.0.0\Bases\klids.sys [186696 2017-09-10] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1021624 2017-07-19] (AO Kaspersky Lab)
R1 KLIM6; C:\WINDOWS\system32\DRIVERS\klim6.sys [57424 2017-05-16] (AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [52136 2016-05-19] (AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R0 klupd_klif_arkmon; C:\WINDOWS\System32\Drivers\klupd_klif_arkmon.sys [229288 2017-07-16] (AO Kaspersky Lab)
R3 klupd_klif_kimul; C:\WINDOWS\System32\Drivers\klupd_klif_kimul.sys [87584 2017-04-14] (AO Kaspersky Lab)
R3 klupd_klif_klark; C:\WINDOWS\System32\Drivers\klupd_klif_klark.sys [251656 2017-07-16] (AO Kaspersky Lab)
R0 klupd_klif_klbg; C:\WINDOWS\System32\Drivers\klupd_klif_klbg.sys [112912 2017-07-16] (AO Kaspersky Lab)
R3 klupd_klif_mark; C:\WINDOWS\System32\Drivers\klupd_klif_mark.sys [173144 2017-07-16] (AO Kaspersky Lab)
R1 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [85320 2016-06-18] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [136416 2017-03-13] (AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [199640 2017-07-19] (AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [192960 2017-09-07] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [101824 2017-09-10] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [45472 2017-09-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [253888 2017-09-10] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [94144 2017-09-11] (Malwarebytes)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-07-26] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48064 2017-07-26] (NVIDIA Corporation)
R3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [57792 2017-07-26] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-18] (Realtek )
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
U3 idsvc; kein ImagePath
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-09-11 16:27 - 2017-09-11 16:32 - 000028364 _____ C:\Users\Powerwalk\Desktop\FRST.txt
2017-09-11 16:25 - 2017-09-11 16:25 - 000004758 _____ C:\Users\Powerwalk\Desktop\eset.txt
2017-09-10 19:57 - 2017-09-10 19:57 - 006760064 _____ (ESET spol. s r.o.) C:\Users\Powerwalk\Desktop\esetonlinescanner_deu.exe
2017-09-10 19:03 - 2017-09-10 19:03 - 000000000 ____D C:\Users\Powerwalk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-09-10 18:50 - 2017-09-10 19:57 - 000000000 ____D C:\ProgramData\HitmanPro
2017-09-10 18:49 - 2017-09-10 18:49 - 011584088 _____ (SurfRight B.V.) C:\Users\Powerwalk\Desktop\HitmanPro_x64.exe
2017-09-10 18:24 - 2017-09-10 18:26 - 000002260 _____ C:\Users\Powerwalk\Desktop\Fixlog.txt
2017-09-10 18:22 - 2017-09-11 16:26 - 000000000 ____D C:\Users\Powerwalk\Desktop\FRST-OlderVersion
2017-09-08 12:26 - 2017-09-08 12:26 - 000165376 _____ C:\Users\Powerwalk\Desktop\SystemLook_x64.exe
2017-09-07 18:16 - 2017-09-11 15:00 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-09-07 18:16 - 2017-09-10 18:36 - 000101824 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-09-07 18:16 - 2017-09-07 18:16 - 000192960 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-09-07 18:15 - 2017-09-10 18:36 - 000045472 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-09-07 18:14 - 2017-09-10 18:36 - 000253888 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-09-07 18:14 - 2017-09-07 18:14 - 000001914 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-09-07 18:14 - 2017-09-07 18:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-09-07 18:13 - 2017-08-24 11:27 - 000077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-09-07 18:12 - 2017-09-07 18:12 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-09-07 18:12 - 2017-09-07 18:12 - 000000000 ____D C:\Program Files\Malwarebytes
2017-09-07 18:08 - 2017-09-07 18:10 - 066347240 _____ (Malwarebytes ) C:\Users\Powerwalk\Downloads\mb3-setup-consumer-3.2.2.2018.exe
2017-09-07 17:57 - 2017-09-07 17:57 - 000566128 _____ (Malwarebytes) C:\Users\Powerwalk\Downloads\mbam-clean-2.3.0.1001.exe
2017-09-07 17:20 - 2017-09-07 17:20 - 008182736 _____ (Malwarebytes) C:\Users\Powerwalk\Downloads\adwcleaner_7.0.2.1.exe
2017-09-06 17:30 - 2017-09-11 16:27 - 000000000 ____D C:\FRST
2017-09-06 17:29 - 2017-09-11 16:26 - 002396672 _____ (Farbar) C:\Users\Powerwalk\Desktop\FRST64.exe
2017-09-05 19:12 - 2017-09-05 19:12 - 000000000 ____D C:\Users\Powerwalk\AppData\Local\ESET
2017-09-05 19:09 - 2017-09-05 19:10 - 006760064 _____ (ESET spol. s r.o.) C:\Users\Powerwalk\Downloads\esetonlinescanner_deu.exe
2017-09-02 17:19 - 2017-09-02 17:19 - 000010402 _____ C:\Users\Powerwalk\Downloads\Ihre Retourenmarke.pdf
2017-09-01 18:42 - 2017-09-01 18:42 - 000269968 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-08-24 17:02 - 2017-08-24 17:02 - 000002289 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2017-08-24 17:02 - 2017-08-24 17:02 - 000002251 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk
2017-08-18 19:15 - 2017-08-18 18:15 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-08-17 19:41 - 2017-08-17 19:41 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2017-08-16 18:28 - 2017-08-16 18:28 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Local\TileDataLayer
2017-08-12 17:32 - 2017-08-12 17:32 - 016233832 _____ (Ventis Media Inc. ) C:\Users\Powerwalk\Downloads\MediaMonkey_4.1.17.1840.exe
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-09-11 16:28 - 2014-08-21 18:28 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2017-09-11 16:23 - 2017-05-15 23:45 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-09-10 19:04 - 2013-09-03 18:38 - 000000000 ____D C:\Users\Powerwalk\AppData\Roaming\Dropbox
2017-09-10 18:51 - 2017-05-15 23:52 - 000000000 ____D C:\ProgramData\NVIDIA
2017-09-10 18:42 - 2017-06-23 19:42 - 000003244 _____ C:\WINDOWS\System32\Tasks\P4GIntlCtrl
2017-09-10 18:35 - 2017-05-16 00:38 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-09-10 18:34 - 2017-03-18 13:40 - 001572864 _____ C:\WINDOWS\system32\config\BBI
2017-09-10 18:07 - 2017-05-16 00:38 - 000004174 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D8E77259-0259-4084-93CD-26B759FCFDE1}
2017-09-10 17:47 - 2016-12-17 10:16 - 000000000 ____D C:\Users\Powerwalk\AppData\LocalLow\Mozilla
2017-09-10 17:39 - 2017-07-27 18:29 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2978788035-3705852035-3635699130-1000
2017-09-10 17:38 - 2017-03-18 23:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-09-10 17:38 - 2015-10-25 17:57 - 000002445 _____ C:\Users\Powerwalk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-09-10 17:38 - 2015-10-25 17:57 - 000000000 ___RD C:\Users\Powerwalk\OneDrive
2017-09-08 19:21 - 2017-03-18 23:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-09-08 12:19 - 2016-03-17 15:13 - 000000000 ____D C:\Users\Powerwalk\AppData\Local\CrashDumps
2017-09-08 12:12 - 2012-08-05 12:03 - 000000000 ____D C:\Users\Powerwalk\AppData\LocalLow\Temp
2017-09-07 17:35 - 2012-04-25 12:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-07 17:33 - 2014-10-22 17:50 - 000000000 ____D C:\AdwCleaner
2017-09-07 17:32 - 2016-07-16 13:47 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-09-06 19:14 - 2011-07-31 14:42 - 000002342 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-04 20:54 - 2014-07-06 13:02 - 000000000 ___RD C:\Users\Powerwalk\Documents\Scanned Documents
2017-09-04 20:54 - 2013-09-07 14:05 - 000000000 ____D C:\Users\Powerwalk\Documents\Eigene PaperPort-Dokumente
2017-09-04 20:54 - 2013-07-19 19:29 - 000000000 ____D C:\Users\Powerwalk\Documents\SelfMV
2017-09-04 20:54 - 2013-06-29 09:48 - 000000000 ____D C:\Users\Powerwalk\Documents\Freemium Driver Utilities
2017-09-04 20:54 - 2013-01-19 17:11 - 000000000 ____D C:\Users\Powerwalk\Documents\Turbo Lister Backup
2017-09-04 20:54 - 2012-02-09 22:28 - 000000000 ____D C:\Users\Powerwalk\Documents\Sync Back Up
2017-09-04 20:54 - 2011-12-07 12:43 - 000000000 ____D C:\Users\Powerwalk\Documents\Cross Fire
2017-09-04 20:54 - 2011-06-26 16:30 - 000000000 ____D C:\Users\Powerwalk\Documents\samsung
2017-09-04 20:54 - 2011-06-26 13:51 - 000000000 ____D C:\Users\Powerwalk\Documents\FreeFileSync
2017-09-04 20:54 - 2010-09-26 12:45 - 000000000 ____D C:\Users\Powerwalk\Documents\CC Cleaner Backup
2017-09-04 20:54 - 2010-09-26 12:15 - 000000000 ____D C:\Users\Powerwalk\Documents\Moz Backup
2017-09-04 20:54 - 2010-08-08 17:32 - 000000000 ____D C:\Users\Powerwalk\Documents\Sichern von Handy
2017-09-04 20:54 - 2010-07-04 14:32 - 000000000 ____D C:\Users\Powerwalk\Documents\DVDVideoSoft
2017-09-04 20:54 - 2010-03-17 19:21 - 000000000 ____D C:\Users\Powerwalk\Documents\SoftMaker
2017-09-02 12:35 - 2017-07-20 18:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-09-02 12:35 - 2011-06-25 16:00 - 000001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-08-31 20:40 - 2015-10-25 17:46 - 000000000 ____D C:\Users\Powerwalk\AppData\Local\Packages
2017-08-31 19:47 - 2017-03-18 23:01 - 000000000 ____D C:\WINDOWS\INF
2017-08-31 17:08 - 2015-04-27 18:05 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-08-26 14:04 - 2011-11-16 18:58 - 000000000 ____D C:\Users\Powerwalk\AppData\Roaming\MediaMonkey
2017-08-26 12:17 - 2017-05-15 23:53 - 002386422 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-08-26 12:17 - 2017-03-20 06:35 - 001050154 _____ C:\WINDOWS\system32\perfh007.dat
2017-08-26 12:17 - 2017-03-20 06:35 - 000242634 _____ C:\WINDOWS\system32\perfc007.dat
2017-08-26 12:04 - 2012-04-04 15:02 - 000000000 ____D C:\Program Files (x86)\Java
2017-08-25 19:47 - 2017-03-18 23:03 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-08-24 18:37 - 2015-02-07 16:42 - 000000743 _____ C:\WINDOWS\wiso.ini
2017-08-24 17:02 - 2011-07-12 09:26 - 000000000 ____D C:\Program Files (x86)\Google
2017-08-23 18:17 - 2017-03-18 23:03 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-08-23 18:16 - 2017-03-18 23:03 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-08-21 17:04 - 2016-11-22 21:13 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-08-19 12:52 - 2017-05-15 19:15 - 000000000 ____D C:\Windows10Upgrade
2017-08-19 12:44 - 2017-03-18 13:40 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-08-18 19:18 - 2013-09-16 21:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-08-18 19:10 - 2016-12-22 23:06 - 000000000 ____D C:\Program Files\Java
2017-08-18 18:15 - 2016-12-22 23:07 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-08-18 18:00 - 2017-07-20 18:53 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2017-08-17 19:46 - 2017-05-15 23:51 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2017-08-17 19:45 - 2017-02-12 15:47 - 000001491 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-08-17 19:44 - 2017-07-20 19:48 - 000004000 _____ C:\WINDOWS\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:44 - 2017-05-16 00:38 - 000003994 _____ C:\WINDOWS\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:42 - 2017-05-16 00:38 - 000004308 _____ C:\WINDOWS\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:42 - 2017-05-15 23:51 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-08-17 19:42 - 2013-09-08 15:12 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-08-17 19:41 - 2017-05-16 00:38 - 000003894 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:41 - 2017-05-16 00:38 - 000003866 _____ C:\WINDOWS\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:41 - 2017-05-16 00:38 - 000003858 _____ C:\WINDOWS\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:41 - 2017-05-16 00:38 - 000003696 _____ C:\WINDOWS\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-17 19:41 - 2017-05-16 00:38 - 000003654 _____ C:\WINDOWS\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-16 18:33 - 2011-06-30 17:41 - 000000000 ____D C:\Program Files\CCleaner
2017-08-13 13:30 - 2013-07-17 11:52 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-08-13 13:22 - 2011-06-25 16:38 - 140394280 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-08-13 13:21 - 2017-03-18 22:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-08-12 17:35 - 2011-06-26 09:20 - 000000000 ____D C:\Program Files (x86)\MediaMonkey
2017-08-12 17:34 - 2011-06-26 09:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MediaMonkey
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-12-09 04:52 - 2005-12-09 04:52 - 000000060 ____R () C:\Program Files (x86)\BRINST.INI
2013-12-18 20:04 - 2014-08-19 17:58 - 000000209 _____ () C:\Users\Powerwalk\AppData\Roaming\WB.CFG
2015-03-17 20:27 - 2015-03-17 20:27 - 000385602 _____ () C:\Users\Powerwalk\AppData\Local\145842EF_stp.CIS
2015-03-17 20:27 - 2015-03-17 20:27 - 000000232 _____ () C:\Users\Powerwalk\AppData\Local\145842EF_stp.CIS.part
2015-02-05 20:30 - 2015-02-05 20:30 - 000187090 _____ () C:\Users\Powerwalk\AppData\Local\2F711529_stp.CIS
2015-02-05 20:30 - 2015-02-05 20:30 - 000000262 _____ () C:\Users\Powerwalk\AppData\Local\2F711529_stp.CIS.part
2015-03-17 20:27 - 2015-03-17 20:27 - 000119839 _____ () C:\Users\Powerwalk\AppData\Local\3040C927_stp.CIS
2015-03-17 20:27 - 2015-03-17 20:27 - 000000318 _____ () C:\Users\Powerwalk\AppData\Local\3040C927_stp.CIS.part
2011-06-26 16:31 - 2012-10-14 12:43 - 000006144 _____ () C:\Users\Powerwalk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-07-02 23:21 - 2017-01-18 16:53 - 000007630 _____ () C:\Users\Powerwalk\AppData\Local\resmon.resmoncfg
2011-11-19 15:00 - 2011-11-19 15:00 - 000017408 _____ () C:\Users\Powerwalk\AppData\Local\WebpageIcons.db
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-09-04 19:48
==================== Ende von FRST.txt ============================ Bisher läuft es besser als vorher
Das was mir auffällt ist, das sich die Taskleiste manchmal neu aufbaut.
So nach etwa einer knappen Stunde online wird es wieder langsamer das Internet, nicht ganz so extrem wie vorher.
Aber ähnliches Verhalten wie im Anfangspost beschrieben. |