Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Langsamer Firefox stört! (https://www.trojaner-board.de/168515-langsamer-firefox-stoert.html)

magigstar 07.07.2015 15:56
Langsamer Firefox stört!
 
Hallo liebe Helfer_innen,

ich bedanke mich schon jetzt recht herzlich an die jenige Person, die mein Problem sich zur Brust nimmt.

Ich habe schon mal FRST laufen lassen...

Fehlerbeschreibung:
Hatte vor kurzem viele Startseiten eingestellt. Hab diese entfernt.
Notebook läuft aber immer noch viel zu langsam.
In den nächsten Tagen werden ich parallel einige Dateien vom Desktop verschwinden lassen.
Das lahmt doch sehr.

Möchte aber gerne von euch wissen, ob es nur daran liegen könnte.


Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by DDDDD CCCCC (administrator) on ARBEITSCOMPUTER on 07-07-2015 16:24:59
Running from C:\Users\DDDDD CCCCC\Desktop
Loaded Profiles: DDDDD CCCCC (Available Profiles: DDDDD CCCCC & EEEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Common Files\AAV\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
() C:\Windows\snuvcdsm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodtray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(RescueTime, Inc.) C:\Program Files (x86)\RescueTime\RescueTime.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Mirko Böer) C:\Program Files (x86)\SSS\SimpleScreenshot.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mirko Böer) C:\Program Files\AmP\AmP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe [3942216 2011-01-25] (O&O Software GmbH)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [SimpleScreenshot] => C:\Program Files (x86)\SSS\SIMPLESCREENSHOT.EXE [2255360 2008-02-09] (Mirko Böer)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [130864 2015-05-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-12-06]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-06-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-07-02] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-02] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-07-02] (Apple Inc.)
FF SearchPlugin: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807\searchplugins\youtube-videosuche.xml [2015-05-30]
FF Extension: LeechBlock - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2015-03-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Slides) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-01]
CHR Extension: (Google Docs) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-22]
CHR Extension: (Google Search) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (Google Sheets) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-01]
CHR Extension: (Avira Browser Safety) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-26]
CHR Extension: (Gmail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [208632 2015-05-21] (Avira Operations GmbH & Co. KG)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
R2 HPSLPSVC; C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.) [File not signed]
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [File not signed]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [File not signed]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [File not signed]
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-11] (Avira Operations GmbH & Co. KG)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-07 16:24 - 2015-07-07 16:25 - 00025062 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-07-07 16:24 - 2015-07-07 16:24 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-07-07 16:23 - 2015-07-07 16:23 - 00000323 _____ C:\Users\DDDDD CCCCC\Desktop\Wissen.URL
2015-07-07 16:23 - 2015-07-07 16:23 - 00000273 _____ C:\Users\DDDDD CCCCC\Desktop\BeYourBest - mehr Erfolg im Leben.URL
2015-07-07 16:23 - 2015-07-07 16:23 - 00000268 _____ C:\Users\DDDDD CCCCC\Desktop\BeYourBest_Schmetterlingsprinzip.pdf.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000292 _____ C:\Users\DDDDD CCCCC\Desktop\karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000289 _____ C:\Users\DDDDD CCCCC\Desktop\karrierebibel.de2.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000280 _____ C:\Users\DDDDD CCCCC\Desktop\Altersvorsorge Orientierung für Berufsanfänger karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000257 _____ C:\Users\DDDDD CCCCC\Desktop\Bewerbung Falsche Angaben, Lügen & Folgen karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000248 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstmotivation lernen Was uns wirklich anspornt karrierebibel.de.URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000303 _____ C:\Users\DDDDD CCCCC\Desktop\SPRECHERHAUS®.URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000258 _____ C:\Users\DDDDD CCCCC\Desktop\Hoppla, dieser Inhalt ist nur für Kunden….URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000245 _____ C:\Users\DDDDD CCCCC\Desktop\Die Person..URL
2015-07-07 16:20 - 2015-07-07 16:20 - 00000285 _____ C:\Users\DDDDD CCCCC\Desktop\Planungstreffen.URL
2015-07-07 16:20 - 2015-07-07 16:20 - 00000250 _____ C:\Users\DDDDD CCCCC\Desktop\Mitmachen! «.URL
2015-07-07 15:54 - 2015-07-07 15:54 - 00009111 _____ C:\Users\DDDDD CCCCC\Downloads\Mappe1.xlsx
2015-07-05 12:32 - 2015-07-05 12:32 - 00011869 _____ C:\Users\DDDDD CCCCC\Desktop\Riester + PRV.xlsx
2015-07-05 10:17 - 2015-07-05 10:17 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5
2015-07-04 09:04 - 2015-07-04 09:04 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner
2015-07-02 21:14 - 2015-07-02 21:14 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-07-02 21:14 - 2015-07-02 21:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-07-02 21:13 - 2015-07-02 21:14 - 00000000 ____D C:\Program Files\iTunes
2015-07-02 21:13 - 2015-07-02 21:13 - 00000000 ____D C:\Program Files\iPod
2015-07-02 21:13 - 2015-07-02 21:13 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-07-02 20:58 - 2015-07-02 20:58 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-07-02 20:58 - 2015-07-02 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-07-02 20:58 - 2015-07-02 20:58 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-06-21 22:00 - 2015-06-21 22:11 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\7-PDFSplitMerge
2015-06-21 22:00 - 2015-06-21 22:10 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\7-PDF Split & Merge
2015-06-21 22:00 - 2015-06-21 22:00 - 01437252 _____ (7-PDF, Germany ) C:\Users\DDDDD CCCCC\Downloads\7-PDFSplitMerge.exe
2015-06-21 22:00 - 2015-06-21 22:00 - 00001204 _____ C:\Users\Public\Desktop\7-PDF Split & Merge.lnk
2015-06-21 22:00 - 2015-06-21 22:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-PDF
2015-06-21 22:00 - 2015-06-21 22:00 - 00000000 ____D C:\Program Files (x86)\7-PDF
2015-06-21 09:17 - 2015-06-21 09:17 - 00008805 _____ C:\Users\DDDDD CCCCC\Downloads\20150621-101768265-umsatz.CSV
2015-06-18 20:23 - 2015-06-18 21:23 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\Skype
2015-06-18 20:23 - 2015-06-18 20:23 - 00000000 ____D C:\Users\Versuch\AppData\Local\Skype
2015-06-18 20:02 - 2015-06-18 20:02 - 00000000 ____D C:\Users\Versuch\AppData\Local\GWX
2015-06-17 00:23 - 2015-06-17 00:23 - 00094208 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
2015-06-17 00:23 - 2015-06-17 00:23 - 00069632 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
2015-06-14 21:13 - 2015-06-14 21:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-06-11 21:21 - 2015-06-11 21:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-06-11 21:21 - 2015-06-11 21:21 - 00002011 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-06-10 22:03 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 22:03 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 22:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 22:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 22:03 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 22:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 22:03 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 22:03 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 22:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 22:03 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 22:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 22:03 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 22:03 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 22:03 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 22:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 22:03 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 22:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 22:03 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 22:03 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 22:03 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 22:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 22:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 22:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 22:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 22:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 22:03 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 22:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 22:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 22:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 22:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 22:03 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 22:03 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 22:03 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 22:03 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 22:03 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 22:03 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 22:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 22:03 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 22:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 22:03 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 22:03 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 22:03 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 22:03 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 22:03 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 22:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 22:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 22:03 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 22:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 22:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 22:03 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 22:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 22:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 22:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 22:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 22:03 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-10 22:00 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 22:00 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 22:00 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 22:00 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 22:00 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 22:00 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 22:00 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 22:00 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 22:00 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 22:00 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 21:57 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 21:57 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 21:57 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 21:57 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 21:57 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 21:57 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 21:57 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 21:57 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 21:57 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 21:57 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 21:57 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 21:57 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 21:57 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 21:57 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 21:57 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 21:57 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 21:57 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 21:56 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 21:56 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 21:56 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-08 17:32 - 2015-07-07 16:23 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-06-08 17:32 - 2015-06-14 16:48 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-07 16:25 - 2014-08-21 21:10 - 00000000 ____D C:\FRST
2015-07-07 16:24 - 2015-02-10 19:48 - 02112512 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-07-07 16:20 - 2015-05-31 14:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-07-07 16:05 - 2012-08-14 19:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-07 15:54 - 2011-11-13 22:43 - 01380240 _____ C:\Windows\WindowsUpdate.log
2015-07-07 15:46 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-07 15:46 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-07 15:36 - 2014-06-18 09:20 - 00040794 _____ C:\Windows\setupact.log
2015-07-07 15:36 - 2012-09-20 05:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-07 15:36 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-07 15:35 - 2014-11-10 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-07 15:35 - 2014-06-20 14:07 - 00303784 _____ C:\Windows\PFRO.log
2015-07-06 19:28 - 2012-09-20 05:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-05 13:07 - 2014-11-16 13:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-05 10:55 - 2012-03-25 12:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-07-02 21:13 - 2012-01-29 15:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-07-02 21:12 - 2015-04-23 13:54 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-07-02 20:55 - 2014-08-15 16:44 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Adobe
2015-07-02 20:54 - 2012-04-02 20:28 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-02 20:54 - 2012-04-02 20:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-02 20:54 - 2011-11-15 22:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-01 22:13 - 2012-04-07 12:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-07-01 21:35 - 2013-02-24 20:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-29 19:28 - 2015-05-25 19:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-23 13:30 - 2011-11-15 22:40 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-21 15:29 - 2014-08-07 21:56 - 03392512 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-06-21 11:50 - 2014-09-10 07:10 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\SimpleScreenshot
2015-06-20 15:37 - 2011-11-14 07:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-06-20 15:37 - 2011-11-14 07:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-06-20 15:37 - 2009-07-14 07:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-18 20:23 - 2014-09-23 19:09 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-06-18 20:23 - 2013-11-02 10:43 - 00000000 ____D C:\ProgramData\Skype
2015-06-18 20:22 - 2014-09-23 19:09 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2015-06-18 20:22 - 2014-09-23 19:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-06-18 20:08 - 2014-09-10 07:15 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\Avira
2015-06-18 20:03 - 2014-12-06 15:40 - 00002211 _____ C:\Users\Versuch\Desktop\Google Chrome.lnk
2015-06-18 19:33 - 2013-03-29 21:10 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-18 19:33 - 2013-03-29 21:10 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-14 16:48 - 2015-05-31 14:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-06-14 13:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-12 21:54 - 2011-11-14 00:16 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Adobe
2015-06-12 17:09 - 2013-02-24 20:39 - 00000000 ____D C:\ProgramData\Avira
2015-06-11 21:21 - 2009-11-05 02:38 - 00000000 ____D C:\ProgramData\Adobe
2015-06-11 21:21 - 2009-11-05 02:38 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-11 19:52 - 2014-08-06 11:55 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-11 19:51 - 2013-02-24 20:39 - 00000000 ____D C:\Program Files (x86)\Avira
2015-06-11 19:47 - 2009-07-14 06:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 19:38 - 2014-12-12 21:57 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 19:38 - 2014-05-03 08:02 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 19:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 19:37 - 2014-03-28 23:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-06-11 19:36 - 2009-11-05 05:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 19:36 - 2009-07-14 04:34 - 00000648 _____ C:\Windows\win.ini
2015-06-11 19:00 - 2013-07-13 09:36 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 18:33 - 2011-11-18 20:58 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-06-28 08:10 - 2014-07-23 22:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 21:51 - 2015-02-22 15:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 19:28 - 2014-07-07 02:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 22:07 - 2014-09-22 22:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-05-15 11:36 - 2015-05-15 11:36 - 0006486 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 22:15 - 2013-08-12 22:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 11:26 - 2012-03-31 11:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 23:53 - 2011-11-13 23:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 20:19 - 2014-10-06 20:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe
C:\Users\DDDDD CCCCC\AppData\Local\Temp\sfamcc00001.dll
C:\Users\DDDDD CCCCC\AppData\Local\Temp\SkypeSetup.exe
C:\Users\EEEEEE\AppData\Local\Temp\avgnt.exe
C:\Users\Versuch\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-05 13:29

==================== End of log ============================

magigstar 07.07.2015 15:58
[CODE]Additional
FRST Logfile:
Code:
scan result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by DDDDD CCCCCC at 2015-07-07 16:26:46
Running from C:\Users\DDDDD CCCCCC\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDDD CCCCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDDD CCCCCC
EEEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-PDF Split & Merge Version 2.5.0 (Build 168) (HKLM-x32\...\7-PDF Split & Merge_is1) (Version: 7-PDF Split & Merge - Version 2.5.0 (Build 168) - 7-PDF, Germany - Thorsten Hodes)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
BitTorrent (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\BitTorrent) (Version: 7.9.2.31638 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Booster-Web (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Booster-Web) (Version: 4 - ${CompanyName})
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.8.8 (HKLM-x32\...\{CD252A60-0965-11E5-B3A2-00505695D7B0}) (Version: 5.8.8.7837 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GoToMeeting 7.2.1.2856 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.2.1.2856 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{4046F74A-28F8-48C6-A5D3-2AFC472574C1}) (Version: 12.2.0.145 - Apple Inc.)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - Daniel Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.14 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.36.164 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\DDDDD CCCCCC\AppData\Roaming\moters\supna.dll No File <==== ATTENTION

==================== Restore Points =========================

14-06-2015 21:10:44 Installed Evernote v. 5.8.8
18-06-2015 19:27:17 Windows Update
23-06-2015 20:50:14 Windows Update
29-06-2015 19:19:34 Windows Update
06-07-2015 19:45:41 Geplanter Prüfpunkt
07-07-2015 15:49:26 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-02-01 09:39 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {23CEA58C-8E99-49B6-96E0-E0033F148659} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDDD CCCCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDDD CCCCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDDD CCCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDDD CCCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDDD CCCCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDDD CCCCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {82539086-8E09-40FC-A285-86E0C061AAC9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {9C395D30-C0E5-4B3A-A232-E38DA71A3827} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe [2015-06-14] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-02] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe [2015-06-14] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DANIEL~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2007-10-04 15:32 - 2007-10-04 15:32 - 00122880 _____ () C:\Program Files (x86)\Common Files\AAV\aavus.exe
2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-01-13 10:04 - 2011-01-13 10:04 - 00030080 _____ () C:\Windows\snuvcdsm.exe
2011-11-13 23:52 - 2011-11-13 23:51 - 00200704 _____ () C:\Windows\PLFSetI.exe
2009-07-29 14:10 - 2009-07-29 14:10 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-13 22:44 - 2011-11-13 22:44 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-12-28 15:38 - 2014-04-22 20:39 - 00645592 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2015-06-02 15:14 - 2015-06-02 15:14 - 00439304 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2015-06-02 15:14 - 2015-06-02 15:14 - 00321032 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\sklavenzentrale.com -> hxxps://www.sklavenzentrale.com

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 12656 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDDD CCCCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{1E4BC495-4C38-4621-B9DC-62A640FACF59}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{A8AF09D2-FC1C-488D-8177-95AE3D314F0F}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [{7D13D4A5-5C79-4DAE-A19F-6D194875984E}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9DA13F2E-A539-4FD6-B99A-D82EB07B4CE6}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{1C908166-1F33-4C13-BA56-F33806E3F4E4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{04CF711F-3CD6-4616-BD22-7A29AA935D27}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3E9BB15D-0AAE-4933-98FB-96FE7BEC0767}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{93DF0A81-48CD-4944-BC1B-543FA267B0FA}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{77FFF4B3-EF2D-442F-B347-00A9A8D0680D}] => (Allow) C:\Users\DDDDD CCCCCC\Downloads\00630\KMSpico.v9.2.3.All-in-One\KMSpico.v9.2.3.Portable\AutoPico.exe
FirewallRules: [{17D73089-DF35-422D-AF5C-7A55FB407FDC}] => (Allow) C:\Users\DDDDD CCCCCC\Downloads\00630\KMSpico.v9.2.3.All-in-One\KMSpico.v9.2.3.Portable\AutoPico.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{1226CE06-D562-40DF-B992-5B7BB4DCB067}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{2FD6414B-DA16-4740-B1DA-E7BD91895861}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDDD CCCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{16582AA1-B5F3-43CE-BD1F-50548A09DE08}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{3F412DCC-4184-4B67-8375-BBE2730A663C}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/07/2015 03:59:58 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:48:49 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:45:37 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 08:08:57 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 06:35:26 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/05/2015 01:36:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (07/07/2015 03:37:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Solutions Framework Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (07/07/2015 03:37:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HP Support Solutions Framework Service erreicht.

Error: (07/06/2015 08:09:13 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/05/2015 00:33:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/05/2015 09:00:27 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (07/04/2015 00:22:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/03/2015 05:50:51 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/02/2015 06:29:57 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (07/02/2015 05:04:57 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (07/01/2015 10:14:23 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}


Microsoft Office:
=========================
Error: (07/07/2015 03:59:58 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:48:49 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:45:37 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 08:08:57 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 06:35:26 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/05/2015 01:36:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe


CodeIntegrity Errors:
===================================
  Date: 2015-02-01 08:39:15.425
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:15.175
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:14.941
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:14.692
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.971
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.769
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.550
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.332
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-06-28 08:07:01.069
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\DANIEL~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-06-28 08:07:00.711
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\DANIEL~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Percentage of memory in use: 33%
Total physical RAM: 3956.5 MB
Available physical RAM: 2616.87 MB
Total Virtual: 7911.21 MB
Available Virtual: 5755.42 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:89.34 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:285.09 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End of log ============================
--- --- ---

schrauber 07.07.2015 17:26
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

magigstar 08.07.2015 20:13
So, einige Fehlermeldungen später und einen weiteren Neustart, weil der Firefox nicht startet wollte, läuft es jetzt... aberr auch alles behoben? Das kann ich leider nicht bestätigen.
Ein Logfile wurde nicht erstellt.
Soll ich Combofix erneut starten?


Nicht direkt auf C:\ ist die Datei, aber ich habe sie gefunden:

Code:
ComboFix 15-07-08.01 - DDDDD CCCCC 08.07.2015  20:37:16.3.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3956.2410 [GMT 2:00]
ausgeführt von:: C:\Users\DDDDD CCCCC\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files (x86)\sss
C:\Program Files (x86)\sss\licence.txt
C:\Program Files (x86)\sss\ReadMe.txt
C:\Program Files (x86)\sss\SimpleScreenshot.exe
C:\Program Files (x86)\sss\upload.php
C:\Users\DANIEL~1\AppData\Local\Temp\7zS552E\HPSLPSVC64.DLL
C:\Users\DANIEL~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\HPSLPSVC64.DLL
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll


(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_HPSLPSVC


(((((((((((((((((((((((  Dateien erstellt von 2015-06-08 bis 2015-07-08  ))))))))))))))))))))))))))))))


2015-07-08 18:50:58 . 2015-07-08 18:50:58        --------        d-----w-        C:\Users\Versuch\AppData\Local\temp
2015-07-08 18:50:58 . 2015-07-08 18:50:58        --------        d-----w-        C:\Users\Public\AppData\Local\temp
2015-07-08 18:50:58 . 2015-07-08 18:50:58        --------        d-----w-        C:\Users\Default\AppData\Local\temp
2015-07-08 18:50:57 . 2015-07-08 18:50:57        --------        d-----w-        C:\Users\EEEEE\AppData\Local\temp
2015-07-08 18:36:28 . 2015-07-08 18:36:28        75888        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{10ACE176-4C34-4A6B-AE44-1C44071B35F5}\offreg.3892.dll
2015-07-07 13:51:34 . 2015-06-12 07:50:55        12221144        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{10ACE176-4C34-4A6B-AE44-1C44071B35F5}\mpengine.dll
2015-07-02 19:13:08 . 2015-07-02 19:13:09        --------        d-----w-        C:\Program Files (x86)\iTunes
2015-07-02 19:13:08 . 2015-07-02 19:13:08        --------        d-----w-        C:\Program Files\iPod
2015-07-02 19:13:07 . 2015-07-02 19:14:14        --------        d-----w-        C:\Program Files\iTunes
2015-07-02 18:58:41 . 2015-07-02 18:58:41        159744        ----a-w-        C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:41        159744        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:40        159744        ----a-w-        C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:40        159744        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:39        159744        ----a-w-        C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:39        159744        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:38        159744        ----a-w-        C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:38        159744        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:37        159744        ----a-w-        C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2015-07-02 18:58:41 . 2015-07-02 18:58:37        159744        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2015-07-02 18:58:04 . 2015-07-02 18:58:35        --------        d-----w-        C:\Program Files (x86)\QuickTime
2015-06-21 20:00:47 . 2015-06-21 20:11:14        --------        d-----w-        C:\Users\DDDDD CCCCC\AppData\Roaming\7-PDFSplitMerge
2015-06-21 20:00:46 . 2015-06-21 20:00:46        --------        d-----w-        C:\Program Files (x86)\7-PDF
2015-06-18 18:23:12 . 2015-06-18 18:23:12        --------        d-----w-        C:\Users\Versuch\AppData\Local\Skype
2015-06-18 18:23:04 . 2015-06-18 19:23:48        --------        d-----w-        C:\Users\Versuch\AppData\Roaming\Skype
2015-06-18 18:02:59 . 2015-06-18 18:02:59        --------        d-----w-        C:\Users\Versuch\AppData\Local\GWX
2015-06-16 22:23:50 . 2015-06-16 22:23:50        94208        ----a-w-        C:\Windows\SysWow64\QuickTimeVR.qtx
2015-06-16 22:23:50 . 2015-06-16 22:23:50        69632        ----a-w-        C:\Windows\SysWow64\QuickTime.qts
2015-06-10 20:00:08 . 2015-04-29 18:22:09        14635008        ----a-w-        C:\Windows\system32\wmp.dll
2015-06-10 19:57:50 . 2015-05-22 18:18:22        1021440        ----a-w-        C:\Windows\system32\appraiser.dll
2015-06-10 19:56:51 . 2015-04-24 18:17:26        633856        ----a-w-        C:\Windows\system32\comctl32.dll
2015-06-10 19:56:51 . 2015-04-24 17:56:58        530432        ----a-w-        C:\Windows\SysWow64\comctl32.dll
2015-06-10 19:56:47 . 2015-05-25 17:08:39        3206144        ----a-w-        C:\Windows\system32\win32k.sys
.


((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2015-07-02 18:54:55 . 2012-04-02 18:28:57        778416        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe
2015-07-02 18:54:55 . 2011-11-15 20:21:42        142512        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2015-06-23 11:30:20 . 2011-11-15 20:40:17        300704        ------w-        C:\Windows\system32\MpSigStub.exe
2015-06-18 17:33:27 . 2013-03-29 19:10:43        153256        ----a-w-        C:\Windows\system32\drivers\avgntflt.sys
2015-06-18 17:33:27 . 2013-03-29 19:10:43        132656        ----a-w-        C:\Windows\system32\drivers\avipbb.sys
2015-06-11 16:33:49 . 2011-11-18 18:58:12        140135120        ----a-w-        C:\Windows\system32\MRT.exe
2015-05-25 18:01:17 . 2015-06-10 19:57:20        44032        ----a-w-        C:\Windows\apppatch\acwow64.dll
2015-05-01 13:17:03 . 2015-05-13 21:54:43        124112        ----a-w-        C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-01 13:16:41 . 2015-05-13 21:54:43        102608        ----a-w-        C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-04-20 03:17:07 . 2015-05-13 17:56:52        1179136        ----a-w-        C:\Windows\system32\FntCache.dll
2015-04-20 03:17:07 . 2015-05-13 17:56:51        1647104        ----a-w-        C:\Windows\system32\DWrite.dll
2015-04-20 02:56:29 . 2015-05-13 17:56:49        1250816        ----a-w-        C:\Windows\SysWow64\DWrite.dll
2015-04-18 03:10:57 . 2015-05-13 17:59:21        460800        ----a-w-        C:\Windows\system32\certcli.dll
2015-04-18 02:56:57 . 2015-05-13 17:59:21        342016        ----a-w-        C:\Windows\SysWow64\certcli.dll
2015-04-13 03:28:33 . 2015-05-13 17:57:42        328704        ----a-w-        C:\Windows\system32\services.exe

schrauber 09.07.2015 08:37
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

magigstar 10.07.2015 20:15
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 10.07.2015
Suchlauf-Zeit: 19:36:21
Logdatei: Malwarebytes Anti-Malware.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.07.10.05
Rootkit Datenbank: v2015.07.10.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DDDDD CCCCC

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 471107
Verstrichene Zeit: 36 Min, 55 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 42
PUP.Optional.SearchModule.A, HKLM\SOFTWARE\SearchModulePlus, In Quarantäne, [77a6db052961e74f5523ddaec93b7f81],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataContainer, In Quarantäne, [021b954b5f2bac8ade6d10f3966dc040],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataContainer.1, In Quarantäne, [b4699f415b2fdf57e269847ffc077f81],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataController, In Quarantäne, [77a6657b494161d556f53ec58c77a25e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataController.1, In Quarantäne, [26f789578604bc7aef5cca397a89c53b],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTable, In Quarantäne, [b06d27b98ffb1026341702019a69a15f],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTable.1, In Quarantäne, [29f4f1ef96f45adc54f7ec17778c1be5],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableFields, In Quarantäne, [58c5558b8dfd6bcb79d2f80b34cfe020],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableFields.1, In Quarantäne, [908deaf6b5d5999d68e37f84c63d9967],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableHolder, In Quarantäne, [1a03e6faef9bad89480339cadf24ad53],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableHolder.1, In Quarantäne, [fe1fce1298f2c96df6557f84d33015eb],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.LSPLogic, In Quarantäne, [41dcc0200e7c61d557f427dccf344eb2],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.LSPLogic.1, In Quarantäne, [8499f2ee107a1e18d873877ceb180000],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.ReadOnlyManager, In Quarantäne, [889531af6822eb4b9bb03cc72bd86e92],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.ReadOnlyManager.1, In Quarantäne, [130ac21e0d7d64d2c487d33043c0837d],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\APPID\abengine.EXE, In Quarantäne, [130a26ba6525de585819622d887c22de],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\abengine.EXE, In Quarantäne, [4bd2c21ec9c13cfae28fa8e712f2f60a],
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32LDR, In Quarantäne, [0a13439d335794a2b0a047474fb5fc04],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv, In Quarantäne, [6ab3518f54362214593c65a5649fef11],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv-ie, In Quarantäne, [b26b98487c0eb482771e5bafb74cc43c],
PUP.Optional.SearchModule.A, HKLM\SOFTWARE\WOW6432NODE\SearchModulePlus, In Quarantäne, [5dc006dab5d515210870701b8b7949b7],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataContainer, In Quarantäne, [f32a13cd0387979ffe4dae5556ad6c94],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataContainer.1, In Quarantäne, [2df0914f1a7088ae361516edd1325aa6],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataController, In Quarantäne, [bb62d60a4a40f93d5cef0cf74bb86c94],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataController.1, In Quarantäne, [c9549e424248fe382e1db251c43fc23e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTable, In Quarantäne, [24f9a93731598da92c1fe51e34cfdc24],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTable.1, In Quarantäne, [7da033ad97f3f54199b2a85b8182837d],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableFields, In Quarantäne, [22fb5e82fd8d280e63e834cfad5603fd],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableFields.1, In Quarantäne, [0e0f59874248aa8c7ecd3fc4aa5901ff],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableHolder, In Quarantäne, [0a133da3f4962016ee5d679c748f27d9],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableHolder.1, In Quarantäne, [100d5c84b3d7e65098b3ef1450b3629e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.LSPLogic, In Quarantäne, [d845ffe1078338fe6fdc2ad942c15fa1],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.LSPLogic.1, In Quarantäne, [3ce19f416327d85e90bbc24144bf17e9],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.ReadOnlyManager, In Quarantäne, [e93405db810955e1b497f50e0af9e61a],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.ReadOnlyManager.1, In Quarantäne, [7f9ed60a662481b56ae15ba81be8f20e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\abengine.EXE, In Quarantäne, [6cb134ac701acf67c2af256a6a9ac040],
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV, In Quarantäne, [f4297c64fb8f6cca7f3f2cd7a45f8977],
PUP.Optional.Crossrider.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, In Quarantäne, [8994d0102f5bd462cce3cebad62e4ab6],
PUP.Optional.Moters.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\ningsup, In Quarantäne, [df3e1bc5602ae55112abfa093bc88d73],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Object Browser-nv, In Quarantäne, [f528a13f107a1224a7efa96148bbc13f],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Object Browser-nv-ie, In Quarantäne, [bc613da33159a6906630e921669d50b0],
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\SearchProtectWS, In Quarantäne, [dd4068786d1d70c6b1983eceee151de3],

Registrierungswerte: 11
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [56c712ce157591a5034c484655af1be5]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.xxx|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [28f517c992f81f174d02d1bda26212ee]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [28f5f0f0167413234c034648aa5a7d83]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [6eafbc246723cf67440bc7c734d0728e]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SettingsManagerSetup.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [ff1e4f9167236ccac38cc0ce9a6a4fb1]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iLivid.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [36e7ebf5424842f4dd72e0ae8b79916f]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iMesh.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [f9244b95008ae94dd57a533be71d13ed]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_removal_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [48d5a739503a043209466529877dc739]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_reporter_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [e23b3da31b6fb28465ea1777f11360a0]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [0a13439d335794a2b0a047474fb5fc04]
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV|affid, 4435, In Quarantäne, [f4297c64fb8f6cca7f3f2cd7a45f8977]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 1
PUP.Optional.SearchModulePlus.A, C:\ProgramData\SearchModulePlus, In Quarantäne, [c5584c946f1bec4aa71b99623ac87b85],

Dateien: 3
Rootkit.Agent.A, C:\Windows\System32\ColorMedia64.dll, In Quarantäne, [c954d20e2565f4421cdf87d8a36228d8],
PUP.Optional.Winsock.HijackBoot, C:\Windows\System32\ColorMedia64.dll, In Quarantäne, [e13c8f51810947ef76900d76d0347090],
PUP.Optional.SearchModulePlus.A, C:\ProgramData\SearchModulePlus\smhe.js, In Quarantäne, [c5584c946f1bec4aa71b99623ac87b85],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 10.07.2015
Suchlauf-Zeit: 19:36:21
Logdatei: Malwarebytes Anti-Malware 2.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.07.10.05
Rootkit Datenbank: v2015.07.10.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DDDDD CCCCC

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 471107
Verstrichene Zeit: 36 Min, 55 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 42
PUP.Optional.SearchModule.A, HKLM\SOFTWARE\SearchModulePlus, In Quarantäne, [77a6db052961e74f5523ddaec93b7f81],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataContainer, In Quarantäne, [021b954b5f2bac8ade6d10f3966dc040],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataContainer.1, In Quarantäne, [b4699f415b2fdf57e269847ffc077f81],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataController, In Quarantäne, [77a6657b494161d556f53ec58c77a25e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataController.1, In Quarantäne, [26f789578604bc7aef5cca397a89c53b],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTable, In Quarantäne, [b06d27b98ffb1026341702019a69a15f],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTable.1, In Quarantäne, [29f4f1ef96f45adc54f7ec17778c1be5],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableFields, In Quarantäne, [58c5558b8dfd6bcb79d2f80b34cfe020],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableFields.1, In Quarantäne, [908deaf6b5d5999d68e37f84c63d9967],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableHolder, In Quarantäne, [1a03e6faef9bad89480339cadf24ad53],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.DataTableHolder.1, In Quarantäne, [fe1fce1298f2c96df6557f84d33015eb],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.LSPLogic, In Quarantäne, [41dcc0200e7c61d557f427dccf344eb2],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.LSPLogic.1, In Quarantäne, [8499f2ee107a1e18d873877ceb180000],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.ReadOnlyManager, In Quarantäne, [889531af6822eb4b9bb03cc72bd86e92],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\abengineLib.ReadOnlyManager.1, In Quarantäne, [130ac21e0d7d64d2c487d33043c0837d],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\APPID\abengine.EXE, In Quarantäne, [130a26ba6525de585819622d887c22de],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\abengine.EXE, In Quarantäne, [4bd2c21ec9c13cfae28fa8e712f2f60a],
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32LDR, In Quarantäne, [0a13439d335794a2b0a047474fb5fc04],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv, In Quarantäne, [6ab3518f54362214593c65a5649fef11],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv-ie, In Quarantäne, [b26b98487c0eb482771e5bafb74cc43c],
PUP.Optional.SearchModule.A, HKLM\SOFTWARE\WOW6432NODE\SearchModulePlus, In Quarantäne, [5dc006dab5d515210870701b8b7949b7],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataContainer, In Quarantäne, [f32a13cd0387979ffe4dae5556ad6c94],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataContainer.1, In Quarantäne, [2df0914f1a7088ae361516edd1325aa6],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataController, In Quarantäne, [bb62d60a4a40f93d5cef0cf74bb86c94],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataController.1, In Quarantäne, [c9549e424248fe382e1db251c43fc23e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTable, In Quarantäne, [24f9a93731598da92c1fe51e34cfdc24],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTable.1, In Quarantäne, [7da033ad97f3f54199b2a85b8182837d],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableFields, In Quarantäne, [22fb5e82fd8d280e63e834cfad5603fd],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableFields.1, In Quarantäne, [0e0f59874248aa8c7ecd3fc4aa5901ff],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableHolder, In Quarantäne, [0a133da3f4962016ee5d679c748f27d9],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.DataTableHolder.1, In Quarantäne, [100d5c84b3d7e65098b3ef1450b3629e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.LSPLogic, In Quarantäne, [d845ffe1078338fe6fdc2ad942c15fa1],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.LSPLogic.1, In Quarantäne, [3ce19f416327d85e90bbc24144bf17e9],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.ReadOnlyManager, In Quarantäne, [e93405db810955e1b497f50e0af9e61a],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\abengineLib.ReadOnlyManager.1, In Quarantäne, [7f9ed60a662481b56ae15ba81be8f20e],
PUP.Optional.Abengine.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\abengine.EXE, In Quarantäne, [6cb134ac701acf67c2af256a6a9ac040],
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV, In Quarantäne, [f4297c64fb8f6cca7f3f2cd7a45f8977],
PUP.Optional.Crossrider.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, In Quarantäne, [8994d0102f5bd462cce3cebad62e4ab6],
PUP.Optional.Moters.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\ningsup, In Quarantäne, [df3e1bc5602ae55112abfa093bc88d73],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Object Browser-nv, In Quarantäne, [f528a13f107a1224a7efa96148bbc13f],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Object Browser-nv-ie, In Quarantäne, [bc613da33159a6906630e921669d50b0],
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\SearchProtectWS, In Quarantäne, [dd4068786d1d70c6b1983eceee151de3],

Registrierungswerte: 11
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [56c712ce157591a5034c484655af1be5]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.xxx|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [28f517c992f81f174d02d1bda26212ee]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [28f5f0f0167413234c034648aa5a7d83]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [6eafbc246723cf67440bc7c734d0728e]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SettingsManagerSetup.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [ff1e4f9167236ccac38cc0ce9a6a4fb1]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iLivid.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [36e7ebf5424842f4dd72e0ae8b79916f]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iMesh.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [f9244b95008ae94dd57a533be71d13ed]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_removal_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [48d5a739503a043209466529877dc739]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_reporter_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [e23b3da31b6fb28465ea1777f11360a0]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130671647497430819, In Quarantäne, [0a13439d335794a2b0a047474fb5fc04]
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV|affid, 4435, In Quarantäne, [f4297c64fb8f6cca7f3f2cd7a45f8977]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 1
PUP.Optional.SearchModulePlus.A, C:\ProgramData\SearchModulePlus, In Quarantäne, [c5584c946f1bec4aa71b99623ac87b85],

Dateien: 3
Rootkit.Agent.A, C:\Windows\System32\ColorMedia64.dll, In Quarantäne, [c954d20e2565f4421cdf87d8a36228d8],
PUP.Optional.Winsock.HijackBoot, C:\Windows\System32\ColorMedia64.dll, In Quarantäne, [e13c8f51810947ef76900d76d0347090],
PUP.Optional.SearchModulePlus.A, C:\ProgramData\SearchModulePlus\smhe.js, In Quarantäne, [c5584c946f1bec4aa71b99623ac87b85],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)


Weiteres folgt...

Code:
# AdwCleaner v4.109 - Bericht erstellt am 10/07/2015 um 20:44:58
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-07-10.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : DDDDD CCCCC - ARBEITSCOMPUTER
# Gestartet von : C:\Users\DDDDD CCCCC\Desktop\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\DDDDD CCCCC\AppData\Local\StormFall
Ordner Gelöscht : C:\Users\DDDDD CCCCC\AppData\LocalLow\Booster-Web
Ordner Gelöscht : C:\Users\DDDDD CCCCC\AppData\Roaming\Booster-Web
Ordner Gelöscht : C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Booster-Web
Datei Gelöscht : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb

***** [ Tasks ] *****

Task Gelöscht : amiupdaterExd
Task Gelöscht : amiupdaterExi

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\YTDownloader.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SysMenuExt
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\SysMenu.DLL
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}
Schlüssel Gelöscht : HKLM\System\CurrentControlSet\Services\Eventlog\Application\registry helper service
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D813D5BB-EBC7-45F9-B8A4-36A305168069}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{028F96B8-C73A-4C60-B82F-3944A19B046E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{51F7DE65-A990-4213-BDB9-C2657FA7F3F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{879F721E-7F23-4B7F-B65B-F5A8F518864A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B9EE49F9-62A3-408D-858F-4ED9A23BAA24}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BF6D8439-BAC1-4E73-94FE-9910D098AE00}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4F14684-336F-44FC-8D9E-8A73DAE003EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\SiteSee
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v39.0 (x86 de)


-\\ Google Chrome v43.0.2357.132

[C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=58&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&q={searchTerms}&SSPV=
[C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.softonic.com/s/{searchTerms}

-\\ Opera v0.0.0.0

[C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=58&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&q={searchTerms}&SSPV=
[C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.softonic.com/s/{searchTerms}

*************************

AdwCleaner[R0].txt - [4287 octets] - [24/08/2014 19:37:07]
AdwCleaner[R1].txt - [2884 octets] - [30/11/2014 00:16:17]
AdwCleaner[R2].txt - [29703 octets] - [31/01/2015 16:04:28]
AdwCleaner[R3].txt - [3646 octets] - [10/07/2015 20:29:47]
AdwCleaner[S0].txt - [4164 octets] - [24/08/2014 19:55:28]
AdwCleaner[S1].txt - [2721 octets] - [30/11/2014 00:19:24]
AdwCleaner[S2].txt - [30134 octets] - [31/01/2015 16:08:01]
AdwCleaner[S3].txt - [4041 octets] - [10/07/2015 20:44:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [4101 octets] ##########

Der FF braucht aber immer noch ewig....

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.4.1 (07.10.2015:2)
OS: Windows 7 Home Premium x64
Ran by DDDDD CCCCC on 10.07.2015 at 20:56:52,15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\DDDDD CCCCC\appdata\local\installer
Successfully deleted: [Folder] C:\Users\DDDDD CCCCC\appdata\local\worldoftanks
Successfully deleted: [Folder] C:\Users\DDDDD CCCCC\AppData\Roaming\productdata
Successfully deleted: [Folder] C:\Windows\syswow64\amd64



~~~ FireFox

Emptied folder: C:\Users\DDDDD CCCCC\AppData\Roaming\mozilla\firefox\profiles\yeqh8rsa.default-1427619462807\minidumps [3 files]



~~~ Chrome


[C:\Users\DDDDD CCCCC\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\DDDDD CCCCC\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\DDDDD CCCCC\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\DDDDD CCCCC\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.07.2015 at 21:01:18,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ok, etwas schneller....

Das FRST....

Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by DDDDD CCCCC (administrator) on ARBEITSCOMPUTER on 10-07-2015 21:03:11
Running from C:\Users\DDDDD CCCCC\Desktop
Loaded Profiles: DDDDD CCCCC (Available Profiles: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe [3942216 2011-01-25] (O&O Software GmbH)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [SimpleScreenshot] => C:\PROGRA~2\SSS\SIMPLESCREENSHOT.EXE
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-12-06]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-06-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807
FF Homepage: hxxp://www.trojaner-board.de/168515-langsamer-firefox-stoert.html#post1485617
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-07-02] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-02] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-07-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-07-02] (Apple Inc.)
FF SearchPlugin: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807\searchplugins\youtube-videosuche.xml [2015-05-30]
FF Extension: LeechBlock - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\yeqh8rsa.default-1427619462807\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2015-03-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Slides) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-01]
CHR Extension: (Google Docs) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-22]
CHR Extension: (Google Search) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (Google Sheets) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-01]
CHR Extension: (Avira Browser Safety) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-26]
CHR Extension: (Gmail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [File not signed]
S2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [File not signed]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [File not signed]
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-11] (Avira Operations GmbH & Co. KG)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-07-10] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 ALSysIO; \??\C:\Users\DDDDD~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-10 21:03 - 2015-07-10 21:03 - 00022563 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-07-10 21:01 - 2015-07-10 21:01 - 00001646 _____ C:\Users\DDDDD CCCCC\Desktop\JRT.txt
2015-07-10 20:55 - 2015-07-10 18:51 - 03033806 _____ (Malwarebytes Corporation) C:\Users\DDDDD CCCCC\Desktop\JRT_NEW.exe
2015-07-10 20:47 - 2015-07-10 20:47 - 00004135 _____ C:\Users\DDDDD CCCCC\Desktop\AdwCleaner[S3].txt
2015-07-10 20:44 - 2015-07-10 20:44 - 00003646 _____ C:\Users\DDDDD CCCCC\Desktop\AdwCleaner[R3].txt
2015-07-10 20:26 - 2015-07-10 20:26 - 00009656 _____ C:\Users\DDDDD CCCCC\Desktop\Malwarebytes Anti-Malware 2.txt
2015-07-10 20:26 - 2015-07-10 20:26 - 00009654 _____ C:\Users\DDDDD CCCCC\Desktop\Malwarebytes Anti-Malware.txt
2015-07-08 20:32 - 2015-07-08 21:07 - 00000000 ____D C:\ComboFix
2015-07-08 20:29 - 2015-07-08 20:29 - 05632279 ____R (Swearware) C:\Users\DDDDD CCCCC\Desktop\ComboFix.exe
2015-07-07 16:24 - 2015-07-07 16:24 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-07-07 16:23 - 2015-07-07 16:23 - 00000323 _____ C:\Users\DDDDD CCCCC\Desktop\wissen.URL
2015-07-07 16:23 - 2015-07-07 16:23 - 00000273 _____ C:\Users\DDDDD CCCCC\Desktop\BeYourBest - mehr Erfolg im Leben.URL
2015-07-07 16:23 - 2015-07-07 16:23 - 00000268 _____ C:\Users\DDDDD CCCCC\Desktop\BeYourBest_Schmetterlingsprinzip.pdf.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000292 _____ C:\Users\DDDDD CCCCC\Desktop\Lebenslauf erklären karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000289 _____ C:\Users\DDDDD CCCCC\Desktop\Jobangeboten karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000280 _____ C:\Users\DDDDD CCCCC\Desktop\Berufsanfänger karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000257 _____ C:\Users\DDDDD CCCCC\Desktop\karrierebibel.de.URL
2015-07-07 16:22 - 2015-07-07 16:22 - 00000248 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstmotivation lernen Was uns wirklich anspornt karrierebibel.de.URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000303 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstvertraue.URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000258 _____ C:\Users\DDDDD CCCCC\Desktop\Hoppla, dieser Inhalt ist nur für Kunden….URL
2015-07-07 16:21 - 2015-07-07 16:21 - 00000245 _____ C:\Users\DDDDD CCCCC\Desktop\Willenskraft.URL
2015-07-07 16:20 - 2015-07-07 16:20 - 00000285 _____ C:\Users\DDDDD CCCCC\Desktop\Freiburg e.V..URL
2015-07-07 16:20 - 2015-07-07 16:20 - 00000250 _____ C:\Users\DDDDD CCCCC\Desktop\Mitmachen! «.URL
2015-07-07 15:54 - 2015-07-07 15:54 - 00009111 _____ C:\Users\DDDDD CCCCC\Downloads\Mappe1.xlsx
2015-07-05 12:32 - 2015-07-05 12:32 - 00011869 _____ C:\Users\DDDDD CCCCC\Desktop\Riester + PRV.xlsx
2015-07-05 10:17 - 2015-07-05 10:17 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5
2015-07-04 09:04 - 2015-07-04 09:04 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner
2015-07-02 21:14 - 2015-07-02 21:14 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-07-02 21:14 - 2015-07-02 21:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-07-02 21:13 - 2015-07-02 21:14 - 00000000 ____D C:\Program Files\iTunes
2015-07-02 21:13 - 2015-07-02 21:13 - 00000000 ____D C:\Program Files\iPod
2015-07-02 21:13 - 2015-07-02 21:13 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-07-02 20:58 - 2015-07-02 20:58 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-07-02 20:58 - 2015-07-02 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-07-02 20:58 - 2015-07-02 20:58 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-06-21 22:00 - 2015-06-21 22:11 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\7-PDFSplitMerge
2015-06-21 22:00 - 2015-06-21 22:10 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\7-PDF Split & Merge
2015-06-21 22:00 - 2015-06-21 22:00 - 01437252 _____ (7-PDF, Germany ) C:\Users\DDDDD CCCCC\Downloads\7-PDFSplitMerge.exe
2015-06-21 22:00 - 2015-06-21 22:00 - 00001204 _____ C:\Users\Public\Desktop\7-PDF Split & Merge.lnk
2015-06-21 22:00 - 2015-06-21 22:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-PDF
2015-06-21 22:00 - 2015-06-21 22:00 - 00000000 ____D C:\Program Files (x86)\7-PDF
2015-06-21 09:17 - 2015-06-21 09:17 - 00008805 _____ C:\Users\DDDDD CCCCC\Downloads\20150621-101768265-umsatz.CSV
2015-06-18 20:23 - 2015-06-18 21:23 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\Skype
2015-06-18 20:23 - 2015-06-18 20:23 - 00000000 ____D C:\Users\Versuch\AppData\Local\Skype
2015-06-18 20:02 - 2015-06-18 20:02 - 00000000 ____D C:\Users\Versuch\AppData\Local\GWX
2015-06-17 00:23 - 2015-06-17 00:23 - 00094208 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
2015-06-17 00:23 - 2015-06-17 00:23 - 00069632 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
2015-06-14 21:13 - 2015-06-14 21:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-06-11 21:21 - 2015-06-11 21:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-06-11 21:21 - 2015-06-11 21:21 - 00002011 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-06-10 22:03 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 22:03 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 22:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 22:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 22:03 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 22:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 22:03 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 22:03 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 22:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 22:03 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 22:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 22:03 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 22:03 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 22:03 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 22:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 22:03 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 22:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 22:03 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 22:03 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 22:03 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 22:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 22:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 22:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 22:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 22:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 22:03 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 22:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 22:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 22:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 22:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 22:03 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 22:03 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 22:03 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 22:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 22:03 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 22:03 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 22:03 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 22:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 22:03 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 22:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 22:03 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 22:03 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 22:03 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 22:03 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 22:03 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 22:03 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 22:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 22:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 22:03 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 22:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 22:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 22:03 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 22:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 22:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 22:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 22:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 22:03 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-10 22:00 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 22:00 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 22:00 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 22:00 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 22:00 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 22:00 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 22:00 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 22:00 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 22:00 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 22:00 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 21:57 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 21:57 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 21:57 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 21:57 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 21:57 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 21:57 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 21:57 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 21:57 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 21:57 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 21:57 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 21:57 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 21:57 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 21:57 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 21:57 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 21:57 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 21:57 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 21:57 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 21:57 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 21:57 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 21:57 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 21:57 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 21:57 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 21:57 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 21:57 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 21:57 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 21:56 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 21:56 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 21:56 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-10 21:03 - 2014-08-21 21:10 - 00000000 ____D C:\FRST
2015-07-10 20:57 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-10 20:57 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-10 20:55 - 2011-11-13 22:43 - 01527713 _____ C:\Windows\WindowsUpdate.log
2015-07-10 20:46 - 2014-06-18 09:20 - 00041186 _____ C:\Windows\setupact.log
2015-07-10 20:46 - 2012-09-20 05:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-10 20:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-10 20:45 - 2014-08-24 19:36 - 00000000 ____D C:\AdwCleaner
2015-07-10 20:45 - 2014-06-20 14:07 - 00305956 _____ C:\Windows\PFRO.log
2015-07-10 20:28 - 2012-09-20 05:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-10 20:25 - 2014-08-05 15:08 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-10 20:23 - 2015-06-08 17:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-07-10 20:20 - 2015-05-31 14:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-07-10 20:05 - 2012-08-14 19:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-10 19:33 - 2015-01-31 16:22 - 00001066 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-10 19:33 - 2014-08-05 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-10 19:33 - 2014-08-05 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-08 21:04 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-07-08 20:57 - 2009-07-14 04:34 - 67108864 _____ C:\Windows\system32\config\components.bak
2015-07-08 20:57 - 2009-07-14 04:34 - 05386240 _____ C:\Windows\system32\config\default.bak
2015-07-08 20:57 - 2009-07-14 04:34 - 00098304 _____ C:\Windows\system32\config\sam.bak
2015-07-08 20:57 - 2009-07-14 04:34 - 00032768 _____ C:\Windows\system32\config\security.bak
2015-07-08 20:51 - 2013-10-13 20:47 - 00000000 ____D C:\Windows\erdnt
2015-07-08 20:33 - 2014-08-24 13:03 - 00000000 ____D C:\Qoobox
2015-07-07 17:49 - 2014-08-06 11:55 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-07 17:49 - 2013-02-24 20:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-07 17:49 - 2013-02-24 20:39 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-07 16:50 - 2012-04-07 12:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-07-07 16:24 - 2015-02-10 19:48 - 02112512 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-07-07 15:35 - 2014-11-10 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-05 13:07 - 2014-11-16 13:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-05 10:55 - 2012-03-25 12:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-07-02 21:13 - 2012-01-29 15:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-07-02 21:12 - 2015-04-23 13:54 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-07-02 20:55 - 2014-08-15 16:44 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Adobe
2015-07-02 20:54 - 2012-04-02 20:28 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-02 20:54 - 2012-04-02 20:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-02 20:54 - 2011-11-15 22:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-29 19:28 - 2015-05-25 19:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-23 13:30 - 2011-11-15 22:40 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-21 15:29 - 2014-08-07 21:56 - 03392512 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-06-21 11:50 - 2014-09-10 07:10 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\SimpleScreenshot
2015-06-20 15:37 - 2011-11-14 07:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-06-20 15:37 - 2011-11-14 07:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-06-20 15:37 - 2009-07-14 07:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-18 20:23 - 2014-09-23 19:09 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-06-18 20:23 - 2013-11-02 10:43 - 00000000 ____D C:\ProgramData\Skype
2015-06-18 20:22 - 2014-09-23 19:09 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2015-06-18 20:22 - 2014-09-23 19:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-06-18 20:08 - 2014-09-10 07:15 - 00000000 ____D C:\Users\Versuch\AppData\Roaming\Avira
2015-06-18 20:03 - 2014-12-06 15:40 - 00002211 _____ C:\Users\Versuch\Desktop\Google Chrome.lnk
2015-06-18 19:33 - 2013-03-29 21:10 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-18 19:33 - 2013-03-29 21:10 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-14 16:48 - 2015-06-08 17:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-06-14 16:48 - 2015-05-31 14:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-06-14 13:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-12 21:54 - 2011-11-14 00:16 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Adobe
2015-06-12 17:09 - 2013-02-24 20:39 - 00000000 ____D C:\ProgramData\Avira
2015-06-11 21:21 - 2009-11-05 02:38 - 00000000 ____D C:\ProgramData\Adobe
2015-06-11 21:21 - 2009-11-05 02:38 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-11 19:47 - 2009-07-14 06:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 19:38 - 2014-12-12 21:57 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 19:38 - 2014-05-03 08:02 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 19:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 19:37 - 2014-03-28 23:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-06-11 19:36 - 2009-11-05 05:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 19:36 - 2009-07-14 04:34 - 00000648 _____ C:\Windows\win.ini
2015-06-11 19:00 - 2013-07-13 09:36 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 18:33 - 2011-11-18 20:58 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-06-28 08:10 - 2014-07-23 22:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 21:51 - 2015-02-22 15:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 19:28 - 2014-07-07 02:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 22:07 - 2014-09-22 22:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-05-15 11:36 - 2015-05-15 11:36 - 0006486 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 22:15 - 2013-08-12 22:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 11:26 - 2012-03-31 11:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 23:53 - 2011-11-13 23:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 20:19 - 2014-10-06 20:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe
C:\Users\DDDDD CCCCC\AppData\Local\Temp\Quarantine.exe
C:\Users\DDDDD CCCCC\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-05 13:29

==================== End of log ============================

magigstar 10.07.2015 20:17
Addition...

[CODE]Additional
FRST Logfile:
Code:
scan result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by DDDD CCCCCC at 2015-07-10 21:04:24
Running from C:\Users\DDDD CCCCCC\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDD CCCCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDD CCCCCC
EEEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-PDF Split & Merge Version 2.5.0 (Build 168) (HKLM-x32\...\7-PDF Split & Merge_is1) (Version: 7-PDF Split & Merge - Version 2.5.0 (Build 168) - 7-PDF, Germany - Thorsten Hodes)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
BitTorrent (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\BitTorrent) (Version: 7.9.2.31638 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Booster-Web (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Booster-Web) (Version: 4 - ${CompanyName})
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.8.8 (HKLM-x32\...\{CD252A60-0965-11E5-B3A2-00505695D7B0}) (Version: 5.8.8.7837 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.132 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GoToMeeting 7.2.1.2856 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.2.1.2856 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{4046F74A-28F8-48C6-A5D3-2AFC472574C1}) (Version: 12.2.0.145 - Apple Inc.)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - DDDD Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.14 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.36.164 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3054791) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{591150FB-47D4-495C-9E76-F8D354A2577D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\DDDD CCCCCC\AppData\Roaming\moters\supna.dll No File <==== ATTENTION

==================== Restore Points =========================

14-06-2015 21:10:44 Installed Evernote v. 5.8.8
18-06-2015 19:27:17 Windows Update
23-06-2015 20:50:14 Windows Update
29-06-2015 19:19:34 Windows Update
06-07-2015 19:45:41 Geplanter Prüfpunkt
07-07-2015 15:49:26 Windows Update
10-07-2015 19:06:37 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-02-01 09:39 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {23CEA58C-8E99-49B6-96E0-E0033F148659} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDD CCCCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDD CCCCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDD CCCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDD CCCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDD CCCCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDD CCCCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {82539086-8E09-40FC-A285-86E0C061AAC9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {9C395D30-C0E5-4B3A-A232-E38DA71A3827} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe [2015-06-14] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-02] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe [2015-06-14] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DDDD~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCCCC\AppData\Local\Citrix\GoToMeeting\2856\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\google.com -> hxxps://www.google.com

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 12656 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDD CCCCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{1E4BC495-4C38-4621-B9DC-62A640FACF59}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{A8AF09D2-FC1C-488D-8177-95AE3D314F0F}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [{7D13D4A5-5C79-4DAE-A19F-6D194875984E}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9DA13F2E-A539-4FD6-B99A-D82EB07B4CE6}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{1C908166-1F33-4C13-BA56-F33806E3F4E4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{04CF711F-3CD6-4616-BD22-7A29AA935D27}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3E9BB15D-0AAE-4933-98FB-96FE7BEC0767}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{93DF0A81-48CD-4944-BC1B-543FA267B0FA}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{77FFF4B3-EF2D-442F-B347-00A9A8D0680D}] => (Allow) C:\Users\DDDD CCCCCC\Downloads\00630\KMSpico.v9.2.3.All-in-One\KMSpico.v9.2.3.Portable\AutoPico.exe
FirewallRules: [{17D73089-DF35-422D-AF5C-7A55FB407FDC}] => (Allow) C:\Users\DDDD CCCCCC\Downloads\00630\KMSpico.v9.2.3.All-in-One\KMSpico.v9.2.3.Portable\AutoPico.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{1226CE06-D562-40DF-B992-5B7BB4DCB067}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{2FD6414B-DA16-4740-B1DA-E7BD91895861}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDD CCCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{3F412DCC-4184-4B67-8375-BBE2730A663C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{AB868FAD-3F39-4ECA-9523-21AA1FBF695D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/08/2015 08:25:20 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:59:58 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:48:49 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:45:37 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 08:08:57 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 06:35:26 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/05/2015 01:36:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (07/10/2015 08:57:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/10/2015 08:57:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/10/2015 08:57:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management & Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Matrix Storage Event Monitor" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/10/2015 08:57:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Raw Socket Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "O&O Defrag" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Support Solutions Framework Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/10/2015 08:57:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "GRegService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (07/08/2015 08:25:20 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:59:58 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:48:49 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/07/2015 03:45:37 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 08:08:57 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/06/2015 06:35:26 PM) (Source: Adobe Reader) (EventID: 16) (User: )
Description:

Error: (07/05/2015 01:36:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe

Error: (07/05/2015 01:33:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe


CodeIntegrity Errors:
===================================
  Date: 2015-07-08 20:50:01.434
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-08 20:50:01.247
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-08 20:50:01.060
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-08 20:50:00.873
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:15.425
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:15.175
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:14.941
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-01 08:39:14.692
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.971
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-24 13:21:32.769
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Percentage of memory in use: 32%
Total physical RAM: 3956.5 MB
Available physical RAM: 2687.19 MB
Total Virtual: 7911.21 MB
Available Virtual: 6186.3 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:92.42 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:285.09 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End of log ============================
--- --- ---




An was liegt es? Wo ist das Problem? Wie kann ich es vor allem vermeiden?
Was habe ich falsch gemacht?

schrauber 11.07.2015 14:51
Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de



Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen




Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

magigstar 11.07.2015 23:31
Welchen Modus soll ich auswählen?

schrauber 12.07.2015 16:04
Moderat reicht :)

magigstar 13.07.2015 05:59
Scheinbar hat es mit dem Chrome nicht funktioniert.
Der ist immer noch da.
Hat aber auch viel viel länger gedauert als beim FF.
Und ich musste beim Chrome auch keine Einträge löschen.

Leider ist der Chrome jetzt in der Auflistung im Revo nicht mehr enthalten.
Ich müsste den Chrome noch einmal neu installieren, damit er erscheint.
Echt seltsam.

FF ist aber deinstalliert und werde ich auch installieren.



Nachdem ich den FF installiert habe, sehe ich, dass die voreingestellte Startseite da ist, wieso denn das, wenn ich doch allles gelöscht habe??

schrauber 13.07.2015 16:52
Haste beide Browser zurückgesetzt?

magigstar 17.07.2015 19:33
Nein,
denn ich dachte, der Revo Unistaller sollte doch beide Browser komplett deinstallieren.
Wenn ich also den FF nochmal installiere, sollte ja nichts da sein.
Eine Zurücksetzung sollte demnach nicht funktionieren.
Dennoch würde ich das tun, aber auch nur, wenn ich merke, dass der FF auch wirklich richtig entfernt wurde.

schrauber 18.07.2015 13:33
Zitat:
Wenn ich also den FF nochmal installiere, sollte ja nichts da sein.
Eine Zurücksetzung sollte demnach nicht funktionieren.
Dennoch würde ich das tun, aber auch nur, wenn ich merke, dass der FF auch wirklich richtig entfernt wurde.
Browser werden grundsätzlich, auch mit Revo, nie komplet entfernt. Ich poste die Anleitung nicht aus Spass so, das hat schon seinen Sinn ;)

magigstar 18.07.2015 18:26
Ok,
ich werde das also so ausführen....

Das Revo dauert aber ganz schön lange, auch nur der moderate Teil.

schrauber 19.07.2015 14:06
was meinst Du genau? Bei mir nie mehr als 5 oder 6 Minuten.

magigstar 19.07.2015 17:58
Ok, dann kann irgendwas nicht funktionieren... bei mir dauert es beträchlich länger.. bleibt immer beim 3. Punkt stehen...

schrauber 20.07.2015 07:52
Welcher Punkt genau? Ist der programmeigene Uninstaller schon durch? Adminrechte?

magigstar 20.07.2015 18:52
Zitat:
Zitat von schrauber (Beitrag 1489607)
Welcher Punkt genau? Ist der programmeigene Uninstaller schon durch? Adminrechte?
Ich starte das Programm...
Klicke auf "Ja"
Suche das zu deinstallierende Programm aus.
Gehe auf "moderat"
Nr. 3: Anwendungseigener Unistaller wird gestartet... aber dann bleibt es auch dabei, wenn ich das bestätige... also Nr. 4 kommt es nicht...

schrauber 21.07.2015 07:03
Du kannst aber auch Abbrechen klicken, dann startet Revo direkt die Suche nach Resten :)

magigstar 21.07.2015 18:46
Ok, aber wenn ich abbreche - nun bin ich mir aber gar nicht sicher - dann muss ich ja neu starten und finde das Programm gar nicht...

schrauber 22.07.2015 08:07
Revo startet den programmeigenen Uninstaller, dabei ist ein Fortschrittsbalken zu sehen, der erst voll wird, wenn der Uninstaller durch ist. Sollte dieser nicht gehen, einfach auf Weiter oder so ähnlich, dann beginnt Revo mit der Suche nach Resten.

Wen dass das Problem nicht löst bitte einen Screenshot, denn dann reden wir aneinander vorbei :)

magigstar 26.07.2015 16:27
Liste der Anhänge anzeigen (Anzahl: 10)
Anbei die Screenshots.. ich habe mal den gesamten Verlauf mit Screenshots hier belegt.
Beachte auch zum Schluss die Uhrzeit...
So mindestens eine halbe Stunde ist da schon bereits vorüber.. kann aber auch mehr gehen.. hab es einfach abgebrochen...

schrauber 27.07.2015 07:20
Wenn Du nach dem Uninstaller von Chrome auf Abbrechen klickst, was passiert dann? Kenn ich so gar nicht das Problem.

magigstar 02.08.2015 16:36
Komisch, beim Chrome, nachdem ich ihn wieder installiert habe, wollte er gar nicht den eigenen Unistaller starten... und es lief...

schrauber 03.08.2015 12:00
was lief? Ich blick nimmer durch :)

magigstar 03.08.2015 19:38
Ok, Chrome ist soweit gut...

Jetzt nur noch FF...
Aber dann ist alles weg, oder? Startseite, Favoriten usw...

schrauber 04.08.2015 12:10
wenn Du ihn nur zurücksetzt normal nicht.

magigstar 08.08.2015 08:17
Firefox habe ich nun mit Revo deinstalliert, neu installiert und restauriert.

Ich habe bei ESET einen Fehler gemacht!!

Ich habe die Standardeinstellung gelassen. Nun hat er mir die Bedrohungen nicht nur gefunden, sondern auch gelöscht???
Und Archive wurden nicht geprüft.

Soll ich ESET neu starten?
Ist es schlimm, dass die Bedrohungen auch gelöscht wurden?
Es gab einige Fehlermeldungen während ESET lief... "Die Anwendung in 0x734ee5a8 verweist auf Speicher 0x00000000. Der Vorgang read konnte nicht im Speicher durchgeführt werden."


Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19554
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-07 11:14:15
# local_time=2014-08-08 01:14:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 14959 151952429 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 42233 159083105 0 0
# scanned=265
# found=1
# cleaned=0
# scan_time=55
sh=C84182A0079B88D923BF936CC788C5B4B46AF482 ft=1 fh=ce39f3e3774c393e vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$R7TUY4P.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19835
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-26 05:27:21
# local_time=2014-08-26 07:27:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 49001 153530015 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 37433 160660691 0 0
# scanned=265829
# found=11
# cleaned=0
# scan_time=31318
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Desktop\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Downloads\PDFCreator-1_7_3_setup(1).exe"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Downloads\PDFCreator-1_7_3_setup.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=21329
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-30 10:05:21
# local_time=2014-11-30 11:05:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 68538 161841095 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 137883 168971771 0 0
# scanned=201326
# found=11
# cleaned=0
# scan_time=41366
sh=BD2752141740654CD9FA4FC44BC5874D57B3642E ft=1 fh=5cdb06fd3465f210 vn="Variante von Win32/InstallCore.RA evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$RIJ9WQK.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=22329
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-02-06 12:14:42
# local_time=2015-02-06 01:14:42 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 20269 167680856 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 20163 174811532 0 0
# scanned=309128
# found=58
# cleaned=0
# scan_time=12586
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Win32/VOPackage.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\UHTQPK.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Common Files\System\SysMenu64.dll"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=705EBCEF56D051A6D6D6356F237201A8448026E0 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD CCCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\96D59457AFA822A33B5B5ED391A55E16768E6472"
sh=37AEC73BCA6A4AD82D0DA871ECD72CD8B8A73904 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD CCCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCCC\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\System32\ColorMedia.dll"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\SysWOW64\ColorMedia.dll"
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-07 09:30:18
# local_time=2015-08-07 11:30:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25178
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-07 09:33:13
# local_time=2015-08-07 11:33:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25178
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-07 11:51:36
# local_time=2015-08-08 01:51:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 9610 190621346 0 0
# scanned=325651
# found=57
# cleaned=57
# scan_time=8302
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=C28D6F91FD875DD0C2DB97F25BBAF791F5D1F88E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\chrome\content\core\c0cdefe7de1a56a2409f82e5fabc5a1e.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=3D8FEB274B1F910633E0EE3966A82AE9DCBD406A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\21.js.vir"
sh=A61F2AB2BDA3DF4EA26FB96BFA4BAA4BEFA99E6A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\28.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=728D952AC1492F8331E2ED29921D5DDB8658697A ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\omiga-plus\UninstallManager.exe.vir"
sh=05FC70FCA7CCDB54CE3D6778AEADB58A32431BB2 ft=1 fh=704d2e4b074cd8f4 vn="Win32/Adware.ConvertAd.AQ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\VOPackage\Uninstall.exe.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCCC\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=2B4568A6B72ABCA0C07398E1C34B402D27FD324F ft=1 fh=cdbeb0c3ff7c0f92 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\abengine.dll.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu64.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner (Gesäubert - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCCC\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe.xBAD"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\EEEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe.xBAD"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Windows\SysWOW64\ColorMedia.dll.xBAD"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD CCCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD CCCCCC\AppData\Roaming\BitTorrent\updates\7.9.2_31638.exe"
sh=99A82A44935AA55E948FBACA5443C0D588ECEB1C ft=1 fh=c1378d07850f9ccb vn="Variante von Win64/Agent.BR Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\dot3ui64.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 06:30:34
# local_time=2015-08-08 08:30:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Hier das Log von securitycheck:

Code:
Results of screen317's Security Check version 1.006 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus 
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 SpywareBlaster 5.0   
 Adobe Flash Player 18.0.0.209 
 Mozilla Firefox (39.0.3)
 Google Chrome (44.0.2403.125)
 Google Chrome (44.0.2403.130)
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:06-08-2015
durchgeführt von DDDDD CCCCC (Administrator) auf ARBEITSCOMPUTER (08-08-2015 09:09:34)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Geladene Profile: DDDDD CCCCC & EEEEE & Versuch (Verfügbare Profile: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Common Files\AAV\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
() C:\Windows\snuvcdsm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodtray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(RescueTime, Inc.) C:\Program Files (x86)\RescueTime\RescueTime.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Mirko Böer) C:\Program Files (x86)\SSS\SimpleScreenshot.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe [3942216 2011-01-25] (O&O Software GmbH)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-07-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [SimpleScreenshot] => C:\Program Files (x86)\SSS\SIMPLESCREENSHOT.EXE [2254848 2008-01-28] (Mirko Böer)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1003\...\Run: [swg] => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-1242904208-471078349-2963378918-1003\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-1242904208-471078349-2963378918-1003\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil64_15_0_0_246_ActiveX.exe [540848 2014-12-09] (Adobe Systems Incorporated)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-12-06]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1242904208-471078349-2963378918-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.de/
HKU\S-1-5-21-1242904208-471078349-2963378918-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7740&r=27361111d106l0498z1j5t4471e496
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1003 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE457
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-06-25] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-06-25] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1242904208-471078349-2963378918-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Keine Datei
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: http://www.trojaner-board.de/168515-...ox-stoert.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-17] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-17] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)

Chrome:
=======
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Slides) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-01]
CHR Extension: (Google Docs) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-22]
CHR Extension: (Google Search) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (Google Sheets) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-01]
CHR Extension: (Avira Browser Safety) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-26]
CHR Extension: (Gmail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-07-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-07-26] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-07-26] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [985280 2015-07-22] (@ByELDI) [Datei ist nicht signiert]
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-26] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-26] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-11] (Avira Operations GmbH & Co. KG)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-07-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-08 09:09 - 2015-08-08 09:10 - 00025466 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-08-07 23:28 - 2015-08-07 23:28 - 02870984 _____ (ESET) C:\Users\DDDDD CCCCC\Downloads\esetsmartinstaller_deu.exe
2015-08-07 22:59 - 2015-08-07 22:59 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\Alte Firefox-Daten
2015-08-07 22:58 - 2015-08-07 22:58 - 00001123 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-08-07 22:58 - 2015-08-07 22:58 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-08-07 22:58 - 2015-08-07 22:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-07 22:57 - 2015-08-07 22:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-07 19:32 - 2015-08-07 19:32 - 00000093 _____ C:\Windows\wininit.ini
2015-08-05 20:27 - 2015-08-05 20:27 - 00009174 _____ C:\Users\DDDDD CCCCC\Desktop\km.xlsx
2015-08-04 21:39 - 2015-08-04 21:39 - 00000328 _____ C:\Users\DDDDD CCCCC\Desktop\Forum.URL
2015-08-02 17:38 - 2015-08-05 19:39 - 00002139 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-02 17:38 - 2015-08-02 17:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-02 12:16 - 2015-08-02 12:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Politik
2015-08-02 12:14 - 2015-08-02 12:14 - 00000270 _____ C:\Users\DDDDD CCCCC\Desktop\CME.URL
2015-08-02 12:08 - 2015-08-02 12:08 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Weiterbildung
2015-08-02 12:00 - 2015-08-02 12:00 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Rezepte
2015-08-02 12:00 - 2015-08-02 12:00 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Audio
2015-08-02 12:00 - 2015-08-02 12:00 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\AAAAA CCCCC
2015-08-01 16:45 - 2015-08-01 16:46 - 00000000 ____D C:\Program Files\KMSpico
2015-08-01 16:45 - 2015-08-01 16:45 - 00003386 _____ C:\Windows\System32\Tasks\AutoPico Daily Restart
2015-08-01 16:45 - 2015-08-01 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2015-08-01 16:45 - 2015-07-22 09:14 - 00000000 ____D C:\Windows\SysWOW64\kmspico.Beta_10.0.10240
2015-08-01 16:45 - 2015-07-22 09:14 - 00000000 ____D C:\Users\DDDDD CCCCC\Downloads\kmspico.Beta_10.0.10240
2015-08-01 16:45 - 2010-12-06 04:16 - 00090112 _____ (Vestris Inc.) C:\Windows\system32\Vestris.ResourceLib.dll
2015-08-01 16:43 - 2015-08-01 16:45 - 03303919 _____ C:\Users\DDDDD CCCCC\Desktop\kmspico.Beta_10.0.10240.exe
2015-07-28 19:04 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 19:04 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 19:04 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 19:04 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 19:04 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 19:04 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 19:04 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 19:04 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-26 17:24 - 2015-07-26 17:24 - 00008743 _____ C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2015-07-26 16:04 - 2015-07-26 16:04 - 01225878 _____ C:\Users\DDDDD CCCCC\Downloads\ssshot.zip
2015-07-26 16:04 - 2015-07-26 16:04 - 00001474 ____R C:\Windows\SimpleScreenshot8_Uninstall.in
2015-07-26 16:04 - 2015-07-26 16:04 - 00000000 ____D C:\Program Files (x86)\SSS
2015-07-26 16:04 - 2008-01-28 15:51 - 00330336 _____ (Mirko Böer) C:\Windows\SSSUn8.exe
2015-07-26 15:34 - 2015-07-26 15:34 - 00000313 _____ C:\Users\DDDDD CCCCC\Desktop\Zeit.URL
2015-07-26 15:33 - 2015-07-26 15:33 - 00000308 _____ C:\Users\DDDDD CCCCC\Desktop\karrierebibel.de.URL
2015-07-26 15:33 - 2015-07-26 15:33 - 00000250 _____ C:\Users\DDDDD CCCCC\Desktop\YouTube.URL
2015-07-26 15:33 - 2015-07-26 15:33 - 00000250 _____ C:\Users\DDDDD CCCCC\Desktop\YouTube.URL
2015-07-26 00:35 - 2015-07-26 00:35 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\CEF
2015-07-25 10:26 - 2015-07-25 10:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-07-25 07:49 - 2015-07-25 07:49 - 00000241 _____ C:\Users\DDDDD CCCCC\Desktop\BusinessLeaderCards.URL
2015-07-20 20:02 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-20 20:02 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 20:02 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-20 20:02 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-20 20:02 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-20 20:02 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-20 20:02 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-20 20:02 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-20 20:02 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-20 20:02 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-17 19:19 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-17 19:19 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-17 19:19 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-17 19:19 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-17 19:19 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-17 19:19 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-17 19:19 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-17 19:19 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-17 19:19 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-17 19:19 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-17 19:18 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-17 19:18 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-17 19:18 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-17 19:18 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-17 19:18 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-17 19:18 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-17 19:18 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-17 19:18 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-17 19:18 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-17 19:18 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-17 19:18 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-17 19:18 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-17 19:18 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-17 19:18 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-17 19:18 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-17 19:18 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-17 19:18 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-17 19:18 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-17 19:18 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-17 19:18 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-17 19:18 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-17 19:18 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-17 19:18 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-17 19:18 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-17 19:18 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-17 19:18 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-17 19:18 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-17 19:18 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-17 19:18 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-17 19:18 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-17 19:18 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-17 19:18 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-17 19:18 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-17 19:18 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-17 19:18 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-17 19:17 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-17 19:17 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-17 19:17 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-17 19:17 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-17 19:17 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-17 19:17 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-17 19:17 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-17 19:17 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-17 19:17 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-17 19:17 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-17 19:17 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-17 19:17 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-17 19:17 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-17 19:17 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-17 19:17 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-17 19:17 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-17 19:17 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-17 19:17 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-17 19:17 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-17 19:17 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-17 19:17 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-17 19:17 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-17 19:17 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-17 19:17 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-17 19:17 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-17 19:17 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-17 19:17 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-17 19:17 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-17 19:17 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-17 19:17 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-17 19:17 - 2015-06-11 19:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-07-17 19:17 - 2015-06-11 19:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-07-17 19:17 - 2015-06-11 19:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-07-17 19:17 - 2015-06-11 19:56 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-17 19:17 - 2015-06-11 19:56 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-17 19:17 - 2015-06-11 19:56 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-07-17 19:17 - 2015-06-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-17 19:16 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-17 19:16 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-17 19:16 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-17 19:16 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-17 19:16 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-17 19:16 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-17 19:16 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-17 19:16 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-17 19:16 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-17 19:16 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-17 19:16 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-17 19:16 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-17 19:16 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-17 19:16 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-17 19:16 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-17 19:16 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-17 19:16 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-17 19:16 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-17 19:16 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-17 19:16 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-17 19:16 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-17 19:16 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-17 19:16 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-17 19:16 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-17 19:16 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-17 19:16 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-17 19:16 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-17 19:16 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-17 19:16 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-17 19:16 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-17 19:16 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-17 19:15 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-17 19:15 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-17 19:15 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-17 19:15 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-17 19:15 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-17 19:15 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-17 19:15 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-17 19:15 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-17 19:15 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-17 19:15 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-17 19:15 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-17 19:15 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-11 22:00 - 2015-07-11 22:00 - 00242928 _____ C:\Users\DDDDD CCCCC\Downloads\Firefox Setup Stub 39.0.exe
2015-07-11 21:59 - 2015-07-11 21:59 - 00931408 _____ (Google Inc.) C:\Users\DDDDD CCCCC\Downloads\ChromeSetup.exe
2015-07-11 21:58 - 2015-07-11 21:58 - 00001228 _____ C:\Users\DDDDD CCCCC\Desktop\Revo Uninstaller.lnk
2015-07-11 21:57 - 2015-07-11 21:57 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\DDDDD CCCCC\Downloads\revosetup95.exe
2015-07-11 21:50 - 2015-07-11 21:50 - 00000235 _____ C:\Users\DDDDD CCCCC\Desktop\Keine Panik vor der Steuerberaterprüfung.URL
2015-07-10 20:55 - 2015-07-10 18:51 - 03033806 _____ (Malwarebytes Corporation) C:\Users\DDDDD CCCCC\Desktop\JRT_NEW.exe
2015-07-10 19:28 - 2015-07-28 22:07 - 00000000 ___HD C:\$Windows.~BT

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-08 09:09 - 2014-08-21 21:10 - 00000000 ____D C:\FRST
2015-08-08 09:05 - 2012-08-14 19:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-08 08:41 - 2015-06-08 17:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-08-08 08:29 - 2012-09-20 05:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-08 08:16 - 2015-05-31 14:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-08-08 07:46 - 2011-11-13 22:43 - 01673046 _____ C:\Windows\WindowsUpdate.log
2015-08-08 07:36 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-08 07:36 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-08 01:50 - 2011-11-23 17:34 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent
2015-08-07 23:13 - 2012-09-20 05:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-07 23:12 - 2014-06-20 14:07 - 00308392 _____ C:\Windows\PFRO.log
2015-08-07 23:12 - 2014-06-18 09:20 - 00043773 _____ C:\Windows\setupact.log
2015-08-07 23:12 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-07 23:09 - 2015-07-07 16:24 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-08-07 23:09 - 2015-02-10 19:48 - 02170368 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-08-07 21:30 - 2012-03-25 12:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-08-07 19:27 - 2013-10-25 20:01 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Firefox Sicherungen
2015-08-07 17:03 - 2015-02-01 00:47 - 00002169 _____ C:\Users\Public\Desktop\SteuerSparErklärung 2015.lnk
2015-08-05 20:27 - 2012-04-07 12:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-08-04 22:07 - 2015-06-08 17:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-08-04 22:07 - 2015-05-31 14:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-08-01 17:01 - 2012-04-10 15:54 - 00010042 _____ C:\Users\DDDDD CCCCC\Documents\OuProxy.log
2015-08-01 16:32 - 2014-11-14 17:19 - 00000000 __SHD C:\Users\DDDDD CCCCC\AppData\Local\EmieBrowserModeList
2015-08-01 16:32 - 2014-05-17 17:22 - 00000000 __SHD C:\Users\DDDDD CCCCC\AppData\Local\EmieUserList
2015-08-01 16:31 - 2014-05-17 17:22 - 00000000 __SHD C:\Users\DDDDD CCCCC\AppData\Local\EmieSiteList
2015-07-31 21:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-31 17:04 - 2011-11-14 07:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-07-31 17:04 - 2011-11-14 07:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-07-31 17:04 - 2009-07-14 07:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-30 21:37 - 2014-08-06 11:55 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-30 21:37 - 2013-02-24 20:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-28 22:29 - 2014-05-03 08:02 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-28 21:21 - 2009-07-27 22:41 - 00000000 ____D C:\Windows\Panther
2015-07-26 17:24 - 2012-08-29 11:11 - 00000000 ____D C:\Users\DDDDD CCCCC\.gimp-2.8
2015-07-26 16:04 - 2011-11-20 17:01 - 00000946 _____ C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SimpleScreenshot.lnk
2015-07-26 15:24 - 2013-03-29 21:10 - 00162528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-26 15:24 - 2013-03-29 21:10 - 00141416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-25 07:44 - 2015-04-04 13:16 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-22 19:01 - 2014-08-07 21:56 - 03409920 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-07-21 19:38 - 2009-07-14 06:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-20 19:52 - 2015-06-21 22:00 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\7-PDFSplitMerge
2015-07-18 14:34 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-07-18 11:03 - 2015-04-04 13:16 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-18 11:03 - 2014-12-12 21:57 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-18 11:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-18 09:15 - 2014-03-28 23:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-07-18 09:14 - 2009-11-05 05:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-18 08:57 - 2009-07-14 04:34 - 00000648 _____ C:\Windows\win.ini
2015-07-18 08:47 - 2013-07-13 09:36 - 00000000 ____D C:\Windows\system32\MRT
2015-07-17 22:20 - 2014-08-15 16:44 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Adobe
2015-07-17 22:20 - 2012-04-02 20:28 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-17 22:20 - 2012-04-02 20:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-17 22:20 - 2011-11-15 22:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-17 18:26 - 2015-06-11 21:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-07-17 18:24 - 2011-11-14 00:22 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-17 18:24 - 2011-11-14 00:22 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-17 18:20 - 2015-05-25 19:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-12 01:39 - 2014-08-24 19:36 - 00000000 ____D C:\AdwCleaner
2015-07-12 01:38 - 2014-08-05 15:08 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-11 21:58 - 2014-09-06 19:33 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-07-11 20:24 - 2014-06-15 20:34 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\gtk-2.0
2015-07-10 19:33 - 2015-01-31 16:22 - 00001066 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-10 19:33 - 2014-08-05 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-10 19:33 - 2014-08-05 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 08:10 - 2014-07-23 22:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 21:51 - 2015-02-22 15:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 19:28 - 2014-07-07 02:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 22:07 - 2014-09-22 22:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-07-26 17:24 - 2015-07-26 17:24 - 0008743 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 22:15 - 2013-08-12 22:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 11:26 - 2012-03-31 11:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 23:53 - 2011-11-13 23:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 20:19 - 2014-10-06 20:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-02 15:16

==================== Ende von log ============================

schrauber 08.08.2015 09:55
Wenn möglich bitte ESET nochmal mit den korrekten Einstellungen :)

magigstar 08.08.2015 17:52
ESET hat wieder was gefunden... kann ich mir aber gar nicht vorstellen, dass da Viren oder Trojaner wären???


Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19554
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-07 11:14:15
# local_time=2014-08-08 01:14:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 14959 151952429 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 42233 159083105 0 0
# scanned=265
# found=1
# cleaned=0
# scan_time=55
sh=C84182A0079B88D923BF936CC788C5B4B46AF482 ft=1 fh=ce39f3e3774c393e vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$R7TUY4P.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19835
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-26 05:27:21
# local_time=2014-08-26 07:27:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 49001 153530015 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 37433 160660691 0 0
# scanned=265829
# found=11
# cleaned=0
# scan_time=31318
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Downloads\PDFCreator-1_7_3_setup(1).exe"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Downloads\PDFCreator-1_7_3_setup.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=21329
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-30 10:05:21
# local_time=2014-11-30 11:05:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 68538 161841095 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 137883 168971771 0 0
# scanned=201326
# found=11
# cleaned=0
# scan_time=41366
sh=BD2752141740654CD9FA4FC44BC5874D57B3642E ft=1 fh=5cdb06fd3465f210 vn="Variante von Win32/InstallCore.RA evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$RIJ9WQK.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=22329
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-02-06 12:14:42
# local_time=2015-02-06 01:14:42 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 20269 167680856 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 20163 174811532 0 0
# scanned=309128
# found=58
# cleaned=0
# scan_time=12586
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Win32/VOPackage.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\UHTQPK.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Common Files\System\SysMenu64.dll"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=705EBCEF56D051A6D6D6356F237201A8448026E0 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\96D59457AFA822A33B5B5ED391A55E16768E6472"
sh=37AEC73BCA6A4AD82D0DA871ECD72CD8B8A73904 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\System32\ColorMedia.dll"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\SysWOW64\ColorMedia.dll"
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-07 09:30:18
# local_time=2015-08-07 11:30:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25178
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-07 09:33:13
# local_time=2015-08-07 11:33:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25178
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-07 11:51:36
# local_time=2015-08-08 01:51:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 9610 190621346 0 0
# scanned=325651
# found=57
# cleaned=57
# scan_time=8302
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=C28D6F91FD875DD0C2DB97F25BBAF791F5D1F88E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\chrome\content\core\c0cdefe7de1a56a2409f82e5fabc5a1e.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=3D8FEB274B1F910633E0EE3966A82AE9DCBD406A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\21.js.vir"
sh=A61F2AB2BDA3DF4EA26FB96BFA4BAA4BEFA99E6A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\28.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=728D952AC1492F8331E2ED29921D5DDB8658697A ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\omiga-plus\UninstallManager.exe.vir"
sh=05FC70FCA7CCDB54CE3D6778AEADB58A32431BB2 ft=1 fh=704d2e4b074cd8f4 vn="Win32/Adware.ConvertAd.AQ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\VOPackage\Uninstall.exe.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=2B4568A6B72ABCA0C07398E1C34B402D27FD324F ft=1 fh=cdbeb0c3ff7c0f92 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\abengine.dll.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu64.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner (Gesäubert - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe.xBAD"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe.xBAD"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Windows\SysWOW64\ColorMedia.dll.xBAD"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD Cipriano\AppData\Roaming\BitTorrent\BitTorrent.exe"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD Cipriano\AppData\Roaming\BitTorrent\updates\7.9.2_31638.exe"
sh=99A82A44935AA55E948FBACA5443C0D588ECEB1C ft=1 fh=c1378d07850f9ccb vn="Variante von Win64/Agent.BR Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\dot3ui64.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 06:30:34
# local_time=2015-08-08 08:30:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 01:11:56
# local_time=2015-08-08 03:11:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25187
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-08 01:13:18
# local_time=2015-08-08 03:13:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25187
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-08 01:17:53
# local_time=2015-08-08 03:17:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 56102 190669723 0 0
# scanned=18061
# found=6
# cleaned=0
# scan_time=274
sh=1BD5660EBB60AF8FC5CE6CE41E6E55D69EF48633 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\UHTQPK.xBAD"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip.xBAD"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 01:18:46
# local_time=2015-08-08 03:18:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 25187
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-08 01:19:03
# local_time=2015-08-08 03:19:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25187
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-08 04:44:30
# local_time=2015-08-08 06:44:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 68499 190682120 0 0
# scanned=335351
# found=10
# cleaned=0
# scan_time=12326
sh=1BD5660EBB60AF8FC5CE6CE41E6E55D69EF48633 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\UHTQPK.xBAD"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD Cipriano\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip.xBAD"
sh=76595B98CEA0CD39E47CEBA9F12AE154DFCBF36A ft=0 fh=0000000000000000 vn="Variante von Android/Agent.KW Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Desktop\Tablett\Android\data\fp\6699.apk"
sh=6F07761C3535E234CB4CE675545DA2B86F932E6D ft=0 fh=0000000000000000 vn="Android/AdDisplay.Dowgin.AT evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Desktop\Tablett\Android\data\fp\7879.apk"
sh=5EBE903452CB921A8FCCC07ADEC8B5797AE7903A ft=0 fh=0000000000000000 vn="Variante von Android/Agent.KW Trojaner" ac=I fn="C:\Users\DDDDD Cipriano\Desktop\Desktop\Tablett\Android\data\un\7343.apk"
sh=A3237ED7B0323377ACDCE02E94D12CB17F793ED0 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Windows\Installer\73825f.msi"

schrauber 09.08.2015 07:27
Das meiste ist in der Quarantäne von FRST, dann noch so Android Zeugs, was ich löschen würde.

magigstar 11.08.2015 17:37
Moment, Android Zeugs?
Habe ich das denn bereits schon eventuell gelöscht?

Ich habe nämlich vorgehabt den Tablett meiner Mutter auf Vordermann zu bringen (ich glaube, ich habe dazu hier noch einen thread). Und das musste ich dann verschieben...
Die "Sicherung" ist auf meinem Notebook.

Ich möchte ungerne Teile des Tablet "wegschießen", um dann festzustellen, dass es nicht mehr geht...

schrauber 12.08.2015 11:28
Dann lass den Kram in dem Desktop Ordner, aber laut ESET sind die nicht in ordnung :)

magigstar 30.08.2015 07:12
Ist denn jetzt alles sauber?

Fühlt sich nicht so an... ich weiss echt nicht was los ist...

schrauber 30.08.2015 12:04
Dann beschreib dein Gefühl mal genauer, warum du das denkst, ich kann nicht hellsehen :)

magigstar 01.09.2015 20:21
Die Reaktionen sind viel zu spät...
Wenn ich klicke, dann reagiert erst viel später... das ist zumindest so beim FF.

schrauber 02.09.2015 17:51
Nur im FF? Was ist mit andern Browsern? Was ist ausserhalb von Browsern?

magigstar 02.09.2015 20:24
Nein, im Chrome läuft es sehr gut.
Ich werde es weiterhin beobachten...

schrauber 03.09.2015 18:09
Bitte mal in Firefox die Hardwarebeschleunigung abschalten.

magigstar 03.09.2015 20:53
Ok,
erledigt, werde weiterhin beobachten...

schrauber 04.09.2015 17:41
mach das :)

magigstar 12.09.2015 18:34
Klar, der Chrome ist schon schneller, als der FF.
Dennoch bevorzuge ich den FF.

Aber es ist nicht nur das Internet.
Ich schalte den Notebook ein, möchte ins Excel, und das lässt auf sich warten...

schrauber 13.09.2015 09:24
http://support2.microsoft.com/kb/929135/de

Bitte einen Clean Boot machen. Wenn das Problem dann weg ist, einzeln wieder Dienste aktivieren, dazwischen immer einen Reboot machen. Solange bis Du weißt welcher Dienst die Probleme macht.

Diesen dann hier benennen.

magigstar 13.09.2015 19:22
Ok,
mache ich...

Der Chrome lässt mich auch momentan verzweifeln...
Ein Video... zu langsam...

Benutzerdefinierter Systemstart geht

Systemdienste laden aktivieren geht auch

Systemstartelemente laden deaktivieren geht auch.

Alle Microsoft-Dienste ausblenden geht auch..


Alle deaktivieren geht irgendwie nicht...
Avira bleibt aktiv...

Neustart...

alle Dienste sind deaktiviert, außer die von Avira...

Ich werde nun einen nach den anderen einschalten..

schrauber 14.09.2015 11:54
Dann deinstalliere Avira :)

magigstar 18.09.2015 18:19
Also, obwohl alle Dienste deaktiviert sind (außer Avira) läuft es immer noch nicht rund.
Kann es ein Hardware-Problem sein?

schrauber 19.09.2015 16:24
Zitat:
Also, obwohl alle Dienste deaktiviert sind (außer Avira) läuft es immer noch nicht rund.
Zitat:
Dann deinstalliere Avira
merkste was? :)

Klar kann es Hardware sein, Du hast aber noch nicht alles ausgeschlossen.

magigstar 21.09.2015 21:39
Also momentan läuft es besser.. muss aber noch nicht so sein...

Ich würde am liebsten Dir irgendein Report posten, damit Du alles ausschließen kannst.

schrauber 22.09.2015 19:09
Das wird bei Hardware schwierig. Also ohne Avira läuft es jetzt?

magigstar 22.09.2015 20:14
Ja, scheint zu laufen...

schrauber 23.09.2015 18:37
Dann aktiviere wieder den Rest, installiere Avira neu und teste. Fängt es wieder an, dann Avira runter und anderes AV drauf.

magigstar 24.09.2015 21:03
Ich gehe auf "Normaler Start", das geht dann ganz einfach...


Ich hab noch was drauf: avira service host???

schrauber 25.09.2015 18:09
Alles runter von Avira. Dann Avira neu installieren.

magigstar 27.09.2015 20:18
Jetzt ist Avira deinstalliert.
Es läuft recht gut..

schrauber 28.09.2015 16:31
Und wenn Du Avira wieder neu installierst?

magigstar 06.10.2015 11:28
Entschuldige vielmals die späte Antwort.
Ich werde heute Avira installieren.
Und das beobachten.

schrauber 07.10.2015 08:20
ok.

magigstar 10.10.2015 10:52
So, endlich geschafft, Avira zu installieren...
Ich werde das nun weiterhin beobachten.


Mal eine andere Frage:
Wird eigentlich mein Surfverhalten an Facebook weiter gegeben??
Ich habe komischerweise das Gefühl.

Habe ein Hotel in Mannheim gebucht und dann kam als "Vorgeschlagene Seite" "Bald in Mannheim? Hotel gesucht!"
Habe online eine Jogginghose gekauft. Nicht einmal fertig, kam mir der gleiche Shop auf Facebook (auf dem Smartphone) als Empfehlung.

Das ist doch nicht normal, oder?

schrauber 11.10.2015 07:24
Die meisten dieser Seiten haben eine Funktion "Login mit Facebook". Wenn FB parallel offen ist, ist das die Erklärung ;)

magigstar 11.10.2015 14:12
Also die Website mit dem Hotel hat so ein Anmelde-Button mit Facebook.
Die Sport-Shopping-Adresse allerdings nicht.
Komisch ist nur, dass ich bei der Hotel-Suche nicht angemeldet bin.

schrauber 11.10.2015 20:24
Facebook...Google...Amis...wundern tut mich da eigentlich nix :)

magigstar 12.10.2015 23:41
Also, jetzt wo Avira wieder installiert sein, braucht der Notebook ewig...

Ich schalte ihn ein... der leere Desktop bleibt eine zeitlang leer... bis die Symbole kommen.
Und es dauert weiter... der FF braucht ewig, bis er erscheint, stürtzt auch ab.

Das macht so kein Spaß.
Ist zwar jetzt nur eine Momentaufnahme, aber das ist bestimmt nicht das erste mal.

schrauber 13.10.2015 18:36
Avira wieder runter, installier testweise was andres :)

magigstar 16.10.2015 19:48
Oh man...
Ok, mache ich...

schrauber 17.10.2015 15:52
Sorry, ich kann nix dafür wenn Antivir den Rechner lahm legt. Sie es positiv, es gibt eh besseres :)

magigstar 17.10.2015 20:06
Eh.. ne, dafür kannst Du überhaupt nicht... habe ich nicht so gemeint....
Und ja, Antivir wird hier auf diesem Forum nicht so beliebt sein.

schrauber 18.10.2015 06:52
Zitat:
Und ja, Antivir wird hier auf diesem Forum nicht so beliebt sein.
Mit Recht ;)

magigstar 18.10.2015 18:41
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:18-10-2015
durchgeführt von DDDDD CCCCC (Administrator) auf ARBEITSCOMPUTER (18-10-2015 14:17:28)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Geladene Profile: DDDDD CCCCC (Verfügbare Profile: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
() C:\Windows\snuvcdsm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(RescueTime, Inc.) C:\Program Files (x86)\RescueTime\RescueTime.exe
(Mirko Böer) C:\Program Files (x86)\SSS\SimpleScreenshot.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SimpleScreenshot] => C:\Program Files (x86)\SSS\SIMPLESCREENSHOT.EXE [2255360 2008-02-09] (Mirko Böer)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-09-24]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2015-09-24]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll => Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-09-25] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-25] (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: hxxp://www.umsetzungsberatung.de/unternehmenskultur/interne-konkurrenz.php
hxxps://www.kickstarter.com/signup?context=checkout&then=%2Fprojects%2F1231926449%2Fweil-am-rhein-deine-jugend%2Fpledges%2F39596764%2Fsave_user%3Fclicked_reward%3Dtrue
hxxp://www.zeitzuleben.de/2164-ziele-finden/
http://www.trojaner-board.de/168515-...ox-stoert.html
hxxps://ivanblatter.com/lp/ty-ez2/
hxxp://www.eltern.de/foren/familienberatung-unserer-expertin/#post25957331
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_207.dll [2015-10-16] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_207.dll [2015-10-16] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-25] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-14] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=55&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&SSPV="
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Präsentationen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-01]
CHR Extension: (Google Docs) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-22]
CHR Extension: (Google-Suche) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (Google Tabellen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-01]
CHR Extension: (Avira Browserschutz) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-26]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (Google Wallet) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-26]
CHR Extension: (Google Mail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S4 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
S4 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-18 14:17 - 2015-10-18 14:18 - 00023164 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-10-18 14:16 - 2015-10-18 14:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-10-17 15:36 - 2015-10-17 15:36 - 00000299 _____ C:\Users\DDDDD CCCCC\Desktop\ver.di Landesbezirk Baden-Württemberg.URL
2015-10-17 10:56 - 2015-10-17 10:56 - 00000288 _____ C:\Users\DDDDD CCCCC\Desktop\Kulinarie - Homepage - JOYclub.URL
2015-10-16 11:11 - 2015-10-16 11:11 - 00006703 _____ C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2015-10-15 13:53 - 2015-08-05 19:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2015-10-15 13:53 - 2015-08-05 19:06 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-10-15 11:33 - 2015-09-18 21:22 - 00025432 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-10-15 11:33 - 2015-09-18 21:19 - 01291264 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-10-15 11:33 - 2015-09-18 21:19 - 00766464 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-10-15 11:33 - 2015-09-18 21:19 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-10-15 11:33 - 2015-09-18 21:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-10-15 11:33 - 2015-09-18 21:19 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-10-15 11:33 - 2015-09-18 21:09 - 01163776 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-10-14 14:37 - 2015-10-14 14:40 - 47511229 _____ C:\Users\DDDDD CCCCC\Downloads\NeuerOrdner2.zip
2015-10-13 21:40 - 2015-09-29 05:16 - 05569472 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-10-13 21:40 - 2015-09-29 05:13 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-10-13 21:40 - 2015-09-29 05:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-10-13 21:40 - 2015-09-29 05:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-10-13 21:40 - 2015-09-29 05:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-10-13 21:40 - 2015-09-29 05:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-10-13 21:40 - 2015-09-29 05:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-10-13 21:40 - 2015-09-29 05:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-10-13 21:40 - 2015-09-29 05:05 - 03990976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-10-13 21:40 - 2015-09-29 05:05 - 03936192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-10-13 21:40 - 2015-09-29 05:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-10-13 21:40 - 2015-09-29 05:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-10-13 21:40 - 2015-09-29 05:02 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-10-13 21:40 - 2015-09-29 04:59 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-10-13 21:40 - 2015-09-29 04:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-10-13 21:40 - 2015-09-29 04:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-10-13 21:40 - 2015-09-29 04:58 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-10-13 21:40 - 2015-09-29 04:58 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-10-13 21:40 - 2015-09-29 04:57 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-10-13 21:40 - 2015-09-29 04:57 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-10-13 21:40 - 2015-09-29 04:57 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-10-13 21:40 - 2015-09-29 04:57 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-10-13 21:40 - 2015-09-29 04:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-10-13 21:40 - 2015-09-29 04:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 03:50 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-10-13 21:40 - 2015-09-29 03:49 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-10-13 21:40 - 2015-09-29 03:49 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-10-13 21:40 - 2015-09-29 03:43 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-10-13 21:40 - 2015-09-29 03:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-10-13 21:40 - 2015-09-29 03:40 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 03:40 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 03:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-13 21:40 - 2015-09-29 03:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 02607104 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-10-13 21:40 - 2015-09-25 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-10-13 21:40 - 2015-09-25 20:06 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-10-13 21:40 - 2015-09-25 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-10-13 21:40 - 2015-09-25 20:06 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-10-13 21:40 - 2015-09-25 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-10-13 21:40 - 2015-09-25 19:59 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-10-13 21:40 - 2015-09-25 19:59 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-10-13 21:40 - 2015-09-25 19:59 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-10-13 21:40 - 2015-09-25 19:59 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-10-13 21:40 - 2015-09-25 19:58 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-10-13 21:40 - 2015-09-18 21:31 - 00391784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-13 21:40 - 2015-09-18 20:58 - 00345688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-13 21:40 - 2015-09-16 06:48 - 25851904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-13 21:40 - 2015-09-16 06:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-13 21:40 - 2015-09-16 06:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-10-13 21:40 - 2015-09-16 06:22 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-13 21:40 - 2015-09-16 06:21 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-13 21:40 - 2015-09-16 06:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-13 21:40 - 2015-09-16 06:21 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-13 21:40 - 2015-09-16 06:21 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-10-13 21:40 - 2015-09-16 06:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-10-13 21:40 - 2015-09-16 06:14 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-13 21:40 - 2015-09-16 06:13 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-13 21:40 - 2015-09-16 06:10 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-13 21:40 - 2015-09-16 06:09 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-13 21:40 - 2015-09-16 06:08 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-13 21:40 - 2015-09-16 06:08 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-10-13 21:40 - 2015-09-16 06:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-10-13 21:40 - 2015-09-16 06:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-10-13 21:40 - 2015-09-16 06:01 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-13 21:40 - 2015-09-16 05:58 - 20357632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-13 21:40 - 2015-09-16 05:58 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-13 21:40 - 2015-09-16 05:50 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-13 21:40 - 2015-09-16 05:46 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-13 21:40 - 2015-09-16 05:45 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-13 21:40 - 2015-09-16 05:45 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-13 21:40 - 2015-09-16 05:43 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-13 21:40 - 2015-09-16 05:41 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-10-13 21:40 - 2015-09-16 05:33 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-13 21:40 - 2015-09-16 05:33 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-13 21:40 - 2015-09-16 05:32 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-13 21:40 - 2015-09-16 05:32 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-10-13 21:40 - 2015-09-16 05:31 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-10-13 21:40 - 2015-09-16 05:31 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-10-13 21:40 - 2015-09-16 05:29 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-13 21:40 - 2015-09-16 05:29 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-13 21:40 - 2015-09-16 05:28 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-13 21:40 - 2015-09-16 05:28 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-10-13 21:40 - 2015-09-16 05:26 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-13 21:40 - 2015-09-16 05:26 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-13 21:40 - 2015-09-16 05:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-13 21:40 - 2015-09-16 05:24 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-13 21:40 - 2015-09-16 05:23 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-10-13 21:40 - 2015-09-16 05:22 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-13 21:40 - 2015-09-16 05:22 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-13 21:40 - 2015-09-16 05:22 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-10-13 21:40 - 2015-09-16 05:15 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-13 21:40 - 2015-09-16 05:11 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-13 21:40 - 2015-09-16 05:10 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-10-13 21:40 - 2015-09-16 05:07 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-13 21:40 - 2015-09-16 05:06 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-13 21:40 - 2015-09-16 05:05 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-13 21:40 - 2015-09-16 05:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-13 21:40 - 2015-09-16 05:04 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-10-13 21:40 - 2015-09-16 04:59 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-13 21:40 - 2015-09-16 04:58 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-13 21:40 - 2015-09-16 04:58 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-10-13 21:40 - 2015-09-16 04:56 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-13 21:40 - 2015-09-16 04:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-13 21:40 - 2015-09-16 04:55 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-10-13 21:40 - 2015-09-16 04:48 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-10-13 21:40 - 2015-09-16 04:37 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-13 21:40 - 2015-09-16 04:34 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-13 21:40 - 2015-09-16 04:32 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-10-13 21:40 - 2015-09-15 20:17 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-10-13 21:40 - 2015-09-15 20:17 - 00097112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-10-13 21:40 - 2015-09-15 20:11 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-10-13 21:40 - 2015-09-15 20:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-10-13 21:40 - 2015-09-15 20:11 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-10-13 21:40 - 2015-09-15 20:11 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-10-13 21:40 - 2015-09-15 20:11 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-10-13 21:40 - 2015-09-15 20:11 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-10-13 21:40 - 2015-09-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-10-13 21:40 - 2015-09-15 19:36 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-10-13 21:40 - 2015-09-15 19:36 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-10-13 21:40 - 2015-09-15 19:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-10-13 21:40 - 2015-09-15 19:35 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-10-13 21:40 - 2015-08-06 20:04 - 14176768 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-10-13 21:40 - 2015-08-06 20:03 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-10-13 21:40 - 2015-08-06 19:44 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-10-13 21:40 - 2015-08-06 19:44 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-10-13 21:39 - 2015-10-01 20:06 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-10-13 21:39 - 2015-10-01 20:04 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-10-13 21:39 - 2015-10-01 20:00 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-10-13 21:39 - 2015-10-01 20:00 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-10-13 21:39 - 2015-10-01 20:00 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-10-13 21:39 - 2015-10-01 20:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-10-13 21:39 - 2015-10-01 20:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-10-13 21:39 - 2015-10-01 19:50 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-10-13 21:39 - 2015-10-01 19:00 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-10-13 21:37 - 2015-07-18 15:08 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2015-10-13 21:37 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2015-10-13 15:11 - 2015-10-13 15:11 - 00000275 _____ C:\Users\DDDDD CCCCC\Desktop\(RatSchlag).URL
2015-09-30 19:04 - 2015-09-30 19:04 - 04559688 _____ (Avira Operations GmbH & Co. KG) C:\Users\DDDDD CCCCC\Downloads\avira_de_av_55fd9846716f7__ws.exe
2015-09-27 17:13 - 2015-09-27 17:13 - 00000315 _____ C:\Users\DDDDD CCCCC\Desktop\Studium Generale Mutig, unbequem und stolz - Wie Sie für sich und andere die besten Ergebnisse erzielen.URL
2015-09-27 17:12 - 2015-09-27 17:12 - 00000301 _____ C:\Users\DDDDD CCCCC\Desktop\Sennheiser Momentum In-Ear G In-Ear-Kopfhörer Kopfhörer Preisvergleich - Preise bei idealo.de.URL
2015-09-27 17:12 - 2015-09-27 17:12 - 00000299 _____ C:\Users\DDDDD CCCCC\Desktop\Kopfhörer Philips SHE8500 In Ear Schwarz im Conrad Online Shop 304284.URL
2015-09-27 17:12 - 2015-09-27 17:12 - 00000284 _____ C:\Users\DDDDD CCCCC\Desktop\Philips TX2 In-Ear-Kopfhörer Kopfhörer Preisvergleich - Preise bei idealo.de.URL
2015-09-27 17:11 - 2015-09-27 17:11 - 00000384 _____ C:\Users\DDDDD CCCCC\Desktop\Gianna Possehl, Frank Kittel, Tiziana Bruno, Gregor Adamczyk Sich durchsetzen (Buch) - portofrei bei Managementbuch.de.URL
2015-09-27 17:11 - 2015-09-27 17:11 - 00000347 _____ C:\Users\DDDDD CCCCC\Desktop\Stefanie Demann Selbstcoaching (Hörbuch) - portofrei bei Managementbuch.de.URL
2015-09-27 10:21 - 2015-09-27 10:21 - 00000267 _____ C:\Users\DDDDD CCCCC\Desktop\Querverlag - Und was sagen die Kinder dazu.URL
2015-09-26 19:47 - 2015-09-26 19:47 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Sprüche
2015-09-26 19:43 - 2015-09-26 20:02 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Karriere
2015-09-26 13:32 - 2015-09-26 13:33 - 263589342 _____ C:\Users\DDDDD CCCCC\Downloads\documents-export-2015-09-26.zip
2015-09-25 17:51 - 2015-09-25 17:51 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Sun
2015-09-25 17:50 - 2015-09-25 17:50 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-09-25 17:50 - 2015-09-25 17:50 - 00000000 ____D C:\Users\DDDDD CCCCC\.oracle_jre_usage
2015-09-25 16:16 - 2015-09-25 16:16 - 00001302 _____ C:\Users\DDDDD CCCCC\Downloads\depot_data.csv
2015-09-22 22:32 - 2015-09-22 22:32 - 00001474 ____R C:\Windows\SimpleScreenshot9_Uninstall.in
2015-09-22 22:32 - 2008-01-28 15:51 - 00330336 _____ (Mirko Böer) C:\Windows\SSSUn9.exe
2015-09-20 18:51 - 2015-09-20 18:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-18 14:17 - 2014-08-21 21:10 - 00000000 ____D C:\FRST
2015-10-18 14:16 - 2015-02-10 19:48 - 02196992 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-10-18 14:05 - 2012-08-14 19:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-18 13:53 - 2015-06-08 17:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-10-18 13:43 - 2015-05-31 14:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-10-18 13:39 - 2012-09-20 05:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-18 12:38 - 2011-11-13 22:43 - 01238941 _____ C:\Windows\WindowsUpdate.log
2015-10-18 11:58 - 2012-03-25 12:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-10-18 11:13 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-18 11:13 - 2009-07-14 06:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-18 11:07 - 2012-09-20 05:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-18 10:53 - 2014-06-18 09:20 - 00047424 _____ C:\Windows\setupact.log
2015-10-18 10:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-17 22:07 - 2015-06-11 21:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-17 22:07 - 2015-05-25 19:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-17 21:51 - 2014-08-07 21:56 - 03468800 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-10-17 12:22 - 2014-11-02 22:54 - 00000000 ____D C:\Users\EEEEE\Desktop\div. Briefe
2015-10-17 12:00 - 2013-02-24 20:39 - 00000000 ____D C:\ProgramData\Avira
2015-10-17 11:53 - 2014-06-20 14:07 - 00449260 _____ C:\Windows\PFRO.log
2015-10-16 20:19 - 2015-08-07 22:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-16 19:07 - 2015-08-28 22:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-16 18:23 - 2012-04-07 12:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-10-16 13:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-10-16 11:11 - 2014-06-15 20:34 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\gtk-2.0
2015-10-16 11:11 - 2012-08-29 11:11 - 00000000 ____D C:\Users\DDDDD CCCCC\.gimp-2.8
2015-10-16 07:17 - 2012-04-02 20:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-10-16 07:17 - 2012-04-02 20:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-10-16 07:17 - 2011-11-15 22:21 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-15 13:54 - 2014-12-12 21:57 - 00000000 ____D C:\Windows\system32\appraiser
2015-10-15 13:54 - 2014-05-03 08:02 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-10-15 12:18 - 2012-06-10 15:07 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbungen
2015-10-14 16:01 - 2014-09-23 19:09 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-10-14 13:23 - 2013-07-13 09:36 - 00000000 ____D C:\Windows\system32\MRT
2015-10-14 13:11 - 2011-11-18 20:58 - 143481208 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-10-14 13:10 - 2014-03-28 23:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-10-14 13:09 - 2009-11-05 05:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-10-14 13:04 - 2009-07-14 04:34 - 00000648 _____ C:\Windows\win.ini
2015-10-11 20:47 - 2011-11-14 00:15 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Google
2015-10-09 20:06 - 2015-04-04 13:16 - 00000000 ___SD C:\Windows\system32\GWX
2015-10-09 09:37 - 2015-04-04 13:16 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-10-03 15:54 - 2012-09-18 19:21 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbung Angela
2015-10-02 19:47 - 2013-10-12 11:28 - 00000000 ____D C:\Users\EEEEE\Desktop\aktuelle bewerbungen
2015-09-28 20:50 - 2013-03-07 20:43 - 00000000 ____D C:\Users\EEEEE\Desktop\Bewerbungen EEEEE CCCCC
2015-09-27 14:05 - 2015-08-05 20:27 - 00009446 _____ C:\Users\DDDDD CCCCC\Desktop\km.xlsx
2015-09-26 19:40 - 2012-06-16 17:38 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Selbstmanagement
2015-09-26 19:37 - 2015-08-02 12:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Politik
2015-09-26 13:17 - 2015-08-31 22:23 - 00015194 _____ C:\Users\DDDDD CCCCC\Desktop\ESt 2015.xlsx
2015-09-25 17:56 - 2013-09-19 22:50 - 00000000 ____D C:\ProgramData\Oracle
2015-09-25 17:50 - 2013-09-19 21:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-09-25 17:50 - 2012-03-11 03:08 - 00000000 ____D C:\Program Files (x86)\Java
2015-09-25 17:50 - 2011-11-13 23:46 - 00000000 ____D C:\Users\DDDDD CCCCC
2015-09-24 22:03 - 2012-08-06 20:43 - 00000000 ____D C:\Windows\pss
2015-09-22 22:32 - 2011-11-20 17:01 - 00000946 _____ C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SimpleScreenshot.lnk
2015-09-20 21:43 - 2015-06-08 17:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-09-20 21:43 - 2015-05-31 14:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-09-18 15:34 - 2011-11-14 00:22 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-18 15:34 - 2011-11-14 00:22 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 08:10 - 2014-07-23 22:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 21:51 - 2015-02-22 15:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 19:28 - 2014-07-07 02:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 22:07 - 2014-09-22 22:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-10-16 11:11 - 2015-10-16 11:11 - 0006703 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 22:15 - 2013-08-12 22:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 11:26 - 2012-03-31 11:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 23:53 - 2011-11-13 23:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 20:19 - 2014-10-06 20:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-10-13 22:05

==================== Ende von FRST.txt ============================
Code:
# AdwCleaner v4.109 - Bericht erstellt am 18/10/2015 um 14:46:55
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-10-18.3 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : DDDD CCCCC - ARBEITSCOMPUTER
# Gestartet von : C:\Users\DDDD CCCCC\Desktop\AdwCleaner_4.109.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gefunden : C:\Program Files (x86)\Yahoo!\Companion
Ordner Gefunden : C:\Users\DDDD CCCCC\AppData\LocalLow\Yahoo!\Companion
Ordner Gefunden : C:\Users\DDDD CCCCC\AppData\Roaming\Yahoo!\Companion

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Yahoo\Companion
Schlüssel Gefunden : HKCU\Software\OB
Schlüssel Gefunden : HKCU\Software\WEBAPP
Schlüssel Gefunden : HKCU\Software\Yahoo\Companion
Schlüssel Gefunden : HKCU\Software\Yahoo\YFriendsBar
Schlüssel Gefunden : [x64] HKCU\Software\OB
Schlüssel Gefunden : [x64] HKCU\Software\WEBAPP
Schlüssel Gefunden : [x64] HKCU\Software\Yahoo\Companion
Schlüssel Gefunden : [x64] HKCU\Software\Yahoo\YFriendsBar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{363F46BE-27B4-4C8D-99E7-B1E049B84376}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A753A1EC-973E-4718-AF8E-A3F554D45C44}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{023E9EC8-B147-40EB-B0B3-DF90618FB371}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0522D9A4-4D57-437D-978D-E5B3B6C9005D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{07F41522-AF7D-4F26-B394-094F059FDB8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0C40F472-7407-4467-8914-1DEA7C326972}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{212E6D43-6062-492A-B8CC-144669FF11ED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{224FE662-1E6D-4BC0-AEBB-9E2FB4057BE9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3A807417-B46D-4D37-8C9A-19AC6DE204F9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3CC60715-D6C5-429D-830E-43FA3F86C61D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4517D94C-19BA-46FA-BE66-2A30CEAC4A85}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{555D7146-94A8-4C94-AE76-C39CDC7F7705}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{59D188FA-757A-424E-8C93-F58FFD896BD7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8120D9D6-785C-4413-9C0C-DF2028C56FAD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{823AE2EB-E62C-4847-B192-C99B91B92416}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9B4F7CFE-987D-410E-A8E4-20182E0B3C24}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9B9A45F4-18FC-484A-BACA-076D78273D8E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A6D54287-7939-466A-8579-92546D946C8C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A78EDAFB-926F-4D93-AB13-8232D7378EB1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8F7D0A5-7074-40B8-9BDC-1174BDD0A132}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D14D64BC-A0E4-42E3-BB72-FB41EA43C198}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DD1F043F-ABC8-4643-8B95-D2C5B22BB019}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E3F3E8F9-F747-4DD6-BA6B-82A6CE1E0860}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ED0B64D4-BF27-4521-AD27-190F49BF5EA7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Yahoo\Companion
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{363F46BE-27B4-4C8D-99E7-B1E049B84376}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{A753A1EC-973E-4718-AF8E-A3F554D45C44}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.18057


-\\ Mozilla Firefox v41.0.2 (x86 de)


-\\ Google Chrome v46.0.2490.71


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [4287 octets] - [24/08/2014 19:37:07]
AdwCleaner[R1].txt - [2884 octets] - [30/11/2014 00:16:17]
AdwCleaner[R2].txt - [29703 octets] - [31/01/2015 16:04:28]
AdwCleaner[R3].txt - [3646 octets] - [10/07/2015 20:29:47]
AdwCleaner[R4].txt - [354 octets] - [12/07/2015 01:39:13]
AdwCleaner[R5].txt - [1710 octets] - [08/08/2015 09:50:29]
AdwCleaner[R6].txt - [5623 octets] - [18/10/2015 14:42:15]
AdwCleaner[R7].txt - [5270 octets] - [18/10/2015 14:46:55]
AdwCleaner[S0].txt - [4164 octets] - [24/08/2014 19:55:28]
AdwCleaner[S1].txt - [2721 octets] - [30/11/2014 00:19:24]
AdwCleaner[S2].txt - [30134 octets] - [31/01/2015 16:08:01]
AdwCleaner[S3].txt - [4185 octets] - [10/07/2015 20:44:58]

########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [5571 octets] ##########
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 18.10.2015
Suchlaufzeit: 14:57
Protokolldatei: Malwarebytes Anti-Malware.txt
Administrator: Ja

Version: 2.2.0.1024
Malware-Datenbank: v2015.10.18.02
Rootkit-Datenbank: v2015.10.16.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DDDDD CCCCC

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 455392
Abgelaufene Zeit: 29 Min., 28 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 7
PUP.Optional.Goobzo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SMU.EXE, , [600ab8a04e3d10268087bfbc0ff3b44c],
PUP.Optional.Goobzo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SMU.EXE, , [89e1aaaeb0dbd363ca3d6714d92951af],
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB, , [4c1ef1677417bf77356d5435bf4412ee],
PUP.Optional.Hicosmea, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}, , [5416a6b272190a2ce09ae377fb08fb05],
PUP.Optional.MultiPlug, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, , [e684abadef9c95a1f12f9d144ab9d42c],
PUP.Optional.MultiPlug, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, , [e684abadef9c95a1f12f9d144ab9d42c],
PUP.Optional.Hicosmea, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\WOW6432NODE\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}, , [77f3c6923e4d92a4fa80302afb0812ee],

Registrierungswerte: 9
PUP.Optional.Goobzo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SMU.EXE, C:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe, , [600ab8a04e3d10268087bfbc0ff3b44c]
PUP.Optional.Goobzo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SMU.EXE, C:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe, , [89e1aaaeb0dbd363ca3d6714d92951af]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype1, 1/31/15 8:52:11, , [4c1ef1677417bf77356d5435bf4412ee]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype29, 1/31/15 8:52:11, , [204a3325ff8ce94d02a03a4f010220e0]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype20, 1/31/15 8:53:54, , [d4964612444783b3930f41483bc8a957]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype22, 1/31/15 8:53:54, , [a1c9490fe6a5082eced441484fb4cc34]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype15, 1/31/15 8:54:28, , [1951cd8b7912a195acf6c7c2956e7b85]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype2, 1/31/15 8:59:31, , [f5751f39d2b90036584a4d3cff042ed2]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\OB|monitype3, 1/31/15 8:59:31, , [670382d6eaa13afca002cfba54afb050]

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 2
PUP.Optional.Hicosmea.Gen, C:\Windows\Installer\73825f.msi, , [ce9ce0780a811521b5069ab3b150748c],
Trojan.Injector.BHO, C:\settings.ini, , [0e5c0e4ab1dabf77d809a8c8f4104db3],

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)

schrauber 19.10.2015 19:20
AdwCleaner auch löschen lassen. Wie läuft der Rechner?

magigstar 20.10.2015 09:15
Das was AdwCleaner gefunden hat?
Ok, mache ich...

Eigentlich recht gut.. momentan...

Und das von Malwarebytes ebenfalls löschen?

schrauber 21.10.2015 11:40
Klar, Funde immer löschen :)

magigstar 14.11.2015 08:44
Ich glaube, ich sollte nochmal mit allen Programmen durchgehen... irgendwie stimmt da was nicht.. der FF ladet und ladet und ladet... stürtzt ab, lässt sich nicht schließen....

schrauber 15.11.2015 06:11
und das passiert nur bei FF?

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Und die Hardwarebeschleunigung abschalten in FF.

magigstar 17.11.2015 08:06
Ok, mache ich.
Kann es möglich sein, dass ich in der Zwischenzeit mir was gefangen habe, also ein Virus oder so ähnlich.
Das zwar alle Programme zeigen, dass das System sauber ist, aber das schon wieder veraltet ist?
Weil dann würde das mit Revo Unistaller nichts bringen.

schrauber 17.11.2015 19:20
Poste mal frische FRST logs.

magigstar 20.11.2015 19:15
Es gibt mehrere Möglichkeiten
  1. Ich habe mir was "Neues" eingefangen
  2. Das "Alte" ist noch nicht weg und nervt weiter


Wie ich sehe, gibt es im Chrome was, was man beachten sollte...


Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:19-11-2015
durchgeführt von DDDDD CCCCC (Administrator) auf ARBEITSCOMPUTER (20-11-2015 16:37:45)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Geladene Profile: DDDDD CCCCC (Verfügbare Profile: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
() C:\Windows\snuvcdsm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(RescueTime, Inc.) C:\Program Files (x86)\RescueTime\RescueTime.exe
(Mirko Böer) C:\Program Files (x86)\SSS\SimpleScreenshot.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SimpleScreenshot] => C:\Program Files (x86)\SSS\SIMPLESCREENSHOT.EXE [2255360 2008-02-09] (Mirko Böer)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-09-23]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll => Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: hxxp://www.zeitzuleben.de/2164-ziele-finden/
hxxp://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-14] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-11] (Apple Inc.)
FF Extension: ADB Helper - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\adbhelper@mozilla.org [2015-11-13]
FF Extension: Valence - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\fxdevtools-adapters@mozilla.org [2015-10-29]
FF Extension: Mailvelope - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\jid1-AQqSMBYb0a8ADg@jetpack.xpi [2015-11-13]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=55&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&SSPV="
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Präsentationen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10]
CHR Extension: (Google Docs) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-26] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ACHTUNG
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-17]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-21]
CHR Extension: (Google-Suche) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]
CHR Extension: (Google Tabellen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10]
CHR Extension: (Avira Browserschutz) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-19] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ACHTUNG
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (Google Wallet) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-26] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ACHTUNG
CHR Extension: (Google Mail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
S4 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-20 16:37 - 2015-11-20 16:38 - 00024344 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-11-20 16:37 - 2015-11-20 16:37 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-11-19 18:48 - 2015-11-19 18:48 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:55 - 00000000 ____D C:\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:53 - 00000594 _____ C:\Users\DDDDD CCCCC\Desktop\FreeOCR.lnk
2015-11-19 15:53 - 2015-11-19 15:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeOCR
2015-11-19 15:53 - 2007-03-10 10:11 - 02680320 _____ (HiComponents) C:\Windows\SysWOW64\ImageEnXLibrary.ocx
2015-11-19 15:52 - 2015-11-19 15:52 - 11316239 _____ ( ) C:\Users\DDDDD CCCCC\Downloads\freeocr5412.exe
2015-11-17 09:07 - 2015-11-17 09:07 - 00141145 _____ C:\Users\DDDDD CCCCC\Downloads\Online-Entgeltrechner.zip
2015-11-13 11:25 - 2015-11-13 11:25 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919
2015-11-12 13:14 - 2015-11-03 18:55 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 16:31 - 2015-11-11 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-11 16:29 - 2015-11-11 16:29 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-11-11 16:29 - 2015-11-11 16:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-11-11 16:28 - 2015-11-11 16:29 - 00000000 ____D C:\Program Files\iTunes
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files\iPod
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files\Bonjour
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2015-11-11 16:23 - 2015-11-11 16:23 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-11-11 16:23 - 2015-11-11 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-11 16:22 - 2015-11-11 16:23 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2015-11-11 13:32 - 2015-10-20 19:42 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 02608128 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-11-11 13:32 - 2015-10-20 18:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-11-11 13:31 - 2015-11-03 23:10 - 00390344 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 13:31 - 2015-11-03 22:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-11-11 13:31 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 13:31 - 2015-10-31 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 13:31 - 2015-10-31 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 13:31 - 2015-10-31 00:25 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-31 00:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 13:31 - 2015-10-31 00:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 13:31 - 2015-10-31 00:13 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 13:31 - 2015-10-31 00:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 13:31 - 2015-10-31 00:12 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 13:31 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 13:31 - 2015-10-31 00:04 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 13:31 - 2015-10-31 00:01 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-11-11 13:31 - 2015-10-30 23:53 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-11-11 13:31 - 2015-10-30 23:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-11-11 13:31 - 2015-10-30 23:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-11-11 13:31 - 2015-10-30 23:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-11-11 13:31 - 2015-10-30 23:34 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 13:31 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:29 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:29 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-11-11 13:31 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-11-11 13:31 - 2015-10-30 23:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 13:31 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-11-11 13:31 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-11-11 13:31 - 2015-10-20 02:12 - 05570496 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 02:12 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 13:31 - 2015-10-20 02:12 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 13:31 - 2015-10-20 02:09 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 02:04 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 13:31 - 2015-10-20 02:00 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:59 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-11-11 13:31 - 2015-10-20 01:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 01:48 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-11-11 13:31 - 2015-10-20 01:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-11-11 13:31 - 2015-10-20 01:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:41 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 13:31 - 2015-10-20 00:29 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-11-11 13:31 - 2015-10-20 00:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-11-11 13:31 - 2015-10-20 00:27 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-09-23 14:15 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 13:31 - 2015-09-23 14:15 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 13:31 - 2015-09-23 14:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 13:30 - 2015-10-29 18:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-11-11 13:30 - 2015-10-13 17:41 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 13:30 - 2015-10-13 17:40 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 13:30 - 2015-10-13 05:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 13:30 - 2015-10-01 19:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 13:30 - 2015-10-01 19:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-11 13:30 - 2015-10-01 18:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-11-10 11:47 - 2015-11-20 15:22 - 00000000 ____D C:\Users\DDDDD CCCCC\Downloads\Mietobjekt
2015-11-06 12:03 - 2015-11-06 12:03 - 00000264 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstwirksamkeitserwartung – Wikipedia.URL
2015-10-28 15:08 - 2015-10-28 15:08 - 00008046 _____ C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2015-10-27 13:07 - 2015-10-28 14:33 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbungen 2015
2015-10-26 10:33 - 2015-08-26 06:32 - 00311808 _____ C:\Users\DDDDD CCCCC\Desktop\Reisekostenabrechnung 2015.xls
2015-10-25 19:33 - 2015-10-25 19:33 - 00000259 _____ C:\Users\DDDDD CCCCC\Desktop\Haus & Grund Aktuell www.haus-und-grund.com.URL
2015-10-25 19:32 - 2015-10-25 19:32 - 00000249 _____ C:\Users\DDDDD CCCCC\Desktop\Recht-News**Verträge-vom-Anwalt.de.URL
2015-10-24 19:48 - 2015-10-24 19:48 - 00000291 _____ C:\Users\DDDDD CCCCC\Desktop\Das 12-Wochen-Selbstcoaching-Programm.URL
2015-10-24 19:47 - 2015-10-24 19:47 - 00000256 _____ C:\Users\DDDDD CCCCC\Desktop\Coaching.URL
2015-10-23 12:23 - 2015-10-23 12:49 - 00010719 _____ C:\Users\DDDDD CCCCC\Desktop\Mappe1.xlsx
2015-10-22 17:14 - 2015-10-22 17:14 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 854d1af6a1324f42910f1f8b74b2b3f41fb51fedf01b43d1a63e88c9a6f21790
2015-10-21 21:02 - 2015-10-21 21:02 - 00000267 _____ C:\Users\DDDDD CCCCC\Desktop\Das DISG®- Persönlichkeits-Profil.URL
2015-10-21 21:02 - 2015-10-21 21:02 - 00000257 _____ C:\Users\DDDDD CCCCC\Desktop\Anja Di Marco.URL
2015-10-21 09:04 - 2015-10-21 09:04 - 00000269 _____ C:\Users\DDDDD CCCCC\Desktop\Mit dem Lebensplan zu Klarheit und Motivation.URL

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-20 16:37 - 2015-02-10 18:48 - 02020352 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-11-20 16:37 - 2014-08-21 20:10 - 00000000 ____D C:\FRST
2015-11-20 16:15 - 2015-06-08 16:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-20 16:05 - 2012-08-14 18:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-20 16:00 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-20 16:00 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-20 15:55 - 2012-09-20 04:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-20 15:54 - 2011-11-14 06:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-11-20 15:54 - 2011-11-14 06:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-11-20 15:54 - 2009-07-14 06:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-20 15:53 - 2011-11-13 21:43 - 01444348 _____ C:\Windows\WindowsUpdate.log
2015-11-20 15:49 - 2014-06-18 08:20 - 00048961 _____ C:\Windows\setupact.log
2015-11-20 15:49 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-20 14:48 - 2015-05-31 13:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-20 14:45 - 2012-03-25 11:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-11-20 14:39 - 2012-09-20 04:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-20 12:37 - 2013-09-19 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-20 12:37 - 2012-03-11 02:08 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-20 12:36 - 2015-09-25 16:50 - 00000000 ____D C:\Users\DDDDD CCCCC\.oracle_jre_usage
2015-11-20 12:35 - 2015-09-25 16:50 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-11-17 21:04 - 2012-04-07 11:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-11-17 19:17 - 2012-04-10 14:54 - 00011120 _____ C:\Users\DDDDD CCCCC\Documents\OuProxy.log
2015-11-17 08:11 - 2014-08-05 14:08 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-17 08:10 - 2014-08-24 18:36 - 00000000 ____D C:\AdwCleaner
2015-11-16 08:53 - 2014-11-02 21:54 - 00000000 ____D C:\Users\EEEEE\Desktop\div. Briefe
2015-11-13 12:08 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-11-13 07:40 - 2012-04-02 19:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-13 07:40 - 2012-04-02 19:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-13 07:40 - 2011-11-15 21:21 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-13 07:35 - 2009-07-14 05:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-12 13:24 - 2013-07-13 08:36 - 00000000 ____D C:\Windows\system32\MRT
2015-11-12 13:11 - 2011-11-18 19:58 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-12 13:10 - 2014-03-28 22:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-11-12 13:10 - 2009-11-05 04:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-12 12:37 - 2013-10-05 08:28 - 01604278 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-11-12 12:30 - 2009-07-14 03:34 - 00000648 _____ C:\Windows\win.ini
2015-11-12 12:29 - 2009-11-05 01:26 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-12 12:23 - 2015-06-08 16:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-12 12:23 - 2015-05-31 13:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-11 16:31 - 2012-01-29 14:14 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Apple Computer
2015-11-11 16:31 - 2011-11-21 17:05 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Apple Computer
2015-11-11 16:28 - 2012-01-29 14:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-11-11 16:21 - 2011-11-20 19:42 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-11-11 12:57 - 2015-08-07 21:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-11 12:57 - 2014-06-20 13:07 - 00451096 _____ C:\Windows\PFRO.log
2015-11-10 08:27 - 2015-08-28 21:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-30 08:51 - 2015-06-11 20:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-30 08:51 - 2015-05-25 18:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-28 15:13 - 2012-08-29 10:11 - 00000000 ____D C:\Users\DDDDD CCCCC\.gimp-2.8
2015-10-27 14:27 - 2012-06-10 14:07 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbungen
2015-10-27 10:38 - 2012-03-11 19:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\SP
2015-10-26 11:37 - 2015-08-05 19:27 - 00011024 _____ C:\Users\DDDDD CCCCC\Desktop\Kilometer.xlsx
2015-10-25 12:06 - 2014-08-07 20:56 - 03492864 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-10-24 23:42 - 2015-09-26 18:47 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Sprüche
2015-10-24 23:38 - 2012-03-11 19:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\ERGO

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 07:10 - 2014-07-23 21:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 20:51 - 2015-02-22 14:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 18:28 - 2014-07-07 01:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 21:07 - 2014-09-22 21:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-10-28 15:08 - 2015-10-28 15:08 - 0008046 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 21:15 - 2013-08-12 21:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 10:26 - 2012-03-31 10:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 22:53 - 2011-11-13 22:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 19:19 - 2014-10-06 19:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\avgnt.exe
C:\Users\DDDDD CCCCC\AppData\Local\Temp\jre-8u66-windows-au.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-11-10 13:46

==================== Ende von FRST.txt ============================

magigstar 20.11.2015 19:18
Was sind eigentlich die "Firewall Regeln (Nicht auf der Ausnahmeliste)"?


Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:19-11-2015
durchgeführt von DDDDD CCCCC (2015-11-20 16:39:10)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-11-13 21:46:57)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDDD CCCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDDD CCCCC
EEEEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20077 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
BitTorrent (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\BitTorrent) (Version: 7.9.2.31638 - BitTorrent Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Booster-Web (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Booster-Web) (Version: 4 - ${CompanyName})
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.9.1 (HKLM-x32\...\{5EA1DED0-5285-11E5-8AA1-0050569584E9}) (Version: 5.9.1.8742 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FreeOCR v5.4 (HKLM-x32\...\freeocr_is1) (Version:  - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GoToMeeting 7.5.1.3911 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.5.1.3911 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 42.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 de)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - Daniel Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.15.11 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\DDDDD CCCCC\AppData\Roaming\moters\supna.dll => Keine Datei <==== ACHTUNG

==================== Wiederherstellungspunkte =========================

10-11-2015 08:31:17 Windows Update
12-11-2015 12:24:26 Windows Update
13-11-2015 07:21:48 Windows Update
17-11-2015 08:02:01 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2015-10-29 14:47 - 00000029 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDDD CCCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {49723E02-558F-4E12-BD48-8ACD6598EC43} - System32\Tasks\HP AR Program Upload - 854d1af6a1324f42910f1f8b74b2b3f41fb51fedf01b43d1a63e88c9a6f21790 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {4D38690B-CEB2-4061-A865-4DF2FBE864A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {6E788608-033F-4B40-8A06-04D8B880BF59} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {A2488771-C70F-410B-ACC7-0C57087007C2} - System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A8E85CF5-280D-463A-87FA-085DDBCDF6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\3911\g2mupdate.exe [2015-11-12] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-13] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\3911\g2mupload.exe [2015-11-12] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DANIEL~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\3911\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\3911\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-01-13 09:04 - 2011-01-13 09:04 - 00030080 _____ () C:\Windows\snuvcdsm.exe
2011-11-13 22:52 - 2011-11-13 22:51 - 00200704 _____ () C:\Windows\PLFSetI.exe
2009-07-29 13:10 - 2009-07-29 13:10 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-13 21:44 - 2011-11-13 21:44 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-12-28 14:38 - 2014-04-22 19:39 - 00645592 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2015-09-03 14:45 - 2015-09-03 14:45 - 00439304 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2015-09-03 14:45 - 2015-09-03 14:45 - 00321032 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7865 mehr Seiten.

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\google.de -> hxxps://www.google.de
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\1-2005-search.com -> www.1-2005-search.com

Da befinden sich 12656 mehr Seiten.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: AAV UpdateService => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Apple Mobile Device Service => 2
MSCONFIG\Services: Avira.ServiceHost => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: ePowerSvc => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: Greg_Service => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: IAANTMON => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: RS_Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: TurboBoost => 3
MSCONFIG\Services: UNS => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{585AA0A3-FEAB-49EE-8D2A-6EE98CD9E875}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E14B1E9F-BDF7-48D5-A58D-69D940C69E9C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8667E163-0B78-401F-9C11-97AA00BD7EBB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3F81BC3A-0F0F-43D7-982C-DFA12A366C07}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AC5B506A-A443-46A1-B62C-1EAA0BF2ACBE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9DD0BC8F-FCCD-4949-B7C6-8657BE07FF54}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{532791CB-D66E-4800-8AAD-BA957B3BEA69}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA8B6329-656C-4DE8-B608-C1A7725A364E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B7E6E726-5025-494C-875B-C2B48E3DBB88}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2CBC7107-1D6F-430A-9B34-C20114A63FA4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/20/2015 03:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RescueTime.exe, Version: 2.2.1.722, Zeitstempel: 0x4bbe0958
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000024
ID des fehlerhaften Prozesses: 0x9ac
Startzeit der fehlerhaften Anwendung: 0xRescueTime.exe0
Pfad der fehlerhaften Anwendung: RescueTime.exe1
Pfad des fehlerhaften Moduls: RescueTime.exe2
Berichtskennung: RescueTime.exe3

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4212

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4212

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


Systemfehler:
=============
Error: (11/20/2015 03:22:41 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (11/17/2015 08:00:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Volumeschattenkopie" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/17/2015 08:00:14 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Volumeschattenkopie erreicht.

Error: (11/17/2015 07:59:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Volumeschattenkopie" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/17/2015 07:59:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Volumeschattenkopie erreicht.

Error: (11/17/2015 07:58:37 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053VSS{0B5A2C52-3EB9-470A-96E2-6C6D4570E40F}

Error: (11/17/2015 07:58:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Volumeschattenkopie" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/17/2015 07:58:35 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Volumeschattenkopie erreicht.

Error: (11/17/2015 07:56:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.

Error: (11/14/2015 09:39:38 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}


CodeIntegrity:
===================================
  Date: 2015-07-28 21:30:24.923
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.917
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.912
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.906
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.854
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.849
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.842
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.836
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.046
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.040
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 3956.5 MB
Verfügbarer physikalischer RAM: 2511.39 MB
Summe virtueller Speicher: 7911.21 MB
Verfügbarer virtueller Speicher: 6331.88 MB

==================== Laufwerke ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:72.23 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:285.01 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

schrauber 21.11.2015 19:47
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

magigstar 21.11.2015 20:34
Och nee.. dann habe ich doch mir was eingefangen....


Code:
ComboFix 15-11-17.01 - DDDD CCCCC 21.11.2015  20:14:48.4.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3956.1866 [GMT 1:00]
ausgeführt von:: c:\users\DDDD CCCCC\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\sss
c:\program files (x86)\sss\licence.txt
c:\program files (x86)\sss\ReadMe.txt
c:\program files (x86)\sss\SimpleScreenshot.exe
c:\program files (x86)\sss\upload.php
c:\windows\wininit.ini
.
---- Vorheriger Suchlauf -------
.
c:\program files (x86)\sss\licence.txt
c:\program files (x86)\sss\ReadMe.txt
c:\program files (x86)\sss\SimpleScreenshot.exe
c:\program files (x86)\sss\upload.php
c:\users\DANIEL~1\AppData\Local\Temp\7zS552E\HPSLPSVC64.DLL
c:\users\DANIEL~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\DDDD CCCCC\AppData\Local\Temp\7zS552E\HPSLPSVC64.DLL
c:\users\DDDD CCCCC\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_HPSLPSVC
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-10-21 bis 2015-11-21  ))))))))))))))))))))))))))))))
.
.
2015-11-21 19:23 . 2015-11-21 19:23        --------        d-----w-        c:\users\Versuch\AppData\Local\temp
2015-11-21 19:23 . 2015-11-21 19:23        --------        d-----w-        c:\users\Public\AppData\Local\temp
2015-11-21 19:23 . 2015-11-21 19:23        --------        d-----w-        c:\users\EEEEE\AppData\Local\temp
2015-11-21 19:23 . 2015-11-21 19:23        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-11-21 06:36 . 2015-11-21 06:36        --------        d-----w-        c:\program files (x86)\Common Files\Acronis
2015-11-21 06:36 . 2015-11-21 06:36        --------        d-----w-        c:\program files (x86)\Acronis
2015-11-21 06:32 . 2015-11-21 06:32        --------        d-----w-        c:\program files (x86)\HD Tune
2015-11-20 20:49 . 2015-11-17 06:43        11138400        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B3D1BB8-BAD9-4DCB-B3FF-EEE63D986B6C}\mpengine.dll
2015-11-20 20:15 . 2015-06-24 14:00        1190000        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A68429F4-25E0-4D1C-9ED4-FBF59EA5A530}\gapaengine.dll
2015-11-20 20:15 . 2015-11-17 06:43        11138400        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-11-20 20:11 . 2015-11-20 20:22        --------        d-----w-        c:\program files (x86)\Microsoft Security Client
2015-11-20 20:11 . 2015-11-20 20:23        --------        d-----w-        c:\program files\Microsoft Security Client
2015-11-20 20:10 . 2015-10-08 23:22        69120        ----a-w-        c:\windows\system32\nlsbres.dll
2015-11-20 20:10 . 2015-10-08 23:18        6656        ----a-w-        c:\windows\SysWow64\kbdgeoqw.dll
2015-11-20 20:10 . 2015-10-08 23:18        6656        ----a-w-        c:\windows\SysWow64\KBDAZEL.DLL
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\kbdgeoqw.dll
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\KBDAZEL.DLL
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\KBDAZE.DLL
2015-11-20 20:10 . 2015-10-08 23:17        69120        ----a-w-        c:\windows\SysWow64\nlsbres.dll
2015-11-20 18:23 . 2015-10-29 09:28        11138400        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{1B45D3F0-22AB-49AC-963E-0A7E565C4CDF}\mpengine.dll
2015-11-20 11:37 . 2015-11-20 11:37        --------        d-----w-        c:\program files (x86)\Common Files\Java
2015-11-19 17:48 . 2015-11-19 17:48        --------        d-----w-        c:\users\DDDD CCCCC\AppData\Local\FreeOCR
2015-11-19 14:53 . 2007-03-10 09:11        2680320        ----a-w-        c:\windows\SysWow64\ImageEnXLibrary.ocx
2015-11-19 14:53 . 2015-11-19 14:55        --------        d-----w-        C:\FreeOCR
2015-11-12 12:14 . 2015-11-03 17:55        3211264        ----a-w-        c:\windows\system32\win32k.sys
2015-11-11 15:28 . 2015-11-11 15:28        --------        d-----w-        c:\program files\iPod
2015-11-11 15:28 . 2015-11-11 15:28        --------        d-----w-        c:\program files (x86)\iTunes
2015-11-11 15:28 . 2015-11-11 15:29        --------        d-----w-        c:\program files\iTunes
2015-11-11 15:25 . 2015-11-11 15:25        --------        d-----w-        c:\program files\Bonjour
2015-11-11 15:25 . 2015-11-11 15:25        --------        d-----w-        c:\program files (x86)\Bonjour
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2015-11-11 15:22 . 2015-11-11 15:23        --------        d-----w-        c:\program files (x86)\QuickTime
2015-11-11 15:21 . 2015-11-11 15:21        --------        d-----w-        c:\program files (x86)\Apple Software Update
2015-11-11 12:31 . 2015-10-30 23:40        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2015-11-11 12:30 . 2015-10-13 16:41        497664        ----a-w-        c:\windows\system32\drivers\afd.sys
2015-11-10 07:27 . 2015-11-10 07:27        10592424        ----a-w-        c:\program files (x86)\Mozilla Firefox\icudt55.dll
2015-11-10 07:27 . 2015-11-10 07:27        901288        ----a-w-        c:\program files (x86)\Mozilla Firefox\icuuc55.dll
2015-11-10 07:27 . 2015-11-10 07:27        59560        ----a-w-        c:\program files (x86)\Mozilla Firefox\lgpllibs.dll
2015-11-10 07:27 . 2015-11-10 07:27        1287848        ----a-w-        c:\program files (x86)\Mozilla Firefox\icuin55.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-20 11:35 . 2015-09-25 15:50        97888        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-11-17 07:11 . 2014-08-05 13:08        192216        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-11-13 06:40 . 2012-04-02 18:28        780488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-13 06:40 . 2011-11-15 20:21        142536        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-12 12:11 . 2011-11-18 18:58        145617392        ----a-w-        c:\windows\system32\MRT.exe
2015-10-29 17:50 . 2015-11-11 12:30        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-11 12:30        309248        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-11 12:30        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-11 12:30        103424        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:49 . 2015-11-11 12:30        562176        ----a-w-        c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-11 12:30        2178560        ----a-w-        c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-11 12:30        470528        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-11 12:30        211968        ----a-w-        c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:39 . 2015-11-11 12:30        2560        ----a-w-        c:\windows\apppatch\AcRes.dll
2015-10-20 00:45 . 2015-11-11 12:31        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2015-10-13 00:29 . 2015-10-13 00:29        875720        ----a-w-        c:\windows\SysWow64\msvcr120_clr0400.dll
2015-10-13 00:22 . 2015-10-13 00:22        869568        ----a-w-        c:\windows\system32\msvcr120_clr0400.dll
2015-10-05 07:50 . 2014-08-05 13:08        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys
2015-10-05 07:50 . 2014-08-05 13:08        109272        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2015-10-05 07:50 . 2014-08-05 13:08        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
2015-10-01 18:06 . 2015-10-13 19:39        692672        ----a-w-        c:\windows\system32\winload.efi
2015-10-01 18:04 . 2015-10-13 19:39        616360        ----a-w-        c:\windows\system32\winresume.efi
2015-10-01 18:00 . 2015-10-13 19:39        63488        ----a-w-        c:\windows\system32\setbcdlocale.dll
2015-10-01 18:00 . 2015-10-13 19:39        59392        ----a-w-        c:\windows\system32\appidapi.dll
2015-10-01 18:00 . 2015-10-13 19:39        32768        ----a-w-        c:\windows\system32\appidsvc.dll
2015-10-01 18:00 . 2015-10-13 19:39        17920        ----a-w-        c:\windows\system32\appidcertstorecheck.exe
2015-10-01 18:00 . 2015-10-13 19:39        147456        ----a-w-        c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-13 19:39        50688        ----a-w-        c:\windows\SysWow64\appidapi.dll
2015-10-01 17:00 . 2015-10-13 19:39        61440        ----a-w-        c:\windows\system32\drivers\appid.sys
2015-09-18 19:22 . 2015-10-15 09:33        25432        ----a-w-        c:\windows\system32\CompatTelRunner.exe
2015-09-18 19:19 . 2015-10-15 09:33        700416        ----a-w-        c:\windows\system32\invagent.dll
2015-09-18 19:19 . 2015-10-15 09:33        766464        ----a-w-        c:\windows\system32\generaltel.dll
2015-09-18 19:19 . 2015-10-15 09:33        503808        ----a-w-        c:\windows\system32\devinv.dll
2015-09-18 19:19 . 2015-10-15 09:33        73216        ----a-w-        c:\windows\system32\acmigration.dll
2015-09-18 19:19 . 2015-10-15 09:33        1291264        ----a-w-        c:\windows\system32\appraiser.dll
2015-09-18 19:09 . 2015-10-15 09:33        1163776        ----a-w-        c:\windows\system32\aeinv.dll
2015-09-02 03:04 . 2015-09-09 17:08        41984        ----a-w-        c:\windows\system32\lpk.dll
2015-09-02 03:04 . 2015-09-09 17:08        100864        ----a-w-        c:\windows\system32\fontsub.dll
2015-09-02 03:04 . 2015-09-09 17:08        14336        ----a-w-        c:\windows\system32\dciman32.dll
2015-09-02 03:04 . 2015-09-09 17:08        46080        ----a-w-        c:\windows\system32\atmlib.dll
2015-09-02 02:48 . 2015-09-09 17:08        70656        ----a-w-        c:\windows\SysWow64\fontsub.dll
2015-09-02 02:48 . 2015-09-09 17:08        10240        ----a-w-        c:\windows\SysWow64\dciman32.dll
2015-09-02 02:48 . 2015-09-09 17:08        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2015-09-02 02:47 . 2015-09-09 17:08        25600        ----a-w-        c:\windows\SysWow64\lpk.dll
2015-09-02 01:47 . 2015-09-09 17:08        372736        ----a-w-        c:\windows\system32\atmfd.dll
2015-09-02 01:33 . 2015-09-09 17:08        299520        ----a-w-        c:\windows\SysWow64\atmfd.dll
2015-08-27 18:18 . 2015-09-09 17:21        2004480        ----a-w-        c:\windows\system32\msxml6.dll
2015-08-27 18:18 . 2015-09-09 17:21        1887232        ----a-w-        c:\windows\system32\msxml3.dll
2015-08-27 18:13 . 2015-09-09 17:21        2048        ----a-w-        c:\windows\system32\msxml6r.dll
2015-08-27 18:13 . 2015-09-09 17:21        2048        ----a-w-        c:\windows\system32\msxml3r.dll
2015-08-27 17:58 . 2015-09-09 17:21        1391104        ----a-w-        c:\windows\SysWow64\msxml6.dll
2015-08-27 17:58 . 2015-09-09 17:21        1241088        ----a-w-        c:\windows\SysWow64\msxml3.dll
2015-08-27 17:51 . 2015-09-09 17:21        2048        ----a-w-        c:\windows\SysWow64\msxml6r.dll
2015-08-27 17:51 . 2015-09-09 17:21        2048        ----a-w-        c:\windows\SysWow64\msxml3r.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2014-04-23 533568]
"HP Photosmart 5520 series (NET)"="c:\program files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SimpleScreenshot"="c:\progra~2\SSS\SIMPLESCREENSHOT.EXE" [BU]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-09 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-10-13 60688]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2015-08-06 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-11-09 596528]
"adm_tray.exe"="c:\program files (x86)\Acronis\DriveMonitor\adm_tray.exe" [2011-02-24 470120]
.
c:\users\DDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2015-9-3 1195016]
RescueTime.lnk - c:\program files (x86)\RescueTime\RescueTime.exe [2013-5-22 2401792]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"Download Protect"=c:\programdata\dlprotect.exe
"iSaverCtrl"=c:\program files (x86)\iSaver\iSaverCtrl.exe --startup
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 ALSysIO;ALSysIO;c:\users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Common Files\AAV\aavus.exe;c:\program files (x86)\Common Files\AAV\aavus.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BotkindSyncService;Botkind Service;c:\program files (x86)\Allway Sync\Bin\SyncService.exe service;c:\program files (x86)\Allway Sync\Bin\SyncService.exe service [x]
R4 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
R4 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
R4 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
R4 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
R4 NoIPDUCService4;NO-IP DUC v4;c:\program files (x86)\No-IP\ducservice.exe;c:\program files (x86)\No-IP\ducservice.exe [x]
R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
R4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
R4 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe;c:\program files\OO Software\Defrag\oodag.exe [x]
R4 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
R4 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
R4 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
R4 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
R4 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R4 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
R4 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 UI Assistant Service;UI Assistant Service;c:\program files (x86)\Join Air\AssistantServices.exe;c:\program files (x86)\Join Air\AssistantServices.exe [x]
R4 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S1 SLEE_18_DRIVER;Steganos Live Encryption Engine 18 [Driver];c:\windows\Sleen1864.sys;c:\windows\Sleen1864.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 EkaProt6;Ekahau User Protocol Driver for NDIS 6;c:\windows\system32\DRIVERS\ekaprot6.sys;c:\windows\SYSNATIVE\DRIVERS\ekaprot6.sys [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-11-13 06:24        997704        ----a-w-        c:\program files (x86)\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-11-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 06:40]
.
2015-11-21 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
- c:\users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe [2015-11-21 17:05]
.
2015-11-21 c:\windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
- c:\users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe [2015-11-21 17:05]
.
2015-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-13 15:29]
.
2015-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-13 15:29]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e}]
c:\program files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SNUVCDSM"="c:\windows\snuvcdsm.exe" [2011-01-13 30080]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-29 8312352]
"PLFSetL"="c:\windows\PLFSetL.exe" [2011-01-13 99712]
"PLFSetI"="c:\windows\PLFSetI.exe" [2011-11-13 200704]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-11 349480]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-22 295936]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-07-22 323072]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 823840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-10-16 170256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-30 1337000]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-02-12 462400]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: Auswahl speichern - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
IE: Bild ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
IE: Diese Seite ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
IE: Free YouTube Download - c:\users\DDDD CCCCC\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Lesezeichen ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Neue Notiz - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
IE: URL notieren - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
Trusted Zone: google.com\www
TCP: DhcpNameServer = 192.168.178.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\DDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\
FF - prefs.js: browser.startup.homepage - hxxp://www.zeitzuleben.de/2164-ziele-finden/|http://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
AddRemove-Chandler - c:\program files (x86)\Chandler1.0.3\uninst.exe
AddRemove-CoreAAC Audio Decoder - c:\windows\system32\CoreAAC-uninstall.exe
AddRemove-{ad2818b3-1616-4ec8-855d-be6936103e5a} - c:\programdata\Package Cache\{ad2818b3-1616-4ec8-855d-be6936103e5a}\free-system-utilities_Setup_chip_de-DE.exe
AddRemove-BitTorrent - c:\users\DDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
AddRemove-Booster-Web - c:\program files (x86)\Booster-Web\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_185_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_185_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32]
@DACL=(02 0000)
@=expand:"%SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_185_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_185_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.19"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
@DACL=(02 0000)
@="Bing"
"DisplayName"="@ieframe.dll,-12512"
"URL"="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-11-21  20:28:21
ComboFix-quarantined-files.txt  2015-11-21 19:28
ComboFix2.txt  2015-02-01 07:55
ComboFix3.txt  2014-08-24 11:42
.
Vor Suchlauf: 20 Verzeichnis(se), 77.538.488.320 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 80.414.703.616 Bytes frei
.
- - End Of File - - 69EDF562F2245EF856FCF51E0A287486
A36C5E4F47E84449FF07ED3517B43A31

Was sind eigentlich die "Firewall Regeln (Nicht auf der Ausnahmeliste)" im FRST?

schrauber 22.11.2015 07:47
Das sind die aus Windows ausgelesenen Firewallregeln.

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

magigstar 22.11.2015 22:42
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 22.11.2015
Suchlaufzeit: 16:49
Protokolldatei: Malwarebytes Anti-Malware.txt
Administrator: Ja

Version: 2.2.0.1024
Malware-Datenbank: v2015.11.22.04
Rootkit-Datenbank: v2015.11.22.02
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DDDDD CCCCC

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 460460
Abgelaufene Zeit: 35 Min., 10 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 5
Adware.Hicosmea, HKCU\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}, , [d13b87faa6e571c5a393855d7b88c23e],
PUP.Optional.Hicosmea, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}, , [9c708af7e1aa79bdc6abfe650df6a35d],
PUP.Optional.MultiPlug, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, , [ec20136e0b80fe385592bff4e3202ad6],
PUP.Optional.MultiPlug, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, , [ec20136e0b80fe385592bff4e3202ad6],
PUP.Optional.Hicosmea, HKU\S-1-5-21-1242904208-471078349-2963378918-1000_Classes\WOW6432NODE\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}, , [4bc1473a6724b5817ff2451ea261b54b],

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 117
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ar, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\bg, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ca, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\cs, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\da, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\de, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\el, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_GB, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_US, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es_419, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\et, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fi, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fil, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fr, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\he, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hi, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hu, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\id, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\it, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ja, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ko, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lt, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lv, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ms, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\nl, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\no, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pl, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_BR, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_PT, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ro, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ru, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sk, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sl, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sr, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sv, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\th, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\tr, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\uk, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\vi, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_CN, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_TW, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_metadata, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\base, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\engines, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\data, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\templates, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\de, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\en, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\en_US, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\es, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\fr, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\it, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\pt_BR, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_metadata, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\css, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\html, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\bg, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ca, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\cs, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\da, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\de, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\el, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en_GB, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es_419, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\et, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fi, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fil, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fr, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hi, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hr, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hu, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\id, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\it, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ja, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ko, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lt, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lv, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nb, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nl, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pl, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_BR, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_PT, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ro, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ru, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sk, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sl, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sr, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sv, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\th, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\tr, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\uk, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\vi, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_CN, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_TW, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_metadata, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda, , [070588f9d0bbbc7a911864270103f50b],

Dateien: 202
PUP.Optional.Hicosmea.Gen, C:\Windows\Installer\73825f.msi, , [cf3d0c7596f5eb4bc907fd21ec156a96],
Trojan.Injector.BHO, C:\settings.ini, , [1af23c45ee9d54e2dba9820912f22bd5],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\manifest.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\icon_128.png, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\icon_16.png, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\main.html, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\main.js, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ar\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\bg\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ca\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\cs\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\da\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\de\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\el\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_GB\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_US\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es_419\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\et\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fi\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fil\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fr\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\he\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hi\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hu\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\id\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\it\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ja\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ko\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lt\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lv\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ms\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\nl\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\no\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pl\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_BR\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_PT\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ro\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ru\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sk\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sl\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sr\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sv\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\th\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\tr\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\uk\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\vi\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_CN\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_TW\messages.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_metadata\computed_hashes.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_metadata\verified_contents.json, , [f01c83fef299280e525717747b899769],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\manifest.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\api-rules.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\app.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\blocked.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\content.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\search.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\base\search.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\content\engines\google.css, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro-Bold.eot, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro-Bold.woff, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro-Light.eot, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro-Light.woff, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro.eot, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\fonts\KievitWebPro.woff, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\animated-overlay.gif, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_diagonals-thick_18_b81900_40x40.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_diagonals-thick_20_666666_40x40.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_flat_10_000000_40x100.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_glass_100_f6f6f6_1x400.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_glass_100_fdf5ce_1x400.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_glass_65_ffffff_1x400.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_gloss-wave_35_f6a828_500x100.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_highlight-soft_100_eeeeee_1x100.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-bg_highlight-soft_75_ffe45c_1x100.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-icons_222222_256x240.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-icons_228ef1_256x240.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-icons_ef8c08_256x240.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-icons_ffd27a_256x240.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\css\images\ui-icons_ffffff_256x240.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\data\effective_tld_names.dat.txt, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\app.html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\blocked.html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\locale.html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\test.html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\top.html, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\html\templates\indexed.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\de-DE.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\en-US.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\es-ES.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\fr-FR.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\it-IT.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\i18n\pt-BR.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_logo.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_close_white.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\info_empty.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\absb-attention.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\absb-checks.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\absb-close.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\abs_avira_umbrella_white.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_icon128.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_icon16.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_icon24.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_icon32.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_icon48.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\avira_logo.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\classification_safe.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\classification_safe_lg.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\classification_unsafe.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\classification_unsafe_lg.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\close-offers-bar.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\close.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_close.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_feedback.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_search_dark.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_search_dark.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_search_light.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_search_light.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\dash_search_normal.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\expand-arrow.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\info_full.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\offers-rating.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\question-mark.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\scroll-down.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\serp_info_safe.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\serp_info_unsafe.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\settings-24.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\switch-on.png, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\trackers_icon.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\trackers_icon_nb.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\img\white_check.svg, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\app.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\background.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\blocked.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\content.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\content_start.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\locale.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\js\bunches\search.js, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\de\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\en\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\en_US\messages-sim.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\en_US\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\es\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\fr\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\it\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_locales\pt_BR\messages.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_metadata\computed_hashes.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\flliilndjeohchalpbbcdekjklbdgfkk\1.4.2_0\_metadata\verified_contents.json, , [f61650317912de5851583655689ca957],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\manifest.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_background.js, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_window.js, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\css\craw_window.css, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\html\craw_window.html, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\flapper.gif, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\icon_128.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\icon_16.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_close.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_hover.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_maximize.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_pressed.png, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\bg\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ca\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\cs\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\da\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\de\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\el\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en_GB\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es_419\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\et\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fi\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fil\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fr\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hi\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hr\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hu\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\id\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\it\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ja\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ko\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lt\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lv\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nb\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nl\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pl\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_BR\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_PT\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ro\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ru\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sk\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sl\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sr\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sv\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\th\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\tr\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\uk\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\vi\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_CN\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_TW\messages.json, , [070588f9d0bbbc7a911864270103f50b],
PUP.Optional.HijackModifiedExtension, C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_metadata\verified_contents.json, , [070588f9d0bbbc7a911864270103f50b],

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
# AdwCleaner v5.022 - Bericht erstellt am 22/11/2015 um 22:11:37
# Aktualisiert am 22/11/2015 von Xplode
# Datenbank : 2015-11-22.2 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : DDDD CCCCC - ARBEITSCOMPUTER
# Gestartet von : C:\Users\DDDD CCCCC\Downloads\adwcleaner_5.022.exe
# Option : Suchlauf
# Unterstützung : http://toolslib.net/forum

***** [ Dienste ] *****


***** [ Ordner ] *****


***** [ Dateien ] *****


***** [ DLL ] *****


***** [ Verknüpfungen ] *****


***** [ Aufgabenplanung ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKLM\SOFTWARE\68092ad5-698d-4be8-a74f-ce15bfc2e7e8
Schlüssel Gefunden : HKLM\SOFTWARE\99ee2e15-617c-d823-fff0-46ed85ec51fd
Schlüssel Gefunden : HKLM\SOFTWARE\ba5cbe1b-a00a-4d46-81e4-746cea11eaa3
Schlüssel Gefunden : HKLM\SOFTWARE\da19990f-007b-44a5-8fbd-3045570d1162
Schlüssel Gefunden : HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{B5147546-9359-4D9B-8B36-F54C54555799}]
Schlüssel Gefunden : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gefunden : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\18C9E3869A16248439FE3FF9EB02207A
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D8011310B2622942868A458964FFDC5
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C63F7979DCC2154CB9591969A5CB89D
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DD31E6C1A73B334383DF186676F4D20
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB3204F747B20694B8D49EF92D8DC94B
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C81E33A400B6F814E90C7A3354E2A3A5
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EDBF68C5F16790341B7C6FD7C7F8E4FC
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFA531D0F3A71504DA7AC6A11CE33739

***** [ Internetbrowser ] *****

[C:\Users\DDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Gefunden : hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=55&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&SSPV=
[C:\Users\DDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : obdejhodejngcbmkiddfjkieejekbfil

########## EOF - C:\AdwCleaner\AdwCleaner[S14].txt - [3587 Bytes] ##########
Code:
# AdwCleaner v5.022 - Bericht erstellt am 22/11/2015 um 22:16:43
# Aktualisiert am 22/11/2015 von Xplode
# Datenbank : 2015-11-22.2 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : DDDDD CCCCC - ARBEITSCOMPUTER
# Gestartet von : C:\Users\DDDDD CCCCC\Downloads\adwcleaner_5.022.exe
# Option : Löschen
# Unterstützung : http://toolslib.net/forum

***** [ Dienste ] *****


***** [ Ordner ] *****


***** [ Dateien ] *****


***** [ DLLs ] *****


***** [ Verknüpfungen ] *****


***** [ Aufgabenplanung ] *****


***** [ Registrierungsdatenbank ] *****

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\68092ad5-698d-4be8-a74f-ce15bfc2e7e8
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\99ee2e15-617c-d823-fff0-46ed85ec51fd
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\ba5cbe1b-a00a-4d46-81e4-746cea11eaa3
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\da19990f-007b-44a5-8fbd-3045570d1162
[-] Schlüssel Gelöscht : HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{B5147546-9359-4D9B-8B36-F54C54555799}]
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\18C9E3869A16248439FE3FF9EB02207A
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D8011310B2622942868A458964FFDC5
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C63F7979DCC2154CB9591969A5CB89D
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DD31E6C1A73B334383DF186676F4D20
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB3204F747B20694B8D49EF92D8DC94B
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C81E33A400B6F814E90C7A3354E2A3A5
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EDBF68C5F16790341B7C6FD7C7F8E4FC
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFA531D0F3A71504DA7AC6A11CE33739

***** [ Internetbrowser ] *****

[-] [C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Gelöscht : hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M7F3C43B3-690F-4276-959F-1C74A797CA2A&SearchSource=55&CUI=&UM=8&UP=SP9050A32E-D786-4A42-9E49-5663C4588ECE&SSPV=
[-] [C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : obdejhodejngcbmkiddfjkieejekbfil

*************************

:: "Tracing" Schlüssel gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

########## EOF - C:\AdwCleaner\AdwCleaner[C7].txt - [3926 Bytes] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.0 (11.12.2015)
Operating System: Windows 7 Home Premium x64
Ran by DDDD CCCC (Administrator) on 22.11.2015 at 22:34:56,05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.11.2015 at 22:38:56,12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

magigstar 22.11.2015 23:05
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:22-11-2015
durchgeführt von DDDD CCCC (Administrator) auf ARBEITSCOMPUTER (22-11-2015 22:49:49)
Gestartet von C:\Users\DDDD CCCC\Desktop
Geladene Profile: DDDD CCCC (Verfügbare Profile: DDDD CCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [462400 2011-02-12] (Acronis)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SimpleScreenshot] => C:\PROGRA~2\SSS\SIMPLESCREENSHOT.EXE
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [adm_tray.exe] => C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe [470120 2011-02-24] ()
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
Startup: C:\Users\DDDD CCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDD CCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-09-23]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll => Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\DDDD CCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: hxxp://www.zeitzuleben.de/2164-ziele-finden/
hxxp://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-14] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDD CCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-11] (Apple Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\DDDD CCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\extensions\adblockpopups@jessehakanen.net.xpi [2015-11-22]
FF Extension: ADB Helper - C:\Users\DDDD CCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\adbhelper@mozilla.org [2015-11-13]
FF Extension: Valence - C:\Users\DDDD CCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\fxdevtools-adapters@mozilla.org [2015-10-29]
FF Extension: Mailvelope - C:\Users\DDDD CCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\jid1-AQqSMBYb0a8ADg@jetpack.xpi [2015-11-13]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR Profile: C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Präsentationen) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10]
CHR Extension: (Google Drive) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]
CHR Extension: (YouTube) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-17]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-21]
CHR Extension: (Google-Suche) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]
CHR Extension: (Google Tabellen) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (Google Mail) - C:\Users\DDDD CCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
S4 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC)
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-22 22:38 - 2015-11-22 22:45 - 00000690 _____ C:\Users\DDDD CCCC\Desktop\JRT.txt
2015-11-22 22:34 - 2015-11-22 22:34 - 01599080 _____ (Malwarebytes) C:\Users\DDDD CCCC\Downloads\JRT.exe
2015-11-22 22:09 - 2015-11-22 22:09 - 01733632 _____ C:\Users\DDDD CCCC\Downloads\adwcleaner_5.022.exe
2015-11-22 21:58 - 2015-11-22 22:00 - 00071434 _____ C:\Users\DDDD CCCC\Desktop\Malwarebytes Anti-Malware.txt
2015-11-22 16:48 - 2015-11-22 16:48 - 00037873 _____ C:\Users\DDDD CCCC\Desktop\ComboFix.txt
2015-11-22 16:47 - 2015-11-22 16:47 - 00037873 _____ C:\ComboFix.txt
2015-11-22 00:33 - 2015-11-22 00:33 - 00275544 _____ C:\Windows\Minidump\112215-33805-01.dmp
2015-11-22 00:21 - 2015-11-22 00:32 - 626154878 _____ C:\Windows\MEMORY.DMP
2015-11-22 00:21 - 2015-11-22 00:21 - 00275544 _____ C:\Windows\Minidump\112215-37845-01.dmp
2015-11-22 00:15 - 2015-11-22 00:14 - 00000918 _____ C:\Users\DDDD CCCC\Desktop\Sandboxed Web Browser.lnk
2015-11-22 00:14 - 2015-11-22 00:36 - 00001768 _____ C:\Windows\Sandboxie.ini
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ___RD C:\Sandbox
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\Program Files\Sandboxie
2015-11-22 00:13 - 2015-11-22 00:14 - 08518280 _____ (Sandboxie Holdings, LLC) C:\Users\DDDD CCCC\Downloads\SandboxieInstall_5.04(1).exe
2015-11-22 00:12 - 2015-11-22 00:12 - 08518280 _____ (Sandboxie Holdings, LLC) C:\Users\DDDD CCCC\Downloads\SandboxieInstall_5.04.exe
2015-11-22 00:12 - 2015-11-22 00:12 - 01466656 _____ C:\Users\DDDD CCCC\Downloads\Sandboxie - CHIP-Installer.exe
2015-11-21 20:35 - 2015-11-21 20:35 - 25527544 _____ C:\Users\DDDD CCCC\Downloads\SeaToolsforWindowsSetup.exe
2015-11-21 20:07 - 2015-11-21 20:08 - 05639131 ____R (Swearware) C:\Users\DDDD CCCC\Desktop\ComboFix.exe
2015-11-21 09:34 - 2015-11-21 09:34 - 00000309 _____ C:\Users\DDDD CCCC\Desktop\Vermögensverwaltende GmbH Auswegstrategie vor der Abgeltungsteuer.URL
2015-11-21 07:36 - 2015-11-21 07:36 - 00001110 _____ C:\Users\Public\Desktop\Acronis Drive Monitor.lnk
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\Program Files (x86)\HD Tune
2015-11-21 07:31 - 2015-11-21 07:31 - 18992072 _____ C:\Users\DDDD CCCC\Downloads\ADM_de-DE.exe
2015-11-21 07:31 - 2015-11-21 07:31 - 00642632 _____ (EFD Software ) C:\Users\DDDD CCCC\Downloads\hdtune_255.exe
2015-11-21 07:30 - 2015-11-21 07:30 - 01466656 _____ C:\Users\DDDD CCCC\Downloads\HD Tune - CHIP-Installer.exe
2015-11-20 21:11 - 2015-11-20 21:23 - 00002121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-11-20 21:11 - 2015-11-20 21:23 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-11-20 21:11 - 2015-11-20 21:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-11-20 21:10 - 2015-10-09 00:22 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2015-11-20 21:10 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\SysWOW64\locale.nls
2015-11-20 21:10 - 2015-10-08 19:52 - 00419928 _____ C:\Windows\system32\locale.nls
2015-11-20 16:50 - 2015-11-20 16:50 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5
2015-11-20 16:37 - 2015-11-22 22:50 - 00023302 _____ C:\Users\DDDD CCCC\Desktop\FRST.txt
2015-11-20 16:37 - 2015-11-22 22:48 - 00000000 ____D C:\Users\DDDD CCCC\Desktop\FRST-OlderVersion
2015-11-19 18:48 - 2015-11-19 18:48 - 00000000 ____D C:\Users\DDDD CCCC\AppData\Local\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:55 - 00000000 ____D C:\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:53 - 00000594 _____ C:\Users\DDDD CCCC\Desktop\FreeOCR.lnk
2015-11-19 15:53 - 2015-11-19 15:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeOCR
2015-11-19 15:53 - 2007-03-10 10:11 - 02680320 _____ (HiComponents) C:\Windows\SysWOW64\ImageEnXLibrary.ocx
2015-11-19 15:52 - 2015-11-19 15:52 - 11316239 _____ ( ) C:\Users\DDDD CCCC\Downloads\freeocr5412.exe
2015-11-17 09:07 - 2015-11-17 09:07 - 00141145 _____ C:\Users\DDDD CCCC\Downloads\Online-Entgeltrechner.zip
2015-11-13 11:25 - 2015-11-13 11:25 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919
2015-11-12 13:14 - 2015-11-03 18:55 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 16:31 - 2015-11-11 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-11 16:29 - 2015-11-11 16:29 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-11-11 16:29 - 2015-11-11 16:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-11-11 16:28 - 2015-11-11 16:29 - 00000000 ____D C:\Program Files\iTunes
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files\iPod
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files\Bonjour
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2015-11-11 16:23 - 2015-11-11 16:23 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-11-11 16:23 - 2015-11-11 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-11 16:22 - 2015-11-11 16:23 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2015-11-11 13:32 - 2015-10-20 19:42 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 02608128 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-11-11 13:32 - 2015-10-20 18:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-11-11 13:31 - 2015-11-03 23:10 - 00390344 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 13:31 - 2015-11-03 22:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-11-11 13:31 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 13:31 - 2015-10-31 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 13:31 - 2015-10-31 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 13:31 - 2015-10-31 00:25 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-31 00:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 13:31 - 2015-10-31 00:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 13:31 - 2015-10-31 00:13 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 13:31 - 2015-10-31 00:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 13:31 - 2015-10-31 00:12 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 13:31 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 13:31 - 2015-10-31 00:04 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 13:31 - 2015-10-31 00:01 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-11-11 13:31 - 2015-10-30 23:53 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-11-11 13:31 - 2015-10-30 23:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-11-11 13:31 - 2015-10-30 23:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-11-11 13:31 - 2015-10-30 23:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-11-11 13:31 - 2015-10-30 23:34 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 13:31 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:29 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:29 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-11-11 13:31 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-11-11 13:31 - 2015-10-30 23:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 13:31 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-11-11 13:31 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-11-11 13:31 - 2015-10-20 02:12 - 05570496 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 02:12 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 13:31 - 2015-10-20 02:12 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 13:31 - 2015-10-20 02:09 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 02:04 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 13:31 - 2015-10-20 02:00 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:59 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-11-11 13:31 - 2015-10-20 01:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 01:48 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-11-11 13:31 - 2015-10-20 01:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-11-11 13:31 - 2015-10-20 01:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:41 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 13:31 - 2015-10-20 00:29 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-11-11 13:31 - 2015-10-20 00:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-11-11 13:31 - 2015-10-20 00:27 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-09-23 14:15 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 13:31 - 2015-09-23 14:15 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 13:31 - 2015-09-23 14:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 13:30 - 2015-10-29 18:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-11-11 13:30 - 2015-10-13 17:41 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 13:30 - 2015-10-13 17:40 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 13:30 - 2015-10-13 05:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 13:30 - 2015-10-01 19:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 13:30 - 2015-10-01 19:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-11 13:30 - 2015-10-01 18:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-11-10 11:47 - 2015-11-20 21:48 - 00000000 ____D C:\Users\DDDD CCCC\Downloads\Mietobjekt Friedrichstraße
2015-11-06 12:03 - 2015-11-06 12:03 - 00000264 _____ C:\Users\DDDD CCCC\Desktop\Selbstwirksamkeitserwartung – Wikipedia.URL
2015-10-28 15:08 - 2015-10-28 15:08 - 00008046 _____ C:\Users\DDDD CCCC\AppData\Local\recently-used.xbel
2015-10-27 13:07 - 2015-10-28 14:33 - 00000000 ____D C:\Users\DDDD CCCC\Documents\Bewerbungen 2015
2015-10-26 10:33 - 2015-08-26 06:32 - 00311808 _____ C:\Users\DDDD CCCC\Desktop\Reisekostenabrechnung 2015.xls
2015-10-25 19:33 - 2015-10-25 19:33 - 00000259 _____ C:\Users\DDDD CCCC\Desktop\Haus & Grund Aktuell www.haus-und-grund.com.URL
2015-10-25 19:32 - 2015-10-25 19:32 - 00000249 _____ C:\Users\DDDD CCCC\Desktop\Recht-News**Verträge-vom-Anwalt.de.URL
2015-10-24 19:48 - 2015-10-24 19:48 - 00000291 _____ C:\Users\DDDD CCCC\Desktop\Das 12-Wochen-Selbstcoaching-Programm.URL
2015-10-24 19:47 - 2015-10-24 19:47 - 00000256 _____ C:\Users\DDDD CCCC\Desktop\Coaching Rheinfelden.URL
2015-10-23 12:23 - 2015-10-23 12:49 - 00010719 _____ C:\Users\DDDD CCCC\Desktop\Mappe1.xlsx

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-22 22:50 - 2015-06-08 16:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-22 22:49 - 2014-08-21 20:10 - 00000000 ____D C:\FRST
2015-11-22 22:48 - 2015-02-10 18:48 - 02346496 _____ (Farbar) C:\Users\DDDD CCCC\Desktop\FRST64.exe
2015-11-22 22:48 - 2011-11-13 21:43 - 01770186 _____ C:\Windows\WindowsUpdate.log
2015-11-22 22:39 - 2012-09-20 04:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-22 22:32 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-22 22:32 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-22 22:29 - 2014-08-07 20:56 - 03508736 ___SH C:\Users\DDDD CCCC\Desktop\Thumbs.db
2015-11-22 22:26 - 2012-09-20 04:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-22 22:19 - 2014-06-18 08:20 - 00049297 _____ C:\Windows\setupact.log
2015-11-22 22:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-22 22:18 - 2014-06-20 13:07 - 00452488 _____ C:\Windows\PFRO.log
2015-11-22 22:16 - 2014-08-24 18:36 - 00000000 ____D C:\AdwCleaner
2015-11-22 22:15 - 2015-05-31 13:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-22 22:05 - 2012-08-14 18:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-22 16:49 - 2014-08-05 14:08 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-22 16:47 - 2014-08-24 12:03 - 00000000 ____D C:\Qoobox
2015-11-22 16:42 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2015-11-22 00:33 - 2012-08-07 08:52 - 00000000 ____D C:\Windows\Minidump
2015-11-21 18:05 - 2015-06-08 16:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 18:05 - 2015-05-31 13:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 15:34 - 2012-04-07 11:49 - 00000000 ____D C:\Users\DDDD CCCC\Documents\Finanzen
2015-11-21 15:34 - 2012-03-25 11:40 - 00000000 ____D C:\Users\DDDD CCCC\Documents\Steuerfälle
2015-11-21 01:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-11-21 01:19 - 2009-07-14 05:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-20 21:31 - 2011-11-14 06:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-11-20 21:31 - 2011-11-14 06:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-11-20 21:31 - 2009-07-14 06:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-20 21:23 - 2013-07-21 10:52 - 00001912 _____ C:\Windows\epplauncher.mif
2015-11-20 16:40 - 2015-10-18 13:18 - 00062895 _____ C:\Users\DDDD CCCC\Desktop\Addition.txt
2015-11-20 12:37 - 2013-09-19 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-20 12:37 - 2012-03-11 02:08 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-20 12:36 - 2015-09-25 16:50 - 00000000 ____D C:\Users\DDDD CCCC\.oracle_jre_usage
2015-11-20 12:35 - 2015-09-25 16:50 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-11-17 19:17 - 2012-04-10 14:54 - 00011120 _____ C:\Users\DDDD CCCC\Documents\OuProxy.log
2015-11-16 08:53 - 2014-11-02 21:54 - 00000000 ____D C:\Users\EEEEE\Desktop\div. Briefe
2015-11-13 07:40 - 2012-04-02 19:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-13 07:40 - 2012-04-02 19:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-13 07:40 - 2011-11-15 21:21 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-12 13:24 - 2013-07-13 08:36 - 00000000 ____D C:\Windows\system32\MRT
2015-11-12 13:11 - 2011-11-18 19:58 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-12 13:10 - 2014-03-28 22:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-11-12 13:10 - 2009-11-05 04:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-12 12:37 - 2013-10-05 08:28 - 01604278 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-11-12 12:30 - 2009-07-14 03:34 - 00000648 _____ C:\Windows\win.ini
2015-11-12 12:29 - 2009-11-05 01:26 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 16:31 - 2012-01-29 14:14 - 00000000 ____D C:\Users\DDDD CCCC\AppData\Local\Apple Computer
2015-11-11 16:31 - 2011-11-21 17:05 - 00000000 ____D C:\Users\DDDD CCCC\AppData\Roaming\Apple Computer
2015-11-11 16:28 - 2012-01-29 14:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-11-11 16:21 - 2011-11-20 19:42 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-11-11 12:57 - 2015-08-07 21:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-10 08:27 - 2015-08-28 21:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-30 08:51 - 2015-06-11 20:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-30 08:51 - 2015-05-25 18:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-28 15:13 - 2012-08-29 10:11 - 00000000 ____D C:\Users\DDDD CCCC\.gimp-2.8
2015-10-27 14:27 - 2012-06-10 14:07 - 00000000 ____D C:\Users\DDDD CCCC\Documents\Bewerbungen
2015-10-27 10:38 - 2012-03-11 19:16 - 00000000 ____D C:\Users\DDDD CCCC\Documents\SP
2015-10-26 11:37 - 2015-08-05 19:27 - 00011024 _____ C:\Users\DDDD CCCC\Desktop\Kilometer.xlsx
2015-10-24 23:42 - 2015-09-26 18:47 - 00000000 ____D C:\Users\DDDD CCCC\Documents\Sprüche
2015-10-24 23:38 - 2012-03-11 19:16 - 00000000 ____D C:\Users\DDDD CCCC\Documents\ERGO

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 07:10 - 2014-07-23 21:30 - 14159872 _____ () C:\Users\DDDD CCCC\AppData\Roaming\Sandra.mdb
2015-01-30 20:51 - 2015-02-22 14:54 - 0000600 _____ () C:\Users\DDDD CCCC\AppData\Roaming\winscp.rnd
2012-04-20 18:28 - 2014-07-07 01:20 - 0006656 _____ () C:\Users\DDDD CCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 21:07 - 2014-09-22 21:07 - 0001482 _____ () C:\Users\DDDD CCCC\AppData\Local\RecConfig.xml
2015-10-28 15:08 - 2015-10-28 15:08 - 0008046 _____ () C:\Users\DDDD CCCC\AppData\Local\recently-used.xbel
2013-08-12 21:15 - 2013-08-12 21:15 - 0007603 _____ () C:\Users\DDDD CCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 10:26 - 2012-03-31 10:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 22:53 - 2011-11-13 22:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 19:19 - 2014-10-06 19:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDD CCCC\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-11-20 17:21

==================== Ende von FRST.txt ============================

magigstar 22.11.2015 23:06
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:22-11-2015
durchgeführt von DDDD CCCCC (2015-11-22 22:50:49)
Gestartet von C:\Users\DDDD CCCCC\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-11-13 21:46:57)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDD CCCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDD CCCCC
EEEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Acronis Drive Monitor (HKLM-x32\...\{706AE61D-40A4-4F50-8359-FE8F6F7FA461}) (Version: 1.0.566 - Acronis)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20077 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.9.1 (HKLM-x32\...\{5EA1DED0-5285-11E5-8AA1-0050569584E9}) (Version: 5.9.1.8742 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FreeOCR v5.4 (HKLM-x32\...\freeocr_is1) (Version:  - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GoToMeeting 7.6.0.4007 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.6.0.4007 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 42.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 de)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - Daniel Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.15.11 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

22-11-2015 22:35:00 JRT Pre-Junkware Removal

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2015-11-21 20:23 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDD CCCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDD CCCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {49723E02-558F-4E12-BD48-8ACD6598EC43} - System32\Tasks\HP AR Program Upload - 854d1af6a1324f42910f1f8b74b2b3f41fb51fedf01b43d1a63e88c9a6f21790 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {4D38690B-CEB2-4061-A865-4DF2FBE864A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDD CCCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {6E788608-033F-4B40-8A06-04D8B880BF59} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDD CCCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {786DB5A0-25AD-4CDC-BB7E-97656C616113} - System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {A2488771-C70F-410B-ACC7-0C57087007C2} - System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A8E85CF5-280D-463A-87FA-085DDBCDF6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-13] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DANIEL~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7865 mehr Seiten.

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\google.com -> hxxps://www.google.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\1-2005-search.com -> www.1-2005-search.com

Da befinden sich 12656 mehr Seiten.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDD CCCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: AAV UpdateService => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Apple Mobile Device Service => 2
MSCONFIG\Services: Avira.ServiceHost => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: ePowerSvc => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: Greg_Service => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: IAANTMON => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: RS_Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: TurboBoost => 3
MSCONFIG\Services: UNS => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{585AA0A3-FEAB-49EE-8D2A-6EE98CD9E875}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E14B1E9F-BDF7-48D5-A58D-69D940C69E9C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8667E163-0B78-401F-9C11-97AA00BD7EBB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3F81BC3A-0F0F-43D7-982C-DFA12A366C07}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AC5B506A-A443-46A1-B62C-1EAA0BF2ACBE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9DD0BC8F-FCCD-4949-B7C6-8657BE07FF54}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{532791CB-D66E-4800-8AAD-BA957B3BEA69}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA8B6329-656C-4DE8-B608-C1A7725A364E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B7E6E726-5025-494C-875B-C2B48E3DBB88}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2CBC7107-1D6F-430A-9B34-C20114A63FA4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/20/2015 03:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RescueTime.exe, Version: 2.2.1.722, Zeitstempel: 0x4bbe0958
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000024
ID des fehlerhaften Prozesses: 0x9ac
Startzeit der fehlerhaften Anwendung: 0xRescueTime.exe0
Pfad der fehlerhaften Anwendung: RescueTime.exe1
Pfad des fehlerhaften Moduls: RescueTime.exe2
Berichtskennung: RescueTime.exe3

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4212

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4212

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


Systemfehler:
=============
Error: (11/22/2015 10:17:12 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (11/22/2015 10:17:12 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Indexdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Skype Click to Call PNR Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Skype Click to Call Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/22/2015 10:16:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


CodeIntegrity:
===================================
  Date: 2015-11-21 20:22:53.304
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.163
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.007
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:52.867
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-28 21:30:24.923
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.917
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.912
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.906
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.854
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.849
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Prozentuale Nutzung des RAM: 43%
Installierter physikalischer RAM: 3956.5 MB
Verfügbarer physikalischer RAM: 2252.34 MB
Summe virtueller Speicher: 7911.21 MB
Verfügbarer virtueller Speicher: 6100.06 MB

==================== Laufwerke ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:83.29 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:284.93 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

schrauber 23.11.2015 19:37

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

magigstar 24.11.2015 18:38
Ok, werde ich machen... ich glaube, morgen bin ich damit durch...
Probleme? Nein, momentan scheint alles gut zu laufen... Malwarebytes hat einiges finden können, wie ich glaube... bis jetzt läufts gut.. mal schauen wie lang...

Code:
C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$RLQQ7VU.exe        Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung
C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$RODKFD0.exe        Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Boost\Boost.dll.vir        Variante von Win32/Adware.PricePeep.D Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\102.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\104.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\119.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\123.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\14.js.vir        JS/Toolbar.Crossrider.O evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\178.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\179.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\180.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\184.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\191.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\195.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\200.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\217.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\220.js.vir        JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\221.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\223.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\231.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\232.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\234.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\242.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\252.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\253.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\260.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\262.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\263.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\264.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\273.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\281.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\286.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\288.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\289.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\300.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\301.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\307.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\315.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\335.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\339.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\342.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\344.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\356.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\370.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\47.js.vir        JS/Toolbar.Crossrider.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\64.js.vir        JS/Toolbar.Crossrider.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\93.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\102.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\104.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\123.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\14.js.vir        JS/Toolbar.Crossrider.O evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\180.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\184.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\200.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\211.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\220.js.vir        JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\221.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\223.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\226.js.vir        JS/Toolbar.Crossrider.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\230.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\233.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\242.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\253.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\263.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\281.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\286.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\288.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\301.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\47.js.vir        JS/Toolbar.Crossrider.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\64.js.vir        JS/Toolbar.Crossrider.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\93.js.vir        JS/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Windows\System32\abengine64.dll.vir        Variante von Win64/Packed.Komodia.A verdächtige Datei
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4.xBAD        JS/Kryptik.I Trojaner
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\FMLW.xBAD        JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\MLSC.xBAD        JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\NWAUR.xBAD        JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\UHTQPK.xBAD        JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung
C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip.xBAD        Win32/SmootherWeb.C evtl. unerwünschte Anwendung
C:\Users\DDDDD CCCCC\Desktop\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Ziele\Jahresplanung 2013\alte Dateien\alte Dateien\Tresor alter Computer\Downloads\[www.byte.to].Saw.2.Directors.Cut.German.2005.DVDRiP.XviD-CRiTiCAL\GRATISDownload JETZT 3 GigabyteMusik.Video.Games.url        LNK/Agent.CH Trojaner
C:\Users\DDDDD CCCCC\Desktop\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Ziele\Jahresplanung 2013\alte Dateien\alte Dateien\Tresor alter Computer\Downloads\[www.byte.to].Saw.III.UNRATED.DiRECTORS.CUT.German.Dubbed.2006.DVDRiP.XviD-LizardsGods\GRATISDownload JETZT 3 GigabyteMusik.Video.Games.url        LNK/Agent.CH Trojaner
C:\Users\DDDDD CCCCC\Desktop\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Ziele\Jahresplanung 2013\alte Dateien\alte Dateien\Tresor alter Computer\Downloads\[www.byte.to].Saw.IV.German.DVDRip.XviD-CRUCiAL\GRATISDownload JETZT 3 GigabyteMusik.Video.Games.url        LNK/Agent.CH Trojaner
C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\fp\6699.apk        Variante von Android/Agent.GZ Trojaner
C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\fp\7879.apk        Android/AdDisplay.Dowgin.AT evtl. unerwünschte Anwendung
C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\un\7343.apk        Variante von Android/TrojanDropper.Agent.BP Trojaner
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19554
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-07 11:14:15
# local_time=2014-08-08 01:14:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 14959 151952429 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 42233 159083105 0 0
# scanned=265
# found=1
# cleaned=0
# scan_time=55
sh=C84182A0079B88D923BF936CC788C5B4B46AF482 ft=1 fh=ce39f3e3774c393e vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$R7TUY4P.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=19835
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-26 05:27:21
# local_time=2014-08-26 07:27:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 49001 153530015 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 37433 160660691 0 0
# scanned=265829
# found=11
# cleaned=0
# scan_time=31318
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Downloads\PDFCreator-1_7_3_setup(1).exe"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Downloads\PDFCreator-1_7_3_setup.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=21329
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-30 10:05:21
# local_time=2014-11-30 11:05:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 68538 161841095 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 137883 168971771 0 0
# scanned=201326
# found=11
# cleaned=0
# scan_time=41366
sh=BD2752141740654CD9FA4FC44BC5874D57B3642E ft=1 fh=5cdb06fd3465f210 vn="Variante von Win32/InstallCore.RA evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1242904208-471078349-2963378918-1000\$RIJ9WQK.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=22329
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-02-06 12:14:42
# local_time=2015-02-06 01:14:42 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 20269 167680856 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 20163 174811532 0 0
# scanned=309128
# found=58
# cleaned=0
# scan_time=12586
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Win32/VOPackage.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\UHTQPK.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Common Files\System\SysMenu64.dll"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F90B3223684DEAAE59E0D371CCA318834695FEBE ft=1 fh=e2bb850c8e277c01 vn="Variante von Win32/RemoteAdmin.RemoteExec.AA potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\SIW\siw.exe"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=B896DEDCC410A84E9D794EB28ADB30E4CE0FC1C7 ft=1 fh=0d280081a7b58c5c vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\.frostwire5\updates\frostwire-5.6.2.windows.exe"
sh=705EBCEF56D051A6D6D6356F237201A8448026E0 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\96D59457AFA822A33B5B5ED391A55E16768E6472"
sh=37AEC73BCA6A4AD82D0DA871ECD72CD8B8A73904 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\System32\ColorMedia.dll"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\SysWOW64\ColorMedia.dll"
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-07 09:30:18
# local_time=2015-08-07 11:30:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25178
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-07 09:33:13
# local_time=2015-08-07 11:33:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25178
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-07 11:51:36
# local_time=2015-08-08 01:51:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 9610 190621346 0 0
# scanned=325651
# found=57
# cleaned=57
# scan_time=8302
sh=1B9445EF3BD4D79AF91C32CB60F5BE9161F8B2EB ft=1 fh=2be33240f1c467c0 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_481\mybestofferstoday_widget.exe.vir"
sh=816B192DE1364CFFC89107738057FF671D635B9C ft=1 fh=4adc5297c803b826 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=378B85C2B314BE9C44F853F3F5988F6835984B74 ft=1 fh=ce49ebd9eb2bc48e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=3A409A328F4652D94BEE9D043E81DACF196E7DBD ft=1 fh=237d68fa70f7d8fc vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=DC9B213AE23010EEFE29B3C18C11248334CCDA1F ft=1 fh=bdea575b52a6fe95 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=1153CC7084A7DD1DDC36CAEDB8C586498BA88E4B ft=1 fh=2ead2e1a342ba75e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=CCB85D18513F5ACCFEDA574B270B482829C64F2C ft=1 fh=e2e2ab3683b2c444 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=2B924EF9E9738396D8FEFFD7F393FDC1926ACB8E ft=1 fh=4db8efae5a044c81 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=09C3C95516BF1A320F48BDCBB3579762F997721A ft=1 fh=89cf0c8724a77af8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=4E9900A77AF999BEF32D6B304219ACDB149978F8 ft=1 fh=8fdbb58d928290a9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=1BB5AC385EB6B2BF403790D191E80B35387404DD ft=1 fh=5b1c558bf768d504 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=2C8C3D72943E9F8EBF7FCF0E0D70D66F823B8F49 ft=1 fh=ad3082de8668fb4a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll.vir"
sh=7C58FA8408975F221BF93238F67AD1B96859EE9C ft=1 fh=8ed56cb492085512 vn="Variante von Win64/Adware.MultiPlug.I Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\youtubeadblocker\2vSp3hYxFkuiwN.x64.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\content.js.vir"
sh=ADA9FE6B3255D8E5CC8ABC05094FE8F3C5CEC2E5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\hakphkngdipbpbhaokjpjfdbiipknffb\Z.js.vir"
sh=C28D6F91FD875DD0C2DB97F25BBAF791F5D1F88E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\chrome\content\core\c0cdefe7de1a56a2409f82e5fabc5a1e.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com\extensionData\plugins\91.js.vir"
sh=3D8FEB274B1F910633E0EE3966A82AE9DCBD406A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\21.js.vir"
sh=A61F2AB2BDA3DF4EA26FB96BFA4BAA4BEFA99E6A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\28.js.vir"
sh=DFB26192F2AC7F0D034024989839F63542D4F40A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com\extensionData\plugins\91.js.vir"
sh=728D952AC1492F8331E2ED29921D5DDB8658697A ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\Za7@Ky.edu\content\bg.js.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\omiga-plus\UninstallManager.exe.vir"
sh=05FC70FCA7CCDB54CE3D6778AEADB58A32431BB2 ft=1 fh=704d2e4b074cd8f4 vn="Win32/Adware.ConvertAd.AQ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\VOPackage\Uninstall.exe.vir"
sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\VOPackage\VOPackage.exe.vir"
sh=2B4568A6B72ABCA0C07398E1C34B402D27FD324F ft=1 fh=cdbeb0c3ff7c0f92 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\abengine.dll.vir"
sh=D3D71D4E9157031CF4E36D72F0DFB2170530223A ft=1 fh=3aa89bd270bdbd1e vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu.dll.xBAD"
sh=5A4C8C7391C5F7A7D85C1C86AD9A9DFDC1B5994C ft=1 fh=461d9be2f02a5bb1 vn="Variante von Win32/SBWatchman.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\PROGRAM Files\COMMON files\System\SysMenu64.dll.xBAD"
sh=ECA75C940566A51E196EFE3E5918EC4615385372 ft=1 fh=a9cf670d970984a3 vn="Variante von Win32/Adware.MultiPlug.EP Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\ProgramData\{06467b43-d78a-a739-0646-67b43d78ed0f}\KMS Activator Ultimate 2014 v2.3 is Here ! [LATEST].exe"
sh=3C4DBE5B2797E189DB67FE266CE84BE90B3AEB58 ft=1 fh=c24890e54943dc65 vn="Variante von Win32/SpeedBit.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Installer\Install_24189\DCytdieamo_amodc_setup.exe.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\Neuer Ordner (3)\Neuer Ordner1\alte Dateien\Tresor alter Computer\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=D3950C59BE2BD5572C4BD63ACED4443CC7E41579 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner (Gesäubert - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Desktop\Neuer Ordner (4)\aufräumen, was geht\Ordner\USB Stick\usb\Neuer Ordner\Dance\The Prodigy - One Love.mp3.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_neueDateien\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-203.dll.xBAD"
sh=79DAA2D7105B23CAC0BF465C44407C9FCC122DDF ft=1 fh=ddae22fb65275801 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Documents\Neuer Ordner\Neuer Ordner (3)\Neuer Ordner (2)\Datensicherung_Tower_Sicherung_2\Desktop\Neuer Ordner (5)\backups\backup-20101226-175451-491.dll.xBAD"
sh=EE170263EA037C877EE979B8863D2EBA5D86D318 ft=1 fh=7109b40decc7c204 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe.xBAD"
sh=8A893FE3C1376F3C1B0F67A9514CBE621B717D98 ft=1 fh=667b25980f774106 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\EEEEE\Downloads\cbsidlm-tr1_13-Free_Audio_Cutter-ORG-75444480.exe.xBAD"
sh=A8BF6CBF1947DF4A1E73B0A6670CBBCB4BD87E21 ft=1 fh=215be700359ffcb7 vn="Variante von Win32/Packed.Komodia.A verdächtige Datei (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Windows\SysWOW64\ColorMedia.dll.xBAD"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\38307773-d954-48f2-8127-93df0ea63e4a\3e7d90a7-d362-46a9-a145-3ee08200dffd.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\74ac0708-eebd-4d53-83f6-7f4779f2f294.dll.vir"
sh=4E043603B90EE544A5B36BE8E8B04CB84313F624 ft=1 fh=de082fb1cb22794f vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\878e2246-8f7a-48fe-89f9-845dc6abbab7\878e2246-8f7a-48fe-89f9-845dc6abbab7.dll.vir"
sh=A8B41A00A882E5DF634641E3513CF5B7456918B8 ft=1 fh=3b340c1a45bfd8b7 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\38307773-d954-48f2-8127-93df0ea63e4a.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Acer\ed55547d-8d98-4039-96d9-00407eb30671.dll.vir"
sh=126D4F1D231AB4D5906103610A520ADD20CCAB75 ft=1 fh=2c9d015a54b3c263 vn="Variante von Win64/Toolbar.Crossrider.P evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Program Files (x86)\ed55547d-8d98-4039-96d9-00407eb30671\ca846dc2-84dd-4e20-94fa-902a5cafe3c0.dll.vir"
sh=45007D7AB67E22EE003593B44A645083DC6E2EC6 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\content.js.vir"
sh=2BD44CFD0C6A2225FCF4370A79C3DA169BAAC900 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\extensions\obdejhodejngcbmkiddfjkieejekbfil\242\GuJbTt1.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\EEEEE\AppData\Roaming\Mozilla\Firefox\Profiles\ilhln8u2.default\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=C76B47C2CB45A525A1E2719CDDB762A3E7BCF4A5 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\wq@P.net\content\bg.js.vir"
sh=95EA88F56230BC4ABC15D3710649133932317B34 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Versuch\AppData\Roaming\Mozilla\Firefox\Profiles\r7teyr0l.default-1417873282698\extensions\staged\Za7@Ky.edu\content\bg.js.vir"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe"
sh=8893580829AE06F0CAC42303D43E1B73841EE19B ft=1 fh=2031adc57d10f162 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\updates\7.9.2_31638.exe"
sh=99A82A44935AA55E948FBACA5443C0D588ECEB1C ft=1 fh=c1378d07850f9ccb vn="Variante von Win64/Agent.BR Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\dot3ui64.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 06:30:34
# local_time=2015-08-08 08:30:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 01:11:56
# local_time=2015-08-08 03:11:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25187
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-08 01:13:18
# local_time=2015-08-08 03:13:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25187
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-08 01:17:53
# local_time=2015-08-08 03:17:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 56102 190669723 0 0
# scanned=18061
# found=6
# cleaned=0
# scan_time=274
sh=1BD5660EBB60AF8FC5CE6CE41E6E55D69EF48633 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\UHTQPK.xBAD"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip.xBAD"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-08-08 01:18:46
# local_time=2015-08-08 03:18:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 25187
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=updated
# utc_time=2015-08-08 01:19:03
# local_time=2015-08-08 03:19:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# engine=25187
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-08 04:44:30
# local_time=2015-08-08 06:44:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 68499 190682120 0 0
# scanned=335351
# found=10
# cleaned=0
# scan_time=12326
sh=1BD5660EBB60AF8FC5CE6CE41E6E55D69EF48633 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Local\Mozilla\Firefox\Profiles\ax92hz4x.default-1417957171376\cache2\entries\BB425C587980B0FCFA063FF796BB36E3D76613A4.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\FMLW.xBAD"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\MLSC.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\NWAUR.xBAD"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\UHTQPK.xBAD"
sh=D6092490B8B905B9058227DF77C38386F2E22BAA ft=0 fh=0000000000000000 vn="Win32/SmootherWeb.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\DDDDD CCCCC\AppData\Roaming\Booster-Web\jid1-U7omKQ6kQfxMaQ@jetpack.zip.xBAD"
sh=76595B98CEA0CD39E47CEBA9F12AE154DFCBF36A ft=0 fh=0000000000000000 vn="Variante von Android/Agent.KW Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\fp\6699.apk"
sh=6F07761C3535E234CB4CE675545DA2B86F932E6D ft=0 fh=0000000000000000 vn="Android/AdDisplay.Dowgin.AT evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\fp\7879.apk"
sh=5EBE903452CB921A8FCCC07ADEC8B5797AE7903A ft=0 fh=0000000000000000 vn="Variante von Android/Agent.KW Trojaner" ac=I fn="C:\Users\DDDDD CCCCC\Desktop\Desktop\Tablett\Android\data\un\7343.apk"
sh=A3237ED7B0323377ACDCE02E94D12CB17F793ED0 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Windows\Installer\73825f.msi"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=58449cc18ee8504882955fd4081431d5
# end=init
# utc_time=2015-10-19 12:54:45
# local_time=2015-10-19 02:54:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 26857
Update Init
Update Download
Update Finalize
Updated modules version: 26869
Code:
Results of screen317's Security Check version 1.009 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
  (On Access scanning disabled!)
 Error obtaining update status for antivirus! 
`````````Anti-malware/Other Utilities Check:`````````
 SpywareBlaster 5.0   
 Java 8 Update 66 
 Java version 32-bit out of Date!
 Adobe Flash Player 19.0.0.245 
 Mozilla Firefox (42.0)
 Google Chrome (46.0.2490.80)
 Google Chrome (46.0.2490.86)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 WinPatrol winpatrol.exe
 BillP Studios WinPatrol WinPatrol.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

magigstar 24.11.2015 18:48
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015
durchgeführt von DDDDD CCCCC (Administrator) auf ARBEITSCOMPUTER (24-11-2015 18:40:28)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Geladene Profile: DDDDD CCCCC (Verfügbare Profile: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
() C:\Windows\snuvcdsm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(RescueTime, Inc.) C:\Program Files (x86)\RescueTime\RescueTime.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
(Mirko Böer) C:\Program Files\AmP\AmP.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [462400 2011-02-12] (Acronis)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SimpleScreenshot] => C:\PROGRA~2\SSS\SIMPLESCREENSHOT.EXE
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [adm_tray.exe] => C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe [470120 2011-02-24] ()
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-09-23]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll => Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: hxxp://www.zeitzuleben.de/2164-ziele-finden/
hxxp://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html
hxxp://forum.computerbild.de/pc-hardware/festplatte-defekt_157241.html
about:preferences
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-14] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-11] (Apple Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\extensions\adblockpopups@jessehakanen.net.xpi [2015-11-22]
FF Extension: ADB Helper - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\adbhelper@mozilla.org [2015-11-13]
FF Extension: Valence - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\fxdevtools-adapters@mozilla.org [2015-10-29]
FF Extension: Mailvelope - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\jid1-AQqSMBYb0a8ADg@jetpack.xpi [2015-11-13]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Präsentationen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-17]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-21]
CHR Extension: (Google-Suche) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]
CHR Extension: (Google Tabellen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (Google Mail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
S4 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC)
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-24 18:28 - 2015-11-24 18:28 - 00852720 _____ C:\Users\DDDDD CCCCC\Desktop\SecurityCheck.exe
2015-11-24 18:26 - 2015-11-24 18:26 - 00043162 _____ C:\Users\DDDDD CCCCC\Desktop\ESET.txt
2015-11-24 01:00 - 2015-11-24 01:00 - 00814790 _____ C:\Users\DDDDD CCCCC\Downloads\muv_immobilien_im_privatvermoegen.zip
2015-11-23 15:22 - 2015-11-23 15:22 - 00438784 _____ C:\Users\DDDDD CCCCC\Downloads\2014-09-23-Berechnung-Aufteilung-Grundstueckskaufpreis-Arbeitshilfe.xls
2015-11-23 15:17 - 2015-11-23 15:17 - 00227840 _____ C:\Users\DDDDD CCCCC\Downloads\4918151_Immorendite_09_15.xls
2015-11-23 10:30 - 2015-11-23 10:30 - 00001365 _____ C:\Users\Public\Desktop\SeaTools for Windows.lnk
2015-11-23 10:30 - 2015-11-23 10:30 - 00000000 ____D C:\ProgramData\Package Cache
2015-11-23 10:29 - 2015-11-23 10:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-11-23 10:29 - 2015-11-23 10:29 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-11-22 22:38 - 2015-11-22 22:45 - 00000690 _____ C:\Users\DDDDD CCCCC\Desktop\JRT.txt
2015-11-22 21:58 - 2015-11-22 22:00 - 00071434 _____ C:\Users\DDDDD CCCCC\Desktop\Malwarebytes Anti-Malware.txt
2015-11-22 16:48 - 2015-11-22 16:48 - 00037873 _____ C:\Users\DDDDD CCCCC\Desktop\ComboFix.txt
2015-11-22 16:47 - 2015-11-22 16:47 - 00037873 _____ C:\ComboFix.txt
2015-11-22 00:33 - 2015-11-22 00:33 - 00275544 _____ C:\Windows\Minidump\112215-33805-01.dmp
2015-11-22 00:21 - 2015-11-22 00:32 - 626154878 _____ C:\Windows\MEMORY.DMP
2015-11-22 00:21 - 2015-11-22 00:21 - 00275544 _____ C:\Windows\Minidump\112215-37845-01.dmp
2015-11-22 00:15 - 2015-11-22 00:14 - 00000918 _____ C:\Users\DDDDD CCCCC\Desktop\Sandboxed Web Browser.lnk
2015-11-22 00:14 - 2015-11-23 10:17 - 00001768 _____ C:\Windows\Sandboxie.ini
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ___RD C:\Sandbox
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\Program Files\Sandboxie
2015-11-21 20:35 - 2015-11-21 20:35 - 25527544 _____ C:\Users\DDDDD CCCCC\Downloads\SeaToolsforWindowsSetup.exe
2015-11-21 20:07 - 2015-11-21 20:08 - 05639131 ____R (Swearware) C:\Users\DDDDD CCCCC\Desktop\ComboFix.exe
2015-11-21 09:34 - 2015-11-21 09:34 - 00000309 _____ C:\Users\DDDDD CCCCC\Desktop\Vermögensverwaltende GmbH Auswegstrategie vor der Abgeltungsteuer.URL
2015-11-21 07:36 - 2015-11-21 07:36 - 00001110 _____ C:\Users\Public\Desktop\Acronis Drive Monitor.lnk
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\Program Files (x86)\HD Tune
2015-11-20 21:11 - 2015-11-20 21:23 - 00002121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-11-20 21:11 - 2015-11-20 21:23 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-11-20 21:11 - 2015-11-20 21:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-11-20 21:10 - 2015-10-09 00:22 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2015-11-20 21:10 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\SysWOW64\locale.nls
2015-11-20 21:10 - 2015-10-08 19:52 - 00419928 _____ C:\Windows\system32\locale.nls
2015-11-20 16:50 - 2015-11-20 16:50 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5
2015-11-20 16:37 - 2015-11-24 18:40 - 00025106 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-11-20 16:37 - 2015-11-24 18:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-11-19 18:48 - 2015-11-19 18:48 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:55 - 00000000 ____D C:\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:53 - 00000594 _____ C:\Users\DDDDD CCCCC\Desktop\FreeOCR.lnk
2015-11-19 15:53 - 2015-11-19 15:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeOCR
2015-11-19 15:53 - 2007-03-10 10:11 - 02680320 _____ (HiComponents) C:\Windows\SysWOW64\ImageEnXLibrary.ocx
2015-11-17 09:07 - 2015-11-17 09:07 - 00141145 _____ C:\Users\DDDDD CCCCC\Downloads\Online-Entgeltrechner.zip
2015-11-13 11:25 - 2015-11-13 11:25 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919
2015-11-12 13:14 - 2015-11-03 18:55 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 16:31 - 2015-11-11 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-11 16:29 - 2015-11-11 16:29 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-11-11 16:29 - 2015-11-11 16:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-11-11 16:28 - 2015-11-11 16:29 - 00000000 ____D C:\Program Files\iTunes
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files\iPod
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files\Bonjour
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2015-11-11 16:23 - 2015-11-11 16:23 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-11-11 16:23 - 2015-11-11 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-11 16:22 - 2015-11-11 16:23 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2015-11-11 13:32 - 2015-10-20 19:42 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 02608128 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-11-11 13:32 - 2015-10-20 18:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-11-11 13:31 - 2015-11-03 23:10 - 00390344 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 13:31 - 2015-11-03 22:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-11-11 13:31 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 13:31 - 2015-10-31 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 13:31 - 2015-10-31 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 13:31 - 2015-10-31 00:25 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-31 00:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 13:31 - 2015-10-31 00:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 13:31 - 2015-10-31 00:13 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 13:31 - 2015-10-31 00:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 13:31 - 2015-10-31 00:12 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 13:31 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 13:31 - 2015-10-31 00:04 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 13:31 - 2015-10-31 00:01 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-11-11 13:31 - 2015-10-30 23:53 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-11-11 13:31 - 2015-10-30 23:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-11-11 13:31 - 2015-10-30 23:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-11-11 13:31 - 2015-10-30 23:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-11-11 13:31 - 2015-10-30 23:34 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 13:31 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:29 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:29 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-11-11 13:31 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-11-11 13:31 - 2015-10-30 23:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 13:31 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-11-11 13:31 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-11-11 13:31 - 2015-10-20 02:12 - 05570496 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 02:12 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 13:31 - 2015-10-20 02:12 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 13:31 - 2015-10-20 02:09 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 02:04 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 13:31 - 2015-10-20 02:00 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:59 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-11-11 13:31 - 2015-10-20 01:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 01:48 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-11-11 13:31 - 2015-10-20 01:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-11-11 13:31 - 2015-10-20 01:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:41 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 13:31 - 2015-10-20 00:29 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-11-11 13:31 - 2015-10-20 00:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-11-11 13:31 - 2015-10-20 00:27 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-09-23 14:15 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 13:31 - 2015-09-23 14:15 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 13:31 - 2015-09-23 14:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 13:30 - 2015-10-29 18:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-11-11 13:30 - 2015-10-13 17:41 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 13:30 - 2015-10-13 17:40 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 13:30 - 2015-10-13 05:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 13:30 - 2015-10-01 19:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 13:30 - 2015-10-01 19:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-11 13:30 - 2015-10-01 18:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-11-10 11:47 - 2015-11-23 20:48 - 00000000 ____D C:\Users\DDDDD CCCCC\Downloads\Mietobjekt Friedrichstraße
2015-11-06 12:03 - 2015-11-06 12:03 - 00000264 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstwirksamkeitserwartung – Wikipedia.URL
2015-10-28 15:08 - 2015-10-28 15:08 - 00008046 _____ C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2015-10-27 13:07 - 2015-10-28 14:33 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbungen 2015
2015-10-26 10:33 - 2015-08-26 06:32 - 00311808 _____ C:\Users\DDDDD CCCCC\Desktop\Reisekostenabrechnung 2015.xls
2015-10-25 19:33 - 2015-10-25 19:33 - 00000259 _____ C:\Users\DDDDD CCCCC\Desktop\Haus & Grund Aktuell www.haus-und-grund.com.URL
2015-10-25 19:32 - 2015-10-25 19:32 - 00000249 _____ C:\Users\DDDDD CCCCC\Desktop\Recht-News**Verträge-vom-Anwalt.de.URL

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-24 18:40 - 2015-02-10 18:48 - 02348544 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-11-24 18:40 - 2014-08-21 20:10 - 00000000 ____D C:\FRST
2015-11-24 18:39 - 2012-09-20 04:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-24 18:15 - 2015-05-31 13:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-24 18:05 - 2012-08-14 18:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-24 16:50 - 2015-06-08 16:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-24 15:39 - 2012-09-20 04:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-24 14:58 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-24 14:58 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-24 14:48 - 2011-11-13 21:43 - 01880785 _____ C:\Windows\WindowsUpdate.log
2015-11-24 11:06 - 2014-08-05 14:08 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-24 09:31 - 2014-06-18 08:20 - 00049409 _____ C:\Windows\setupact.log
2015-11-24 09:31 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-23 22:30 - 2012-03-25 11:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-11-22 23:06 - 2015-10-18 13:18 - 00061635 _____ C:\Users\DDDDD CCCCC\Desktop\Addition.txt
2015-11-22 22:29 - 2014-08-07 20:56 - 03508736 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-11-22 22:18 - 2014-06-20 13:07 - 00452488 _____ C:\Windows\PFRO.log
2015-11-22 22:16 - 2014-08-24 18:36 - 00000000 ____D C:\AdwCleaner
2015-11-22 16:47 - 2014-08-24 12:03 - 00000000 ____D C:\Qoobox
2015-11-22 16:42 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2015-11-22 00:33 - 2012-08-07 08:52 - 00000000 ____D C:\Windows\Minidump
2015-11-21 18:05 - 2015-06-08 16:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 18:05 - 2015-05-31 13:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 15:34 - 2012-04-07 11:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-11-21 01:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-11-21 01:19 - 2009-07-14 05:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-20 21:31 - 2011-11-14 06:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-11-20 21:31 - 2011-11-14 06:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-11-20 21:31 - 2009-07-14 06:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-20 21:23 - 2013-07-21 10:52 - 00001912 _____ C:\Windows\epplauncher.mif
2015-11-20 12:37 - 2013-09-19 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-20 12:37 - 2012-03-11 02:08 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-20 12:36 - 2015-09-25 16:50 - 00000000 ____D C:\Users\DDDDD CCCCC\.oracle_jre_usage
2015-11-20 12:35 - 2015-09-25 16:50 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-11-17 19:17 - 2012-04-10 14:54 - 00011120 _____ C:\Users\DDDDD CCCCC\Documents\OuProxy.log
2015-11-16 08:53 - 2014-11-02 21:54 - 00000000 ____D C:\Users\EEEEE\Desktop\div. Briefe
2015-11-13 07:40 - 2012-04-02 19:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-13 07:40 - 2012-04-02 19:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-13 07:40 - 2011-11-15 21:21 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-12 13:24 - 2013-07-13 08:36 - 00000000 ____D C:\Windows\system32\MRT
2015-11-12 13:11 - 2011-11-18 19:58 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-12 13:10 - 2014-03-28 22:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-11-12 13:10 - 2009-11-05 04:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-12 12:37 - 2013-10-05 08:28 - 01604278 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-11-12 12:30 - 2009-07-14 03:34 - 00000648 _____ C:\Windows\win.ini
2015-11-12 12:29 - 2009-11-05 01:26 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 16:31 - 2012-01-29 14:14 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Apple Computer
2015-11-11 16:31 - 2011-11-21 17:05 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Apple Computer
2015-11-11 16:28 - 2012-01-29 14:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-11-11 16:21 - 2011-11-20 19:42 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-11-11 12:57 - 2015-08-07 21:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-10 08:27 - 2015-08-28 21:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-30 08:51 - 2015-06-11 20:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-30 08:51 - 2015-05-25 18:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-28 15:13 - 2012-08-29 10:11 - 00000000 ____D C:\Users\DDDDD CCCCC\.gimp-2.8
2015-10-27 14:27 - 2012-06-10 14:07 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Bewerbungen
2015-10-27 10:38 - 2012-03-11 19:16 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\SP
2015-10-26 11:37 - 2015-08-05 19:27 - 00011024 _____ C:\Users\DDDDD CCCCC\Desktop\Kilometer.xlsx

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 07:10 - 2014-07-23 21:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 20:51 - 2015-02-22 14:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 18:28 - 2014-07-07 01:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 21:07 - 2014-09-22 21:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-10-28 15:08 - 2015-10-28 15:08 - 0008046 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 21:15 - 2013-08-12 21:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 10:26 - 2012-03-31 10:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 22:53 - 2011-11-13 22:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 19:19 - 2014-10-06 19:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-11-20 17:21

==================== Ende von FRST.txt ============================

magigstar 24.11.2015 18:51
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-11-2015
durchgeführt von DDDDD CCCCC (2015-11-24 18:41:27)
Gestartet von C:\Users\DDDDD CCCCC\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-11-13 21:46:57)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDDD CCCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDDD CCCCC
EEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Acronis Drive Monitor (HKLM-x32\...\{706AE61D-40A4-4F50-8359-FE8F6F7FA461}) (Version: 1.0.566 - Acronis)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20077 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.9.1 (HKLM-x32\...\{5EA1DED0-5285-11E5-8AA1-0050569584E9}) (Version: 5.9.1.8742 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FreeOCR v5.4 (HKLM-x32\...\freeocr_is1) (Version:  - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GoToMeeting 7.6.0.4007 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.6.0.4007 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 42.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 de)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - Daniel Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.15.11 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

22-11-2015 22:35:00 JRT Pre-Junkware Removal
22-11-2015 23:15:27 Windows Update
23-11-2015 10:30:13 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2015-11-21 20:23 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDDD CCCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {49723E02-558F-4E12-BD48-8ACD6598EC43} - System32\Tasks\HP AR Program Upload - 854d1af6a1324f42910f1f8b74b2b3f41fb51fedf01b43d1a63e88c9a6f21790 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {4D38690B-CEB2-4061-A865-4DF2FBE864A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDDD CCCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {6E788608-033F-4B40-8A06-04D8B880BF59} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDDD CCCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {786DB5A0-25AD-4CDC-BB7E-97656C616113} - System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {A2488771-C70F-410B-ACC7-0C57087007C2} - System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A8E85CF5-280D-463A-87FA-085DDBCDF6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-13] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DANIEL~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-01-13 09:04 - 2011-01-13 09:04 - 00030080 _____ () C:\Windows\snuvcdsm.exe
2011-11-13 22:52 - 2011-11-13 22:51 - 00200704 _____ () C:\Windows\PLFSetI.exe
2011-02-24 19:07 - 2011-02-24 19:07 - 00470120 _____ () C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe
2009-07-29 13:10 - 2009-07-29 13:10 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-13 21:44 - 2011-11-13 21:44 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-12-28 14:38 - 2014-04-22 19:39 - 00645592 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2015-09-03 14:45 - 2015-09-03 14:45 - 00439304 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2015-09-03 14:45 - 2015-09-03 14:45 - 00321032 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2011-02-24 18:39 - 2011-02-24 18:39 - 00012128 _____ () C:\Program Files (x86)\Common Files\Acronis\DriveMonitor\Common\icudt38.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7865 mehr Seiten.

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\google.com -> hxxps://www.google.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\1-2005-search.com -> www.1-2005-search.com

Da befinden sich 12656 mehr Seiten.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: AAV UpdateService => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Apple Mobile Device Service => 2
MSCONFIG\Services: Avira.ServiceHost => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: ePowerSvc => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: Greg_Service => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: IAANTMON => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: RS_Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: TurboBoost => 3
MSCONFIG\Services: UNS => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDDD CCCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDDD CCCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{585AA0A3-FEAB-49EE-8D2A-6EE98CD9E875}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E14B1E9F-BDF7-48D5-A58D-69D940C69E9C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8667E163-0B78-401F-9C11-97AA00BD7EBB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3F81BC3A-0F0F-43D7-982C-DFA12A366C07}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AC5B506A-A443-46A1-B62C-1EAA0BF2ACBE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9DD0BC8F-FCCD-4949-B7C6-8657BE07FF54}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{532791CB-D66E-4800-8AAD-BA957B3BEA69}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA8B6329-656C-4DE8-B608-C1A7725A364E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B7E6E726-5025-494C-875B-C2B48E3DBB88}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2CBC7107-1D6F-430A-9B34-C20114A63FA4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/23/2015 07:43:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (11/20/2015 03:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RescueTime.exe, Version: 2.2.1.722, Zeitstempel: 0x4bbe0958
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000024
ID des fehlerhaften Prozesses: 0x9ac
Startzeit der fehlerhaften Anwendung: 0xRescueTime.exe0
Pfad der fehlerhaften Anwendung: RescueTime.exe1
Pfad des fehlerhaften Moduls: RescueTime.exe2
Berichtskennung: RescueTime.exe3

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4212

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4212


Systemfehler:
=============
Error: (11/24/2015 02:32:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275

Error: (11/24/2015 02:32:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\DANIEL~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/24/2015 02:32:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275

Error: (11/24/2015 02:32:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\DANIEL~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/24/2015 02:32:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275

Error: (11/24/2015 02:32:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\DANIEL~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/24/2015 02:32:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275

Error: (11/24/2015 02:32:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\DANIEL~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/24/2015 02:32:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275

Error: (11/24/2015 02:32:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\DANIEL~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.


CodeIntegrity:
===================================
  Date: 2015-11-21 20:22:53.304
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.163
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.007
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:52.867
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-28 21:30:24.923
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.917
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.912
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.906
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.854
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.849
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Prozentuale Nutzung des RAM: 47%
Installierter physikalischer RAM: 3956.5 MB
Verfügbarer physikalischer RAM: 2057.68 MB
Summe virtueller Speicher: 7911.21 MB
Verfügbarer virtueller Speicher: 5962.04 MB

==================== Laufwerke ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:81.51 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:284.91 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================


Probleme habe ich momentan nicht, aber es ist fraglich, wie lang das gut geht.
Ich hab daher Sandboxie heruntergeladen um was zu testen.
Aber da stürzt der Computer immer nur ab...
Ich hab nämlich wirklich keine Lust jede Woche die Programme, die Du mir jetzt gegeben hast, auszuführen. Vor allem bei ComboFix habe ich so meine Bedenken.

schrauber 24.11.2015 22:32
Bei Sandboxie stürzt er ab, sonst nicht?

magigstar 24.11.2015 23:34
Ja, ich wollte Sandboxie einfach testen und gucken.
Es kommen seltsame Meldungen und kurze Zeit später Neustart des gesamten Notebooks, also nicht das nur Sandboxie abstürzt.

schrauber 26.11.2015 12:23
Merkwürdig, liegt dann aber wohl an Sandboxie selbst.

magigstar 28.11.2015 15:50
Was ist mit den restlichen Ergebnissen?
Also ESET ist ja immer eindeutig.
Aber auch SecurityCheck hat seltsame Ergebnisse.

Code:
c:\windows\SysWow64\Drivers\atapi.sys . . . ist infiziert!!

schrauber 29.11.2015 07:12
siehst Du ein anderes Log wie ich? o.O

magigstar 29.11.2015 15:14
Code:
ComboFix 15-11-27.01 - DDDDD CCCCC 28.11.2015  15:25:20.6.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3956.2193 [GMT 1:00]
ausgeführt von:: c:\users\DDDDD CCCCC\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\sss
c:\program files (x86)\sss\licence.txt
c:\program files (x86)\sss\ReadMe.txt
c:\program files (x86)\sss\SimpleScreenshot.exe
c:\program files (x86)\sss\upload.php
.
c:\windows\SysWow64\Drivers\atapi.sys . . . ist infiziert!!
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-10-28 bis 2015-11-28  ))))))))))))))))))))))))))))))
.
.
2015-11-28 14:42 . 2015-11-28 14:42        --------        d-----w-        c:\users\Versuch\AppData\Local\temp
2015-11-28 14:42 . 2015-11-28 14:42        --------        d-----w-        c:\users\Public\AppData\Local\temp
2015-11-28 14:42 . 2015-11-28 14:42        --------        d-----w-        c:\users\EEEEE\AppData\Local\temp
2015-11-28 14:42 . 2015-11-28 14:42        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-11-28 08:11 . 2008-01-28 13:51        330336        ----a-w-        c:\windows\SSSUn10.exe
2015-11-27 22:13 . 2015-06-24 14:00        1190000        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-11-27 22:13 . 2015-06-24 14:00        1190000        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C0BFD931-C29A-44AA-B7DD-2B8823116E3B}\gapaengine.dll
2015-11-27 22:12 . 2015-11-17 06:43        11138400        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A2E23AFE-DF85-4FF1-AF48-410DE69DED16}\mpengine.dll
2015-11-27 22:03 . 2015-11-17 06:43        11138400        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-11-23 09:30 . 2015-11-23 09:30        --------        d-----w-        c:\programdata\Package Cache
2015-11-23 09:29 . 2015-11-23 09:29        --------        d-----w-        c:\program files (x86)\Seagate
2015-11-21 23:14 . 2015-11-21 23:14        --------        d-----r-        C:\Sandbox
2015-11-21 23:14 . 2015-11-21 23:14        --------        d-----w-        c:\program files\Sandboxie
2015-11-21 06:36 . 2015-11-21 06:36        --------        d-----w-        c:\program files (x86)\Common Files\Acronis
2015-11-21 06:36 . 2015-11-21 06:36        --------        d-----w-        c:\program files (x86)\Acronis
2015-11-21 06:32 . 2015-11-21 06:32        --------        d-----w-        c:\program files (x86)\HD Tune
2015-11-20 20:11 . 2015-11-20 20:22        --------        d-----w-        c:\program files (x86)\Microsoft Security Client
2015-11-20 20:11 . 2015-11-20 20:23        --------        d-----w-        c:\program files\Microsoft Security Client
2015-11-20 20:10 . 2015-10-08 23:22        69120        ----a-w-        c:\windows\system32\nlsbres.dll
2015-11-20 20:10 . 2015-10-08 23:18        6656        ----a-w-        c:\windows\SysWow64\kbdgeoqw.dll
2015-11-20 20:10 . 2015-10-08 23:18        6656        ----a-w-        c:\windows\SysWow64\KBDAZEL.DLL
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\kbdgeoqw.dll
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\KBDAZEL.DLL
2015-11-20 20:10 . 2015-10-08 23:18        7168        ----a-w-        c:\windows\system32\KBDAZE.DLL
2015-11-20 20:10 . 2015-10-08 23:17        69120        ----a-w-        c:\windows\SysWow64\nlsbres.dll
2015-11-20 18:23 . 2015-10-29 09:28        11138400        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{1B45D3F0-22AB-49AC-963E-0A7E565C4CDF}\mpengine.dll
2015-11-20 11:37 . 2015-11-20 11:37        --------        d-----w-        c:\program files (x86)\Common Files\Java
2015-11-19 17:48 . 2015-11-19 17:48        --------        d-----w-        c:\users\DDDDD CCCCC\AppData\Local\FreeOCR
2015-11-19 14:53 . 2007-03-10 09:11        2680320        ----a-w-        c:\windows\SysWow64\ImageEnXLibrary.ocx
2015-11-19 14:53 . 2015-11-19 14:55        --------        d-----w-        C:\FreeOCR
2015-11-12 12:14 . 2015-11-03 17:55        3211264        ----a-w-        c:\windows\system32\win32k.sys
2015-11-11 15:28 . 2015-11-11 15:28        --------        d-----w-        c:\program files\iPod
2015-11-11 15:28 . 2015-11-11 15:28        --------        d-----w-        c:\program files (x86)\iTunes
2015-11-11 15:28 . 2015-11-11 15:29        --------        d-----w-        c:\program files\iTunes
2015-11-11 15:25 . 2015-11-11 15:25        --------        d-----w-        c:\program files\Bonjour
2015-11-11 15:25 . 2015-11-11 15:25        --------        d-----w-        c:\program files (x86)\Bonjour
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2015-11-11 15:23 . 2015-11-11 15:23        159744        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2015-11-11 15:22 . 2015-11-11 15:23        --------        d-----w-        c:\program files (x86)\QuickTime
2015-11-11 15:21 . 2015-11-11 15:21        --------        d-----w-        c:\program files (x86)\Apple Software Update
2015-11-11 12:31 . 2015-10-30 23:40        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2015-11-11 12:30 . 2015-10-13 16:41        497664        ----a-w-        c:\windows\system32\drivers\afd.sys
2015-11-10 07:27 . 2015-11-10 07:27        10592424        ----a-w-        c:\program files (x86)\Mozilla Firefox\icudt55.dll
2015-11-10 07:27 . 2015-11-10 07:27        901288        ----a-w-        c:\program files (x86)\Mozilla Firefox\icuuc55.dll
2015-11-10 07:27 . 2015-11-10 07:27        59560        ----a-w-        c:\program files (x86)\Mozilla Firefox\lgpllibs.dll
2015-11-10 07:27 . 2015-11-10 07:27        1287848        ----a-w-        c:\program files (x86)\Mozilla Firefox\icuin55.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-24 23:41 . 2014-08-05 13:08        192216        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-11-20 11:35 . 2015-09-25 15:50        97888        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-11-13 06:40 . 2012-04-02 18:28        780488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-13 06:40 . 2011-11-15 20:21        142536        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-12 12:11 . 2011-11-18 18:58        145617392        ----a-w-        c:\windows\system32\MRT.exe
2015-10-29 17:50 . 2015-11-11 12:30        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-11 12:30        309248        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-11 12:30        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-11 12:30        103424        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:49 . 2015-11-11 12:30        562176        ----a-w-        c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-11 12:30        2178560        ----a-w-        c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-11 12:30        470528        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-11 12:30        211968        ----a-w-        c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:39 . 2015-11-11 12:30        2560        ----a-w-        c:\windows\apppatch\AcRes.dll
2015-10-20 00:45 . 2015-11-11 12:31        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2015-10-13 00:29 . 2015-10-13 00:29        875720        ----a-w-        c:\windows\SysWow64\msvcr120_clr0400.dll
2015-10-13 00:22 . 2015-10-13 00:22        869568        ----a-w-        c:\windows\system32\msvcr120_clr0400.dll
2015-10-05 07:50 . 2014-08-05 13:08        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys
2015-10-05 07:50 . 2014-08-05 13:08        109272        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2015-10-05 07:50 . 2014-08-05 13:08        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
2015-10-01 18:06 . 2015-10-13 19:39        692672        ----a-w-        c:\windows\system32\winload.efi
2015-10-01 18:04 . 2015-10-13 19:39        616360        ----a-w-        c:\windows\system32\winresume.efi
2015-10-01 18:00 . 2015-10-13 19:39        63488        ----a-w-        c:\windows\system32\setbcdlocale.dll
2015-10-01 18:00 . 2015-10-13 19:39        59392        ----a-w-        c:\windows\system32\appidapi.dll
2015-10-01 18:00 . 2015-10-13 19:39        32768        ----a-w-        c:\windows\system32\appidsvc.dll
2015-10-01 18:00 . 2015-10-13 19:39        17920        ----a-w-        c:\windows\system32\appidcertstorecheck.exe
2015-10-01 18:00 . 2015-10-13 19:39        147456        ----a-w-        c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-13 19:39        50688        ----a-w-        c:\windows\SysWow64\appidapi.dll
2015-10-01 17:00 . 2015-10-13 19:39        61440        ----a-w-        c:\windows\system32\drivers\appid.sys
2015-09-18 19:22 . 2015-10-15 09:33        25432        ----a-w-        c:\windows\system32\CompatTelRunner.exe
2015-09-18 19:19 . 2015-10-15 09:33        700416        ----a-w-        c:\windows\system32\invagent.dll
2015-09-18 19:19 . 2015-10-15 09:33        766464        ----a-w-        c:\windows\system32\generaltel.dll
2015-09-18 19:19 . 2015-10-15 09:33        503808        ----a-w-        c:\windows\system32\devinv.dll
2015-09-18 19:19 . 2015-10-15 09:33        73216        ----a-w-        c:\windows\system32\acmigration.dll
2015-09-18 19:19 . 2015-10-15 09:33        1291264        ----a-w-        c:\windows\system32\appraiser.dll
2015-09-18 19:09 . 2015-10-15 09:33        1163776        ----a-w-        c:\windows\system32\aeinv.dll
2015-09-02 03:04 . 2015-09-09 17:08        41984        ----a-w-        c:\windows\system32\lpk.dll
2015-09-02 03:04 . 2015-09-09 17:08        100864        ----a-w-        c:\windows\system32\fontsub.dll
2015-09-02 03:04 . 2015-09-09 17:08        14336        ----a-w-        c:\windows\system32\dciman32.dll
2015-09-02 03:04 . 2015-09-09 17:08        46080        ----a-w-        c:\windows\system32\atmlib.dll
2015-09-02 02:48 . 2015-09-09 17:08        70656        ----a-w-        c:\windows\SysWow64\fontsub.dll
2015-09-02 02:48 . 2015-09-09 17:08        10240        ----a-w-        c:\windows\SysWow64\dciman32.dll
2015-09-02 02:48 . 2015-09-09 17:08        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2015-09-02 02:47 . 2015-09-09 17:08        25600        ----a-w-        c:\windows\SysWow64\lpk.dll
2015-09-02 01:47 . 2015-09-09 17:08        372736        ----a-w-        c:\windows\system32\atmfd.dll
2015-09-02 01:33 . 2015-09-09 17:08        299520        ----a-w-        c:\windows\SysWow64\atmfd.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-10-13 14:13        1731800        ----a-w-        c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2014-04-23 533568]
"HP Photosmart 5520 series (NET)"="c:\program files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2015-09-21 787592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SimpleScreenshot"="c:\progra~2\SSS\SIMPLESCREENSHOT.EXE" [BU]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-09 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-10-13 60688]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2015-08-06 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-11-09 596528]
"adm_tray.exe"="c:\program files (x86)\Acronis\DriveMonitor\adm_tray.exe" [2011-02-24 470120]
.
c:\users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2015-9-3 1195016]
RescueTime.lnk - c:\program files (x86)\RescueTime\RescueTime.exe [2013-5-22 2401792]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"Download Protect"=c:\programdata\dlprotect.exe
"iSaverCtrl"=c:\program files (x86)\iSaver\iSaverCtrl.exe --startup
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 ALSysIO;ALSysIO;c:\users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Common Files\AAV\aavus.exe;c:\program files (x86)\Common Files\AAV\aavus.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BotkindSyncService;Botkind Service;c:\program files (x86)\Allway Sync\Bin\SyncService.exe service;c:\program files (x86)\Allway Sync\Bin\SyncService.exe service [x]
R4 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
R4 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
R4 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
R4 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
R4 NoIPDUCService4;NO-IP DUC v4;c:\program files (x86)\No-IP\ducservice.exe;c:\program files (x86)\No-IP\ducservice.exe [x]
R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
R4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
R4 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe;c:\program files\OO Software\Defrag\oodag.exe [x]
R4 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
R4 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
R4 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
R4 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
R4 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R4 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
R4 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 UI Assistant Service;UI Assistant Service;c:\program files (x86)\Join Air\AssistantServices.exe;c:\program files (x86)\Join Air\AssistantServices.exe [x]
R4 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S1 SLEE_18_DRIVER;Steganos Live Encryption Engine 18 [Driver];c:\windows\Sleen1864.sys;c:\windows\Sleen1864.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 EkaProt6;Ekahau User Protocol Driver for NDIS 6;c:\windows\system32\DRIVERS\ekaprot6.sys;c:\windows\SYSNATIVE\DRIVERS\ekaprot6.sys [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-11-13 06:24        997704        ----a-w-        c:\program files (x86)\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-11-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 06:40]
.
2015-11-28 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
- c:\users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe [2015-11-21 17:05]
.
2015-11-28 c:\windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
- c:\users\DDDDD CCCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe [2015-11-21 17:05]
.
2015-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-13 15:29]
.
2015-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-13 15:29]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e}]
c:\program files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-10-13 14:09        2339032        ----a-w-        c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SNUVCDSM"="c:\windows\snuvcdsm.exe" [2011-01-13 30080]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-29 8312352]
"PLFSetL"="c:\windows\PLFSetL.exe" [2011-01-13 99712]
"PLFSetI"="c:\windows\PLFSetI.exe" [2011-11-13 200704]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-11 349480]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-22 295936]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-07-22 323072]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 823840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-10-16 170256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-30 1337000]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-02-12 462400]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: Auswahl speichern - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
IE: Bild ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
IE: Diese Seite ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
IE: Free YouTube Download - c:\users\DDDDD CCCCC\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Lesezeichen ausschneiden - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Neue Notiz - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
IE: URL notieren - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
Trusted Zone: google.com\www
TCP: DhcpNameServer = 192.168.178.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\
FF - prefs.js: browser.startup.homepage - hxxp://www.zeitzuleben.de/2164-ziele-finden/|http://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html|http://forum.computerbild.de/pc-hardware/festplatte-defekt_157241.html|about:preferences
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
AddRemove-Chandler - c:\program files (x86)\Chandler1.0.3\uninst.exe
AddRemove-CoreAAC Audio Decoder - c:\windows\system32\CoreAAC-uninstall.exe
AddRemove-{ad2818b3-1616-4ec8-855d-be6936103e5a} - c:\programdata\Package Cache\{ad2818b3-1616-4ec8-855d-be6936103e5a}\free-system-utilities_Setup_chip_de-DE.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_185_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_185_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32]
@DACL=(02 0000)
@=expand:"%SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_185_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_185_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.19"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_185.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
@DACL=(02 0000)
@="Bing"
"DisplayName"="@ieframe.dll,-12512"
"URL"="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-11-28  15:46:59
ComboFix-quarantined-files.txt  2015-11-28 14:46
ComboFix2.txt  2015-11-22 15:47
ComboFix3.txt  2015-11-21 19:28
ComboFix4.txt  2015-02-01 07:55
ComboFix5.txt  2015-11-28 14:22
.
Vor Suchlauf: 23 Verzeichnis(se), 88.341.544.960 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 89.584.181.248 Bytes frei
.
- - End Of File - - E1EC034C19E2F426780D3D077051E92A
A36C5E4F47E84449FF07ED3517B43A31
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 29.11.2015
Suchlaufzeit: 13:14
Protokolldatei: Malwarebytes Anti-Malware.2txt.txt
Administrator: Ja

Version: 2.2.0.1024
Malware-Datenbank: v2015.11.29.02
Rootkit-Datenbank: v2015.11.26.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DDDD CCCCC

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 462739
Abgelaufene Zeit: 31 Min., 8 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 7 Home Premium x64
Ran by DDDDD CCCCC (Administrator) on 29.11.2015 at 14:27:52,00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.11.2015 at 14:32:09,46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ich dachte SearchScopes wurde schon entfernt?

Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:28-11-2015
durchgeführt von DDDDD CCCCC (Administrator) auf ARBEITSCOMPUTER (29-11-2015 14:49:49)
Gestartet von C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
Geladene Profile: DDDDD CCCCC (Verfügbare Profile: DDDDD CCCCC & EEEEE & Versuch)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SNUVCDSM] => C:\Windows\snuvcdsm.exe [30080 2011-01-13] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetL] => C:\Windows\PLFSetL.exe [99712 2011-01-13] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2011-11-13] ()
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [462400 2011-02-12] (Acronis)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SimpleScreenshot] => C:\PROGRA~2\SSS\SIMPLESCREENSHOT.EXE
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [adm_tray.exe] => C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe [470120 2011-02-24] ()
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [533568 2014-04-23] (BillP Studios)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-03-29]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RescueTime.lnk [2014-09-23]
ShortcutTarget: RescueTime.lnk -> C:\Program Files (x86)\RescueTime\RescueTime.exe (RescueTime, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{15EF09C9-CEB0-425C-A5AC-002B19B46047}: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{C020751A-5210-47B5-9035-51239104E46C}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C10DCD24-BF50-4B4B-B20C-22407FC328C8}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1242904208-471078349-2963378918-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: unissales -> {7e0aaab3-ba7d-4a2d-b1e6-4289ce4d1b1e} -> C:\Program Files (x86)\unissales\9vFbOLvEX4RE1d.x64.dll => Keine Datei
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-20] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-09-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-20] (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253
FF Homepage: hxxp://www.zeitzuleben.de/2164-ziele-finden/
hxxp://www.trojaner-board.de/168515-langsamer-firefox-stoert-6.html
hxxp://forum.computerbild.de/pc-hardware/festplatte-defekt_157241.html
about:preferences
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-20] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-14] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1242904208-471078349-2963378918-1000: @citrixonline.com/appdetectorplugin -> C:\Users\DDDDD CCCCC\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-31] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-07-14] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-11] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-11] (Apple Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\extensions\adblockpopups@jessehakanen.net.xpi [2015-11-22]
FF Extension: ADB Helper - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\adbhelper@mozilla.org [2015-11-13]
FF Extension: Valence - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\fxdevtools-adapters@mozilla.org [2015-10-29]
FF Extension: Mailvelope - C:\Users\DDDDD CCCCC\AppData\Roaming\Mozilla\Firefox\Profiles\40txp56o.default-1438981183253\Extensions\jid1-AQqSMBYb0a8ADg@jetpack.xpi [2015-11-13]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR Profile: C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Präsentationen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10]
CHR Extension: (Google Drive) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]
CHR Extension: (YouTube) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-17]
CHR Extension: (Nanny for Google Chrome (TM)) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\cljcgchbnolheggdgaeclffeagnnmhno [2015-02-21]
CHR Extension: (Google-Suche) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]
CHR Extension: (Google Tabellen) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-08]
CHR Extension: (Google Mail) - C:\Users\DDDDD CCCCC\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AAV UpdateService; C:\Program Files (x86)\Common Files\AAV\aavus.exe [122880 2007-10-04] () [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
S4 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2013-10-10] () [Datei ist nicht signiert]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S4 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [241704 2014-03-25] (Foxit Corporation)
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S4 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] () [Datei ist nicht signiert]
S4 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3051848 2011-01-25] (O&O Software GmbH)
S4 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [80896 2011-03-31] () [Datei ist nicht signiert]
S4 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S4 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert]
S4 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [Datei ist nicht signiert]
S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe [72344 2008-05-19] (SiSoftware) [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC)
S4 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 EkaProt6; C:\Windows\System32\DRIVERS\ekaprot6.sys [27288 2012-03-23] (Ekahau Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806592 2011-01-13] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
S3 ALSysIO; \??\C:\Users\DANIEL~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-29 14:47 - 2015-11-29 14:47 - 00000692 _____ C:\Users\DDDDD CCCCC\Desktop\JRT2.txt
2015-11-29 14:27 - 2015-11-25 00:42 - 01599336 _____ (Malwarebytes) C:\Users\DDDDD CCCCC\Desktop\JRT.exe
2015-11-29 14:13 - 2015-11-29 14:13 - 01733632 _____ C:\Users\DDDDD CCCCC\Desktop\AdwCleaner_5.022.exe
2015-11-29 14:10 - 2015-11-29 14:44 - 00001240 _____ C:\Users\DDDDD CCCCC\Desktop\Malwarebytes Anti-Malware.2txt.txt
2015-11-28 15:47 - 2015-11-28 15:47 - 00038051 _____ C:\ComboFix.txt
2015-11-28 15:20 - 2015-11-28 15:20 - 00001238 _____ C:\Users\DDDDD CCCCC\Desktop\ComboFix.exe - Verknüpfung.lnk
2015-11-28 15:19 - 2015-11-28 15:20 - 05639804 _____ (Swearware) C:\Users\DDDDD CCCCC\Downloads\ComboFix.exe
2015-11-28 14:15 - 2015-11-28 14:15 - 01646209 _____ C:\Users\DDDDD CCCCC\Desktop\Caruso_Sabrina_ESt_2014.pdf
2015-11-28 09:11 - 2015-11-28 09:11 - 00001474 ____R C:\Windows\SimpleScreenshot10_Uninstall.in
2015-11-28 09:11 - 2008-01-28 14:51 - 00330336 _____ (Mirko Böer) C:\Windows\SSSUn10.exe
2015-11-28 09:10 - 2015-11-28 09:10 - 01227218 _____ C:\Users\DDDDD CCCCC\Downloads\ssshot14.zip
2015-11-28 09:09 - 2015-11-28 09:09 - 01466656 _____ C:\Users\DDDDD CCCCC\Downloads\SimpleScreenshot - CHIP-Installer.exe
2015-11-27 16:10 - 2015-11-27 16:10 - 00178402 _____ C:\Users\DDDDD CCCCC\Downloads\unterstützerblatt_rheinsteg.pdf
2015-11-25 12:36 - 2015-11-25 12:36 - 00431429 _____ C:\Users\DDDDD CCCCC\Downloads\Schwarzelühr-Sutter Newsletter (19)2015.pdf
2015-11-25 12:35 - 2015-11-25 12:36 - 00138265 _____ C:\Users\DDDDD CCCCC\Downloads\2015-11-22_LMV-Einladung-Jahresmitgliederversammlung_mit_LV-Neuwahlen.pdf
2015-11-25 12:32 - 2015-11-25 12:33 - 00204025 _____ C:\Users\DDDDD CCCCC\Downloads\urkunde.pdf
2015-11-25 12:32 - 2015-11-25 12:32 - 00012782 _____ C:\Users\DDDDD CCCCC\Downloads\sepa-direct.pdf
2015-11-24 18:28 - 2015-11-24 18:28 - 00852720 _____ C:\Users\DDDDD CCCCC\Desktop\SecurityCheck.exe
2015-11-24 18:26 - 2015-11-24 18:26 - 00043162 _____ C:\Users\DDDDD CCCCC\Desktop\ESET.txt
2015-11-24 01:00 - 2015-11-24 01:00 - 00814790 _____ C:\Users\DDDDD CCCCC\Downloads\muv_immobilien_im_privatvermoegen.zip
2015-11-23 17:11 - 2015-11-23 17:11 - 00096384 _____ C:\Users\DDDDD CCCCC\Downloads\finanzplanung_konkret_2014-2.pdf
2015-11-23 15:44 - 2015-11-23 15:44 - 00442264 _____ C:\Users\DDDDD CCCCC\Downloads\2014-09-23-Berechnung-Aufteilung-Grundstueckskaufpreis-Anleitung.pdf
2015-11-23 15:22 - 2015-11-23 15:22 - 00438784 _____ C:\Users\DDDDD CCCCC\Downloads\2014-09-23-Berechnung-Aufteilung-Grundstueckskaufpreis-Arbeitshilfe.xls
2015-11-23 15:17 - 2015-11-23 15:17 - 00227840 _____ C:\Users\DDDDD CCCCC\Downloads\4918151_Immorendite_09_15.xls
2015-11-23 10:30 - 2015-11-23 10:30 - 00001365 _____ C:\Users\Public\Desktop\SeaTools for Windows.lnk
2015-11-23 10:30 - 2015-11-23 10:30 - 00000000 ____D C:\ProgramData\Package Cache
2015-11-23 10:29 - 2015-11-23 10:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-11-23 10:29 - 2015-11-23 10:29 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-11-22 22:38 - 2015-11-29 14:32 - 00000697 _____ C:\Users\DDDDD CCCCC\Desktop\JRT.txt
2015-11-22 21:58 - 2015-11-22 22:00 - 00071434 _____ C:\Users\DDDDD CCCCC\Desktop\Malwarebytes Anti-Malware.txt
2015-11-22 16:48 - 2015-11-22 16:48 - 00037873 _____ C:\Users\DDDDD CCCCC\Desktop\ComboFix.txt
2015-11-22 00:33 - 2015-11-22 00:33 - 00275544 _____ C:\Windows\Minidump\112215-33805-01.dmp
2015-11-22 00:21 - 2015-11-22 00:32 - 626154878 _____ C:\Windows\MEMORY.DMP
2015-11-22 00:21 - 2015-11-22 00:21 - 00275544 _____ C:\Windows\Minidump\112215-37845-01.dmp
2015-11-22 00:15 - 2015-11-22 00:14 - 00000918 _____ C:\Users\DDDDD CCCCC\Desktop\Sandboxed Web Browser.lnk
2015-11-22 00:14 - 2015-11-23 10:17 - 00001768 _____ C:\Windows\Sandboxie.ini
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ___RD C:\Sandbox
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-11-22 00:14 - 2015-11-22 00:14 - 00000000 ____D C:\Program Files\Sandboxie
2015-11-21 20:35 - 2015-11-21 20:35 - 25527544 _____ C:\Users\DDDDD CCCCC\Downloads\SeaToolsforWindowsSetup.exe
2015-11-21 20:07 - 2015-11-28 15:20 - 05639804 ____R (Swearware) C:\Users\DDDDD CCCCC\Desktop\ComboFix.exe
2015-11-21 09:34 - 2015-11-21 09:34 - 00000309 _____ C:\Users\DDDDD CCCCC\Desktop\Vermögensverwaltende GmbH Auswegstrategie vor der Abgeltungsteuer.URL
2015-11-21 07:36 - 2015-11-21 07:36 - 00001110 _____ C:\Users\Public\Desktop\Acronis Drive Monitor.lnk
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\ProgramData\Acronis
2015-11-21 07:36 - 2015-11-21 07:36 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2015-11-21 07:32 - 2015-11-21 07:32 - 00000000 ____D C:\Program Files (x86)\HD Tune
2015-11-20 21:11 - 2015-11-20 21:23 - 00002121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-11-20 21:11 - 2015-11-20 21:23 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-11-20 21:11 - 2015-11-20 21:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-11-20 21:10 - 2015-10-09 00:22 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll
2015-11-20 21:10 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL
2015-11-20 21:10 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2015-11-20 21:10 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\SysWOW64\locale.nls
2015-11-20 21:10 - 2015-10-08 19:52 - 00419928 _____ C:\Windows\system32\locale.nls
2015-11-20 16:50 - 2015-11-20 16:50 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5
2015-11-20 16:37 - 2015-11-29 14:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Desktop\FRST-OlderVersion
2015-11-20 16:37 - 2015-11-24 18:49 - 00066656 _____ C:\Users\DDDDD CCCCC\Desktop\FRST.txt
2015-11-19 18:48 - 2015-11-19 18:48 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:55 - 00000000 ____D C:\FreeOCR
2015-11-19 15:53 - 2015-11-19 15:53 - 00000594 _____ C:\Users\DDDDD CCCCC\Desktop\FreeOCR.lnk
2015-11-19 15:53 - 2015-11-19 15:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeOCR
2015-11-19 15:53 - 2007-03-10 10:11 - 02680320 _____ (HiComponents) C:\Windows\SysWOW64\ImageEnXLibrary.ocx
2015-11-17 18:56 - 2015-11-17 18:56 - 02038188 _____ C:\Users\DDDDD CCCCC\Downloads\49224_BA_Merkblatt_10_vgks_3AK_barrierefrei.pdf
2015-11-17 09:07 - 2015-11-17 09:07 - 00141145 _____ C:\Users\DDDDD CCCCC\Downloads\Online-Entgeltrechner.zip
2015-11-17 08:55 - 2015-11-17 08:55 - 01469743 _____ C:\Users\DDDDD CCCCC\Downloads\Scan_Document_17112015.pdf
2015-11-17 08:38 - 2015-11-17 08:38 - 00183898 _____ C:\Users\DDDDD CCCCC\Downloads\BoardingPass(1).pdf
2015-11-14 08:34 - 2015-11-14 08:34 - 00148859 _____ C:\Users\DDDDD CCCCC\Downloads\Anmeldung_Stammtisch_November_2015.pdf
2015-11-13 11:25 - 2015-11-13 11:25 - 00003588 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919
2015-11-13 08:19 - 2015-11-13 08:19 - 00073326 _____ C:\Users\DDDDD CCCCC\Desktop\WEB.de Verschlüsselung.pdf
2015-11-13 08:12 - 2015-11-13 08:12 - 00068516 _____ C:\Users\DDDDD CCCCC\Downloads\Datenänderung(4).PDF
2015-11-13 08:11 - 2015-11-13 08:11 - 00501898 _____ C:\Users\DDDDD CCCCC\Downloads\187M4G.pdf
2015-11-13 08:09 - 2015-11-13 08:09 - 00481809 _____ C:\Users\DDDDD CCCCC\Downloads\Schwarzelühr-Sutter Newsletter (18)2015.pdf
2015-11-13 07:56 - 2015-10-29 11:16 - 00720414 ____N C:\Users\DDDDD CCCCC\Desktop\Ausbildungsreport-Baden-Wuerttemberg-2015.pdf
2015-11-13 07:56 - 2015-06-27 07:05 - 00117802 ____N C:\Users\DDDDD CCCCC\Desktop\Kandidaturschreiben-Max-Heß.pdf
2015-11-13 07:56 - 2015-06-21 11:10 - 00692579 ____N C:\Users\DDDDD CCCCC\Desktop\DGB-Jugend-Ausbildungsreport-2014.pdf
2015-11-13 07:55 - 2015-04-27 11:10 - 00204289 ____N C:\Users\DDDDD CCCCC\Desktop\aufgabenbeschreibung-rentenfachmann.pdf
2015-11-13 07:52 - 2015-02-26 06:04 - 00083956 ____N C:\Users\DDDDD CCCCC\Desktop\Datenänderung.PDF
2015-11-12 17:17 - 2015-11-12 17:17 - 00023178 _____ C:\Users\DDDDD CCCCC\Downloads\Creditor Identifier.pdf
2015-11-12 13:23 - 2015-11-12 13:23 - 00040174 _____ C:\Users\DDDDD CCCCC\Downloads\Kontoauszug_201510.pdf
2015-11-12 13:14 - 2015-11-03 18:55 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 16:31 - 2015-11-11 16:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-11 16:29 - 2015-11-11 16:29 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-11-11 16:29 - 2015-11-11 16:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-11-11 16:28 - 2015-11-11 16:29 - 00000000 ____D C:\Program Files\iTunes
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files\iPod
2015-11-11 16:28 - 2015-11-11 16:28 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files\Bonjour
2015-11-11 16:25 - 2015-11-11 16:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2015-11-11 16:23 - 2015-11-11 16:23 - 00001809 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-11-11 16:23 - 2015-11-11 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-11 16:22 - 2015-11-11 16:23 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2015-11-11 16:21 - 2015-11-11 16:21 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2015-11-11 13:32 - 2015-10-20 19:42 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 02608128 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 13:32 - 2015-10-20 19:42 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 13:32 - 2015-10-20 19:41 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 13:32 - 2015-10-20 19:41 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-11-11 13:32 - 2015-10-20 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-11-11 13:32 - 2015-10-20 18:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-11-11 13:31 - 2015-11-03 23:10 - 00390344 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 13:31 - 2015-11-03 22:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-11-11 13:31 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 13:31 - 2015-10-31 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 13:31 - 2015-10-31 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 13:31 - 2015-10-31 00:25 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 13:31 - 2015-10-31 00:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 13:31 - 2015-10-31 00:24 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-31 00:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 13:31 - 2015-10-31 00:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 13:31 - 2015-10-31 00:13 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 13:31 - 2015-10-31 00:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 13:31 - 2015-10-31 00:12 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 13:31 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 13:31 - 2015-10-31 00:11 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 13:31 - 2015-10-31 00:04 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 13:31 - 2015-10-31 00:01 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-11-11 13:31 - 2015-10-30 23:53 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-11-11 13:31 - 2015-10-30 23:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-11-11 13:31 - 2015-10-30 23:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 13:31 - 2015-10-30 23:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-11-11 13:31 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-11-11 13:31 - 2015-10-30 23:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-11-11 13:31 - 2015-10-30 23:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-11-11 13:31 - 2015-10-30 23:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-11-11 13:31 - 2015-10-30 23:34 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 13:31 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:29 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:29 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-11-11 13:31 - 2015-10-30 23:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-11-11 13:31 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-11-11 13:31 - 2015-10-30 23:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-11-11 13:31 - 2015-10-30 23:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 13:31 - 2015-10-30 23:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-11-11 13:31 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-11-11 13:31 - 2015-10-30 23:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-11-11 13:31 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-11-11 13:31 - 2015-10-30 23:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-11-11 13:31 - 2015-10-30 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-11-11 13:31 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 13:31 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-11-11 13:31 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-11-11 13:31 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-11-11 13:31 - 2015-10-20 02:12 - 05570496 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 02:12 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 13:31 - 2015-10-20 02:12 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 13:31 - 2015-10-20 02:09 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-11-11 13:31 - 2015-10-20 02:06 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 13:31 - 2015-10-20 02:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 13:31 - 2015-10-20 02:05 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 02:04 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 13:31 - 2015-10-20 02:04 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 13:31 - 2015-10-20 02:00 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:59 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-11-11 13:31 - 2015-10-20 01:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-11-11 13:31 - 2015-10-20 01:48 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-11-11 13:31 - 2015-10-20 01:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-11-11 13:31 - 2015-10-20 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-11-11 13:31 - 2015-10-20 01:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-11-11 13:31 - 2015-10-20 01:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-11-11 13:31 - 2015-10-20 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 01:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:41 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 13:31 - 2015-10-20 00:40 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 13:31 - 2015-10-20 00:29 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-11-11 13:31 - 2015-10-20 00:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-11-11 13:31 - 2015-10-20 00:27 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-11 13:31 - 2015-10-20 00:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-11 13:31 - 2015-09-23 14:15 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 13:31 - 2015-09-23 14:15 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 13:31 - 2015-09-23 14:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 13:30 - 2015-10-29 18:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-11-11 13:30 - 2015-10-29 18:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-11-11 13:30 - 2015-10-13 17:41 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 13:30 - 2015-10-13 17:40 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 13:30 - 2015-10-13 05:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 13:30 - 2015-10-01 19:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 13:30 - 2015-10-01 19:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-11 13:30 - 2015-10-01 18:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-11-10 13:09 - 2015-11-10 13:09 - 00066911 _____ C:\Users\DDDDD CCCCC\Downloads\Anlagen_zur_Beschwerde.pdf
2015-11-10 11:47 - 2015-11-25 23:56 - 00000000 ____D C:\Users\DDDDD CCCCC\Downloads\Mietobjekt Friedrichstraße
2015-11-10 10:19 - 2015-11-10 10:19 - 00397473 _____ C:\Users\DDDDD CCCCC\Documents\korrigiertes Arbeitszeugnis.pdf
2015-11-10 09:29 - 2015-11-10 09:29 - 01670270 _____ C:\Users\DDDDD CCCCC\Downloads\DJI_Broschüre_ComingOut.pdf
2015-11-06 12:03 - 2015-11-06 12:03 - 00000264 _____ C:\Users\DDDDD CCCCC\Desktop\Selbstwirksamkeitserwartung – Wikipedia.URL
2015-11-06 11:07 - 2015-11-06 11:07 - 00441498 _____ C:\Users\DDDDD CCCCC\Downloads\WIR in STUTTGART 2015.pdf
2015-11-06 11:01 - 2015-11-06 11:01 - 00533804 _____ C:\Users\DDDDD CCCCC\Downloads\biema_faltblatt_neuechancen.pdf
2015-11-06 09:16 - 2015-11-06 09:16 - 01691580 _____ C:\Users\DDDDD CCCCC\Desktop\WIR-im-Wahlkampf-Einladung1.pdf
2015-11-05 10:35 - 2015-11-05 10:35 - 00010767 _____ C:\Users\DDDDD CCCCC\Downloads\Wechsel_des_Einlagensicherungssystems_vom_22_10_2015.pdf
2015-11-05 10:35 - 2015-11-05 10:35 - 00005933 _____ C:\Users\DDDDD CCCCC\Downloads\Kontoauszug_zum_30_10_2015.pdf
2015-11-05 10:34 - 2015-11-05 10:34 - 00008240 _____ C:\Users\DDDDD CCCCC\Downloads\Kontoabschluss_zum_30_09_2015.pdf
2015-11-05 10:34 - 2015-11-05 10:34 - 00005961 _____ C:\Users\DDDDD CCCCC\Downloads\Kontoauszug_zum_30_09_2015.pdf
2015-11-03 21:20 - 2015-11-03 21:20 - 01700703 _____ C:\Users\DDDDD CCCCC\Downloads\WIR-im-Wahlkampf-Einladung1.pdf
2015-11-03 21:07 - 2015-11-03 21:07 - 07358642 _____ C:\Users\DDDDD CCCCC\Downloads\Wirtschaftliche-Foerderung-Hilfen-fuer-Investitionen-Innovationen.pdf
2015-11-03 11:00 - 2015-11-03 11:00 - 00870087 _____ C:\Users\DDDDD CCCCC\Downloads\WOF7PV.pdf
2015-11-03 11:00 - 2015-11-03 11:00 - 00502476 _____ C:\Users\DDDDD CCCCC\Downloads\K7MVFV.pdf
2015-10-30 17:26 - 2015-10-30 17:26 - 01033366 _____ C:\Users\DDDDD CCCCC\Downloads\7-universelle-Geldgesetze-Gratisreport.pdf
2015-10-30 10:41 - 2015-10-30 10:41 - 00007659 _____ C:\Users\DDDDD CCCCC\Downloads\Kreditkarten-Abrechnung_vom_12_10_2015.pdf
2015-10-30 09:17 - 2015-10-30 09:17 - 00870087 _____ C:\Users\DDDDD CCCCC\Downloads\FLT_H8F93727200_0.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-29 14:50 - 2015-06-08 16:32 - 00000724 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-29 14:49 - 2014-08-21 20:10 - 00000000 ____D C:\FRST
2015-11-29 14:43 - 2014-08-05 14:08 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-29 14:39 - 2012-09-20 04:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-29 14:28 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-29 14:28 - 2009-07-14 05:45 - 00025840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-29 14:21 - 2012-09-20 04:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-29 14:20 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-29 14:19 - 2014-08-24 18:36 - 00000000 ____D C:\AdwCleaner
2015-11-29 14:15 - 2015-05-31 13:23 - 00000628 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job
2015-11-29 14:05 - 2012-08-14 18:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-28 15:47 - 2014-08-24 12:03 - 00000000 ____D C:\Qoobox
2015-11-28 15:42 - 2013-10-13 19:47 - 00000000 ____D C:\Windows\erdnt
2015-11-28 15:42 - 2009-10-05 22:35 - 00000000 ____D C:\Windows
2015-11-28 15:42 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2015-11-28 14:14 - 2012-03-25 11:40 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Steuerfälle
2015-11-28 09:11 - 2011-11-20 16:01 - 00000946 _____ C:\Users\DDDDD CCCCC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SimpleScreenshot.lnk
2015-11-25 23:29 - 2014-08-15 15:44 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Adobe
2015-11-25 17:28 - 2015-06-11 20:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-24 18:51 - 2015-10-18 13:18 - 00064234 _____ C:\Users\DDDDD CCCCC\Desktop\Addition.txt
2015-11-24 18:40 - 2015-02-10 18:48 - 02348544 _____ (Farbar) C:\Users\DDDDD CCCCC\Desktop\FRST64.exe
2015-11-22 22:29 - 2014-08-07 20:56 - 03508736 ___SH C:\Users\DDDDD CCCCC\Desktop\Thumbs.db
2015-11-22 00:33 - 2012-08-07 08:52 - 00000000 ____D C:\Windows\Minidump
2015-11-21 18:05 - 2015-06-08 16:32 - 00003786 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 18:05 - 2015-05-31 13:23 - 00003690 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000
2015-11-21 15:34 - 2012-04-07 11:49 - 00000000 ____D C:\Users\DDDDD CCCCC\Documents\Finanzen
2015-11-21 01:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-11-21 01:19 - 2009-07-14 05:45 - 00458328 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-20 21:31 - 2011-11-14 06:34 - 00702664 _____ C:\Windows\system32\perfh007.dat
2015-11-20 21:31 - 2011-11-14 06:34 - 00151424 _____ C:\Windows\system32\perfc007.dat
2015-11-20 21:31 - 2009-07-14 06:13 - 01629998 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-20 21:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2015-11-20 21:23 - 2013-07-21 10:52 - 00001912 _____ C:\Windows\epplauncher.mif
2015-11-20 12:37 - 2013-09-19 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-20 12:37 - 2012-03-11 02:08 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-20 12:36 - 2015-09-25 16:50 - 00000000 ____D C:\Users\DDDDD CCCCC\.oracle_jre_usage
2015-11-20 12:35 - 2015-09-25 16:50 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-11-16 08:53 - 2014-11-02 21:54 - 00000000 ____D C:\Users\EEEEE\Desktop\div. Briefe
2015-11-13 07:40 - 2012-04-02 19:28 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-13 07:40 - 2012-04-02 19:28 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-13 07:40 - 2011-11-15 21:21 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-12 13:24 - 2013-07-13 08:36 - 00000000 ____D C:\Windows\system32\MRT
2015-11-12 13:11 - 2011-11-18 19:58 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-12 13:10 - 2014-03-28 22:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-11-12 13:10 - 2009-11-05 04:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-12 12:37 - 2013-10-05 08:28 - 01604278 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-11-12 12:30 - 2009-07-14 03:34 - 00000648 _____ C:\Windows\win.ini
2015-11-12 12:29 - 2009-11-05 01:26 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 16:31 - 2012-01-29 14:14 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Local\Apple Computer
2015-11-11 16:31 - 2011-11-21 17:05 - 00000000 ____D C:\Users\DDDDD CCCCC\AppData\Roaming\Apple Computer
2015-11-11 16:28 - 2012-01-29 14:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-11-11 16:21 - 2011-11-20 19:42 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-11-11 12:57 - 2015-08-07 21:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-10 08:27 - 2015-08-28 21:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-30 08:51 - 2015-05-25 18:25 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-06-28 07:10 - 2014-07-23 21:30 - 14159872 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\Sandra.mdb
2015-01-30 20:51 - 2015-02-22 14:54 - 0000600 _____ () C:\Users\DDDDD CCCCC\AppData\Roaming\winscp.rnd
2012-04-20 18:28 - 2014-07-07 01:20 - 0006656 _____ () C:\Users\DDDDD CCCCC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 21:07 - 2014-09-22 21:07 - 0001482 _____ () C:\Users\DDDDD CCCCC\AppData\Local\RecConfig.xml
2015-10-28 15:08 - 2015-10-28 15:08 - 0008046 _____ () C:\Users\DDDDD CCCCC\AppData\Local\recently-used.xbel
2013-08-12 21:15 - 2013-08-12 21:15 - 0007603 _____ () C:\Users\DDDDD CCCCC\AppData\Local\Resmon.ResmonCfg
2012-03-31 10:26 - 2012-03-31 10:26 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-13 22:53 - 2011-11-13 22:57 - 0008282 _____ () C:\ProgramData\ArcadeDeluxe3.log
2014-09-22 19:19 - 2014-10-06 19:45 - 0008737 _____ () C:\ProgramData\hpzinstall.log

Einige Dateien in TEMP:
====================
C:\Users\DDDDD CCCCC\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-11-20 17:21

==================== Ende von FRST.txt ============================

magigstar 29.11.2015 15:16
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:28-11-2015
durchgeführt von DDDD CCCC (2015-11-29 14:50:43)
Gestartet von C:\Users\DDDD CCCC\Desktop\FRST-OlderVersion
Windows 7 Home Premium Service Pack 1 (X64) (2011-11-13 21:46:57)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1242904208-471078349-2963378918-500 - Administrator - Disabled)
DDDD CCCC (S-1-5-21-1242904208-471078349-2963378918-1000 - Administrator - Enabled) => C:\Users\DDDD CCCC
EEEEE (S-1-5-21-1242904208-471078349-2963378918-1003 - Limited - Enabled) => C:\Users\EEEEE
Gast (S-1-5-21-1242904208-471078349-2963378918-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1242904208-471078349-2963378918-1002 - Limited - Enabled)
Versuch (S-1-5-21-1242904208-471078349-2963378918-1004 - Administrator - Enabled) => C:\Users\Versuch

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
AC3Filter 1.63b (HKLM-x32\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Acronis Drive Monitor (HKLM-x32\...\{706AE61D-40A4-4F50-8359-FE8F6F7FA461}) (Version: 1.0.566 - Acronis)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.103 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Alle meine Passworte 4.13 (HKLM\...\AllemeinePassworte) (Version:  - Mirko Böer)
Allway Sync version 12.16.9 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.2015.1105 - Alps Electric)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Avi2Dvd 0.6.4 (HKLM-x32\...\Avi2Dvd) (Version: 0.6.4 - TrustFm)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
BatteryCare 0.9.10.0 (HKLM-x32\...\{C6A6036D-FBD0-4324-BEAA-C0845257160C}_is1) (Version: 0.9.10.0 - Filipe Lourenço)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP160 Benutzerregistrierung (HKLM-x32\...\Canon MP160 Benutzerregistrierung) (Version:  - )
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Chandler 1.0.3 (HKLM-x32\...\Chandler) (Version: 1.0.3 - Open Source Applications Foundation)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
CoreAAC Audio Decoder (remove only) (HKLM-x32\...\CoreAAC Audio Decoder) (Version:  - )
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EinsteinBrainTrainer (remove only) (HKLM-x32\...\EinsteinBrainTrainer) (Version:  - )
Ekahau HeatMapper (HKLM\...\Heatmapper-1.1.4.39795) (Version: 1.1.4.39795 - Ekahau Inc.)
Eraser 6.0.10.2620 (HKLM\...\{6E5159B4-A519-41EF-80EF-AD58371515DF}) (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 5.9.1 (HKLM-x32\...\{5EA1DED0-5285-11E5-8AA1-0050569584E9}) (Version: 5.9.1.8742 - Evernote Corp.)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
ffdshow [rev 3299] [2010-03-03] (HKLM-x32\...\ffdshow_is1) (Version: 1.0.0.3299 - )
Fiat eco:Drive (HKLM-x32\...\com.fiat.convergence.385E4263E7379A5D22A7076E99B02868EFF10711.1) (Version: 2.0.2 - Fiat Group Automobiles)
Fiat eco:Drive (x32 Version: 2.0.2 - Fiat Group Automobiles) Hidden
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.3.105.325 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.3.321 - Foxit Corporation)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.0.4.426 (HKLM-x32\...\Free DVD Video Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free System Utilities (HKLM-x32\...\{ad2818b3-1616-4ec8-855d-be6936103e5a}) (Version: 1.1.0.70 - Covus Freemium GmbH)
Free SystemUtilities (x32 Version: 1.1.0.70 - Covus Freemium GmbH) Hidden
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0_RC_10 - )
FreeOCR v5.4 (HKLM-x32\...\freeocr_is1) (Version:  - )
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FrostWire 5.3.5 (HKLM-x32\...\FrostWire 5) (Version: 5.3.5.0 - FrostWire Team)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GoToMeeting 7.6.0.4007 (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\GoToMeeting) (Version: 7.6.0.4007 - CitrixOnline)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - ZTE Corporation)
Kassenbuch (HKLM-x32\...\{29531C6B-7B64-4C53-B54A-6C8AB5DE2159}) (Version: 1.0.0 - Office Consult GmbH)
K-Lite Codec Pack 9.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.2.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MediaHuman YouTube to MP3 Converter Version 3.3 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.3 - )
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (KB971118) (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971118)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 42.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 de)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
O&O Defrag Free Edition (HKLM\...\{C10CAF82-9D36-4D9A-9DC0-C4549F06B519}) (Version: 14.1.431 - O&O Software GmbH)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
pomodairo (HKLM-x32\...\{EEBEA077-AB92-5083-ECB1-C15BD842D00B}) (Version: 1.9 - UNKNOWN)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Random Dresser (HKLM-x32\...\RandomDresser) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
RescueTime 2.2.1 (HKLM-x32\...\{2505571C-03B3-4F9F-AC35-33F1CB4B5E9E}_is1) (Version:  - RescueTime.com)
Restorer2000 3.3 (HKLM-x32\...\Restorer2000_is1) (Version: 3.3 - Bitmart Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Manager (HKLM-x32\...\{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1) (Version: 2.0.7 - Daniel Höllig)
SimpleScreenshot 1.40 (HKLM-x32\...\SimpleScreenshot) (Version:  - )
SiSoftware Sandra Lite 2014.SP2a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.35.2014.6 - SiSoftware)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steganos Safe 14 (HKLM-x32\...\{13B7FBFB-622E-4002-8570-594798E6167D}) (Version: 14.2.2 - Steganos Software GmbH)
Steuer-Spar-Erklärung 2008 (HKLM-x32\...\{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}) (Version: 13.02.0000 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.15 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.18 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.15.11 - Wolters Kluwer Deutschland GmbH)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.38.173 - Akademische Arbeitsgemeinschaft)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Studie zur Verbesserung von HP Deskjet 3070 B611 series Produkten (HKLM\...\{CAD7B6DD-9C82-4D17-BAE8-3E9AE4971B90}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Time Stamp (HKLM-x32\...\Time Stamp_is1) (Version:  - 3.23.2010-0313)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Tunatic (HKLM-x32\...\Tunatic) (Version:  - )
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinPatrol (HKLM\...\{6E575124-6D34-4E65-9375-7D69468A6089}) (Version: 30.9 - BillP Studios)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
Zuzahlungsrechner (HKLM-x32\...\{B2C69E77-F209-4B63-8676-4F32B27E162B}) (Version: 3.6.0 - sfr-software-fuers-heim)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

29-11-2015 14:27:56 JRT Pre-Junkware Removal

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2015-11-28 15:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A17BE20-076C-42DA-8F99-A26025333D5F} - System32\Tasks\HP AR Program Upload - c77186144c9e4d9887733fcbfeb43c949342edc65b3a40a69306946f2a856eae => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {0CAEEB6B-A216-4E04-9EA6-AC310639FD8D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1C03E9C3-4B4B-4ACB-A8AB-17B2C42F6D36} - System32\Tasks\HP AR Program Upload - 86702d7e2b234fe0ac4104c075da5675aa9e3e32525c4609a8c1d9652126c508 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {26DA7882-781D-4FC9-B1A5-5F5B1F7227FE} - System32\Tasks\{6A246FB0-E753-4188-9543-22389AB30F4E} => pcalua.exe -a "C:\Users\DDDD CCCC\Downloads\Chandler_win_1.0.3.exe" -d "C:\Users\DDDD CCCC\Downloads"
Task: {38C51694-B081-4739-8E17-069D4A49D4D4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {3EB7AAE6-60CB-4B78-8975-457682CF3EA5} - System32\Tasks\{75A20F51-DAD0-4F5F-919E-84B2AB233F5B} => msiexec.exe /package "C:\Users\DDDD CCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {40978C8B-1D20-43E6-89F1-B1BA719E581E} - System32\Tasks\HP AR Program Upload - 80a8e838e6934cd8b655baa83b9a353e1c06edcb6d694a43b472cfefd87bcfc5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {47C46238-A6C4-4C4B-BE85-E6E1425608CB} - System32\Tasks\{144D2C4F-2583-452B-AC74-C64839CF03CC} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {49723E02-558F-4E12-BD48-8ACD6598EC43} - System32\Tasks\HP AR Program Upload - 854d1af6a1324f42910f1f8b74b2b3f41fb51fedf01b43d1a63e88c9a6f21790 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {4D38690B-CEB2-4061-A865-4DF2FBE864A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {52FE82CE-EC2E-4802-BCC3-4E0421151CFC} - System32\Tasks\{F3B963CB-BFF7-43C8-ADEF-9881996EFE34} => msiexec.exe /package "C:\Users\DDDD CCCC\Downloads\HPSupportSolutionsFramework-11.51.0048.msi"
Task: {5A42985A-DC32-4FE1-8210-CA09F67316FC} - System32\Tasks\HPCustPartic.exe_{96420065-3C4E-4B3E-96DB-DB0760F51DDD} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {5B5D6CC7-9FA7-4441-9A09-8A3C4EA669FD} - System32\Tasks\{9B880EC1-DC3B-45D7-A7BB-4E131A7A884F} => pcalua.exe -a "C:\Users\DDDD CCCC\Downloads\esetsmartinstaller_enu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {6E788608-033F-4B40-8A06-04D8B880BF59} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {739C86AB-D488-4894-A94A-E1C873D935C4} - System32\Tasks\{239C0599-E784-4910-B228-5D5AB8D346A6} => pcalua.exe -a "C:\Users\DDDD CCCC\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {786DB5A0-25AD-4CDC-BB7E-97656C616113} - System32\Tasks\HP AR Program Upload - 1f34e1c96e2441c2954c4ee9bad5d9a7c0a8147dcd0a401485574ee6cc4342d5 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {792B72B2-C51B-4379-B2AA-007529DB50F0} - System32\Tasks\{8D77E667-A31C-4EB4-B209-1E559B732CBC} => pcalua.exe -a "C:\Program Files (x86)\Canon\IJEREG\MP160\UNINST.EXE"
Task: {7AEAE564-35D2-434E-8BC2-12BF5BC672DE} - System32\Tasks\HPCustParticipation HP Deskjet 3070 B611 series => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7EED0456-B087-4708-8496-6474B917CECB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {92533B9B-37E7-4E54-B7DE-F8B0B255CFEE} - System32\Tasks\{4781B96F-C3F4-45CF-AB6F-C64C9AD3E88D} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{319D91C6-3D44-436C-9F79-36C0D22372DC}\setup.exe" -d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK" -c -runfromtemp -removeonly
Task: {A1D835EF-9220-45A2-811E-2CA5B38166BF} - System32\Tasks\hpUrlLauncher.exe_{4AF7A75F-FDE8-41B8-80D9-5C3EBC32D019} => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\utils\hpUrlLauncher.exe
Task: {A2488771-C70F-410B-ACC7-0C57087007C2} - System32\Tasks\HP AR Program Upload - 35705e1cf9504357848dc302c9669a5caa95e00a3e9f4a8d9f6ab1f8a3caa919 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A8E85CF5-280D-463A-87FA-085DDBCDF6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B608EBAA-A759-44B4-B758-5C039701BB1D} - System32\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B7A342C6-6ABF-492E-9250-2C92CB583846} - System32\Tasks\{A2A68590-5CAE-4C98-8B98-D18CC5E4C073} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{3DB0448D-AD82-4923-B305-D001E521A964}\setup.exe" -c -runfromtemp -l0x407 -removeonly
Task: {BBBF9E37-C1CD-4CF0-A783-CE021D6D2928} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {CE5325CF-BB63-4751-AB56-BD427BEAA0D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-13] (Adobe Systems Incorporated)
Task: {D3C8250E-FAC7-4C67-A7FE-89F284D7F2B0} - System32\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000 => C:\Users\DDDD CCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe [2015-11-21] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E36CA599-B047-467B-99AF-5E380AFECE05} - System32\Tasks\{AC797CD7-B058-4AC8-84B2-B2307D6AFF9B} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {E85DBE85-E344-4E48-A05A-ACF97445121F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {F108FC97-F5B0-4510-9C8E-EB2E8F5AE0EA} - System32\Tasks\HP AR Program Upload - aa75a83ba0e54f469f9229056b3523d0eb35faeb3e174ec898b456f50bbc2c60 => C:\Program Files\HP\HP Photosmart 5520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F30712C0-5F79-4616-BFEE-8D27E1822469} - System32\Tasks\{581487AC-8AAF-40E1-A997-6B8519F0C5EC} => C:\Program Files (x86)\Chandler1.0.3\chandler.exe
Task: {FC0397BA-8222-41E7-836D-453BA55E74DB} - System32\Tasks\{2E665153-C229-4C02-9699-2F4EF08B1807} => pcalua.exe -a C:\Users\DANIEL~1\AppData\Local\Temp\InstallFlashPlayer.exe -d "C:\Program Files (x86)\Mozilla Firefox"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1242904208-471078349-2963378918-1000.job => C:\Users\DDDD CCCC\AppData\Local\Citrix\GoToMeeting\4007\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7865 mehr Seiten.

IE trusted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\google.com -> hxxps://www.google.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1242904208-471078349-2963378918-1000\...\1-2005-search.com -> www.1-2005-search.com

Da befinden sich 12656 mehr Seiten.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1242904208-471078349-2963378918-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\DDDD CCCC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: AAV UpdateService => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AgereModemAudio => 2
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Apple Mobile Device Service => 2
MSCONFIG\Services: Avira.ServiceHost => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BotkindSyncService => 2
MSCONFIG\Services: ePowerSvc => 2
MSCONFIG\Services: FoxitCloudUpdateService => 2
MSCONFIG\Services: Greg_Service => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: IAANTMON => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NoIPDUCService4 => 2
MSCONFIG\Services: NTI IScheduleSvc => 2
MSCONFIG\Services: NTIBackupSvc => 3
MSCONFIG\Services: NTISchedulerSvc => 2
MSCONFIG\Services: OODefragAgent => 2
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: PDF Architect Helper Service => 2
MSCONFIG\Services: PDF Architect Service => 2
MSCONFIG\Services: RS_Service => 2
MSCONFIG\Services: SandraAgentSrv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: TomTomHOMEService => 2
MSCONFIG\Services: TurboBoost => 3
MSCONFIG\Services: UNS => 2
MSCONFIG\Services: Updater Service => 2
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{F6B32B8C-EC0E-4B28-9287-B8C519D8E6A4}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{E9C7FC32-FF19-44FD-8635-A3BA8CD46B37}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{3A7E9C3E-D4C7-48C7-A391-916DE6E2496B}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [UDP Query User{ABF40A86-7B5D-4716-8585-0AF97F15FF48}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicator.exe
FirewallRules: [TCP Query User{46F06FB8-4B9E-4BF0-83DC-FBA66CDC6D60}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{7EE6B8EC-3BFF-4024-A5E1-9CA0CBE1D3CD}C:\program files (x86)\frostwire 5\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 5\frostwire.exe
FirewallRules: [TCP Query User{7704F62E-74F8-4D12-9FE4-7EA6AE97FDA0}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{10A2E470-BCA4-476F-82B8-E7D160C7559D}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{2701F01B-8DB1-44D8-BAEF-2FF0B9F93EDD}C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{BC63BC49-AEE1-4951-9DDE-0DFBE64087D7}C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A54A0D33-DF2F-49CB-8495-80AD34FE8F06}C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E75C2282-F4D3-4F6F-8301-ECCEDDF36668}C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\DDDD CCCC\appdata\roaming\spotify\spotify.exe
FirewallRules: [{48226463-F9DD-4B9B-83E7-3D5304D1B9CF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8FFE3C7D-5A93-4B41-B0F4-E325ED17CCDB}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [UDP Query User{E6C65721-F9E0-49EA-9A8D-95FFA2AEFC72}C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe] => (Allow) C:\program files (x86)\fontforge\bin\xming-6.9.0.31\xming.exe
FirewallRules: [TCP Query User{789C5BCF-BF2A-4E31-88CF-D6EFB5B1DF6D}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{19975A45-5B6C-42AC-9064-EA0F0A265577}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [TCP Query User{A2F9BF40-3393-4EC2-8DA0-420EF01F5993}C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{01EB00A5-90E5-4670-977B-0F28C0908837}C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{FCCC8F95-3F2A-4B10-875F-AD388712025D}C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{626DC18D-4E5B-4E02-B6A7-6EC7BF6BD3BD}C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\DDDD CCCC\appdata\local\akamai\netsession_win.exe
FirewallRules: [{DB0EC775-61B3-4D33-BF1B-DDD3C08A593F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{6CDC8BAB-AF8D-4FA9-A2AF-7859D699AA25}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2DD2C0FC-3533-4461-8312-FDD2047234E5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73717DCA-EC2F-4602-B416-A92D4B1B99DF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{7668C84C-C1E4-403B-BB83-EB4AACFA5A62}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{917F6B0F-9BD5-4274-90B7-1CF9BEA30EAA}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{14725361-11B8-4940-8660-7136E5159A03}] => (Allow) C:\Users\DDDD CCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F9EDFF34-0567-4CEA-BF90-323AAFB5D000}] => (Allow) C:\Users\DDDD CCCC\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{990EDDAD-40E9-4250-BA29-DCCBCC8822FB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{5C8B7C06-3841-4840-BD0D-313E742A4244}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{CC26E933-124D-4250-A618-B0269C603F01}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
FirewallRules: [{FA096118-978C-4F2F-AEEA-A2BDCBF1345A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F8384AD-2F6B-4B31-88C7-53EF69725ADE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{CECC61E8-3278-4175-9AF4-BDF8D8327F6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F274E59B-CCB4-4F79-904E-924A6A34FDD0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{6F272B60-B08E-4EF7-B0BC-884D722D3E80}] => (Allow) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\WNt500x64\RpcSandraSrv.exe
FirewallRules: [TCP Query User{429D326F-119D-42DE-9528-91755511646A}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [UDP Query User{377BF4C2-21A9-4FB1-8FE0-09E6115EA045}C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp deskjet 3070 b611 series\bin\hpnetworkcommunicatorcom.exe
FirewallRules: [{303F0A3A-B115-44F8-8751-D8EB368F329B}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8217D1D4-D0FD-41BB-8663-23F689A06660}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS25D4\HPDiagnosticCoreUI.exe
FirewallRules: [{6F8DFB34-DB3F-4955-A97D-7BEE7F52E424}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{3C4BA469-7267-437B-AD8B-7AC77EE65F1E}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS2F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EA0D240-4A70-4039-AAD5-A14B13CCED5D}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{AF2AF2CB-3771-44A7-88BC-A02A46E0F5AA}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS470A\HPDiagnosticCoreUI.exe
FirewallRules: [{F5E55556-ECA7-40D3-B2F0-570593F1B3F5}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{E5A8989A-886D-4ED6-9C7B-03A297C01F04}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS1D89\hppiw.exe
FirewallRules: [{61231B20-AE19-4104-BD42-59E5E8484A82}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0FF02937-71C3-4FD9-943E-5B8F638932CA}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{E23214BB-2D94-46BF-A2F2-593E6E4C3AE1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\DeviceSetup.exe
FirewallRules: [{FBC51609-58D2-41C3-8088-D41B714E1DD7}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{15C2C52F-DF67-4663-808F-3E4D9859AAA1}] => (Allow) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{96F570C0-0D0E-4C28-8C4B-8A038047177F}] => (Allow) LPort=1688
FirewallRules: [{69093685-5CA7-470B-9A69-A7A5F4C06DEB}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{9CADF699-7FBE-4AE5-9A2C-2FCA5D49FE6B}] => (Allow) C:\Users\DDDD CCCC\AppData\Local\Temp\7zS552E\hppiw.exe
FirewallRules: [{585AA0A3-FEAB-49EE-8D2A-6EE98CD9E875}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E14B1E9F-BDF7-48D5-A58D-69D940C69E9C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8667E163-0B78-401F-9C11-97AA00BD7EBB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3F81BC3A-0F0F-43D7-982C-DFA12A366C07}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AC5B506A-A443-46A1-B62C-1EAA0BF2ACBE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9DD0BC8F-FCCD-4949-B7C6-8657BE07FF54}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{532791CB-D66E-4800-8AAD-BA957B3BEA69}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA8B6329-656C-4DE8-B608-C1A7725A364E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B7E6E726-5025-494C-875B-C2B48E3DBB88}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2CBC7107-1D6F-430A-9B34-C20114A63FA4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/25/2015 05:27:54 PM) (Source: MsiInstaller) (EventID: 1023) (User: Arbeitscomputer)
Description: Produkt: Adobe Acrobat Reader DC - Deutsch - Update "{AC76BA86-7AD7-0000-2550-AC0F094E6F00}" konnte nicht installiert werden. Fehlercode 1625. Weitere Informationen sind in der Protokolldatei C:\Users\DANIEL~1\AppData\Local\Temp\MSI3f01e.LOG enthalten.

Error: (11/23/2015 07:43:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (11/20/2015 03:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RescueTime.exe, Version: 2.2.1.722, Zeitstempel: 0x4bbe0958
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000024
ID des fehlerhaften Prozesses: 0x9ac
Startzeit der fehlerhaften Anwendung: 0xRescueTime.exe0
Pfad der fehlerhaften Anwendung: RescueTime.exe1
Pfad des fehlerhaften Moduls: RescueTime.exe2
Berichtskennung: RescueTime.exe3

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6255

Error: (11/19/2015 02:00:29 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5226

Error: (11/19/2015 02:00:28 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/19/2015 02:00:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4212


Systemfehler:
=============
Error: (11/29/2015 02:19:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Indexdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Skype Click to Call PNR Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Skype Click to Call Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Apple Mobile Device Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/29/2015 02:19:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


CodeIntegrity:
===================================
  Date: 2015-11-28 15:41:30.713
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-28 15:41:30.588
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-28 15:41:30.463
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-28 15:41:30.338
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.304
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.163
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:53.007
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-11-21 20:22:52.867
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-07-28 21:30:24.923
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-28 21:30:24.917
  Description: Die Integrität der Datei "\Device\HarddiskVolume3\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 3956.5 MB
Verfügbarer physikalischer RAM: 2523.57 MB
Summe virtueller Speicher: 7911.21 MB
Verfügbarer virtueller Speicher: 6445.67 MB

==================== Laufwerke ================================

Drive c: (ACER) (Fixed) (Total:290.05 GB) (Free:83.18 GB) NTFS
Drive d: (DATA) (Fixed) (Total:290.4 GB) (Free:284.88 GB) NTFS
Drive f: () (Removable) (Total:1.84 GB) (Free:1.62 GB) FAT

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6D48B855)
Partition 1: (Not Active) - (Size=15.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=290.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=290.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================
So wie es aussieht, hat sich eigetlich in der Zwischenzeit nichts geändert.
Das heißt also, dass das System sauber ist?

Ich hab nun mal eine Startseite im Firefox eingestellt. Mal schauen, ob es schneller geht. Wenn ich den Notebook einschalte und gleich ins Internet gehe möchte.

schrauber 30.11.2015 07:55
Du hast von Securitycheck geredet, in dem Log von SC ist aber nix. Die Zeile kommt aus dem CF log und ist schon lange Geschichte :)

magigstar 30.11.2015 09:15
Sorry, ich kam da glaube ich durcheinander...
Bei diesem post, meinte ich den Report von unten (von SecurityCheck):

Zitat:
Zitat von magigstar (Beitrag 1539220)
Was ist mit den restlichen Ergebnissen?
Also ESET ist ja immer eindeutig.
Aber auch SecurityCheck hat seltsame Ergebnisse.

Code:
c:\windows\SysWow64\Drivers\atapi.sys . . . ist infiziert!!
Habe allerdings einen Teil vom ComboFix-Report im post kopiert.
Und später habe ich den vollständigen ComboFix-Report gepostet.


Zitat:
Zitat von magigstar (Beitrag 1538044)
Code:
Results of screen317's Security Check version 1.009 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
  (On Access scanning disabled!)
 Error obtaining update status for antivirus! 
`````````Anti-malware/Other Utilities Check:`````````
 SpywareBlaster 5.0   
 Java 8 Update 66 
 Java version 32-bit out of Date!
 Adobe Flash Player 19.0.0.245 
 Mozilla Firefox (42.0)
 Google Chrome (46.0.2490.80)
 Google Chrome (46.0.2490.86)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 WinPatrol winpatrol.exe
 BillP Studios WinPatrol WinPatrol.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````


EDIT: Und wie ich gerade sehe, meinst Du das auch so... :-)

Ist nicht die Java-Version veraltet? Zumindest weist doch SC daraufhin, oder?
Ist atapi.sys nicht wichtig?

schrauber 01.12.2015 12:45
Nö, 66 ist die aktuelle Version, ist ein Fehler in SC.

Noch Probleme oder können wir aufräumen? :)

magigstar 01.12.2015 17:00
Ne, sieht eigentlich ganz gut aus.
Dachte, dass der Notebook Probleme beim Start hätte.
Aber nun nicht mehr. Hatte vielleicht mit einigen Programmen zu tun, die mit starten.

Sandboxie habe ich neu installiert und nun kommt kein bluescreen mehr bzw. der Notebook stürtzt nicht mehr ab.
Mit Sandboxie kann ich eventuell das Problem von Malware "eingrenzen".

schrauber 02.12.2015 16:22
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren .
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.pngAbsicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:
http://filepony.de/icon/emsisoft_anti_malware.png
Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:04 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2026, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132