Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   MPC Cleaner lässt sich nicht entfernen (https://www.trojaner-board.de/176733-mpc-cleaner-laesst-entfernen.html)

Infiziert16 24.03.2016 08:57

Weiter FRST.txt

Code:

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-03-09 11:49 - 2016-03-23 16:25 - 0001035 _____ () C:\Users\Susanne\AppData\Roaming\SAS7_000.DAT
2015-11-20 11:01 - 2015-11-20 11:01 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Einige Dateien in TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\0NPZDBEQSA.exe
C:\Users\Susanne\AppData\Local\Temp\103F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\105D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\110B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1149.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\11D7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1205.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\127.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1294.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1360.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\140A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\140D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\14D6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\14E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\156.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1592.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\15B5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\166E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1681.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\173D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\17C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\17FA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\18A3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\18D5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\195F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1A2B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1AE8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1BA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1C70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1D4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1DE7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1E09.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1E4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1EA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1ED5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1F70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1FA1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\202C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\206D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\20F9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2129.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\213.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\21C5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\21F6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2281.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\22F1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\234D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\23AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\240A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\245A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\24D6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2526.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2592.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\25D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\264F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\269F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\271B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\276B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\27D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2828.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2894.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\28E4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2960.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\29A1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A1D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A6D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2AE9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2B58.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2BA5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2C24.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2C62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2D00.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2D2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2DBD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2DFA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2E79.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2EA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2F45.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2F73.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3011.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3030.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\30EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\30ED.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\31A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\31C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3265.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3285.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3331.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3342.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\33EE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\340E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\34AA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\34CA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3567.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3577.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3633.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3643.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\36FF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3710.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\37AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\37EB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3878.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38B7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3934.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3974.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3A01.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3A30.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3ACD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3B2B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3B89.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3C75.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3D40.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3D41.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3DEE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3E0C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3EC9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3EF7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3F86.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3FD3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4052.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\408F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\40FF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\416B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4180.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\41CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4228.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4297.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4313.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4344.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4410.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\448.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\449.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\44AA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\453A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4586.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4606.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4643.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4672.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\472E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\474F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4825.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\482B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4839.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\48E7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\48F5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\49B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\49D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4A8F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4B49.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4B5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4C15.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4C37.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4D13.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4D4E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4DC0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4E8C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4ED7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4F39.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4F5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5005.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\505F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\50C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\513A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\517E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\524A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5274.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5307.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5330.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\53D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\53FD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\542F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\548F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\54C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\554C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5551.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\55C4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5608.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5690.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\56D4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\575C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5791.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5838.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\585D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5923.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5977.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\59EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5A2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5A53.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5AEA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5B0F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5BFB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5C33.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5DBB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5E97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5F63.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5F76.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\601F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6062.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\60EB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\612E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\61B8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\61EA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6284.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\62A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6350.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\63D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\641C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\64AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\64E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6579.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\65B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6654.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6671.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\66E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6711.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\673D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\67E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\683B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6876.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\68FD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6907.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6942.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\69C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6A0F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6A80.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6B4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6B97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6C28.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6C54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6CF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6D2F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6E1E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6EC8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6F38.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6FA3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7004.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\707F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\70C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\715B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\719C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7208.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7259.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7325.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\73A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\73B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7401.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\746A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\74EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7536.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\75A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7602.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7675.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\76DE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\779B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\77CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7867.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\78E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7933.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\79B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\79EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7A70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7B7B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7B88.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7C47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7C54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7D13.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7D20.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7DD0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7DEC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7E7D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7ED1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7F35.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7F49.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8005.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\806.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\808E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\80D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\816A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\817.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\81CC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\81FE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8236.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82E9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8394.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\83CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8460.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\848B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\852C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8547.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\857B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\85E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8623.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8637.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\86A5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\86EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8703.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8771.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\87CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\87CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\882D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\888C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8897.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\88EA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8968.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\89A6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\89F0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8A24.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8A53.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8AF0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8B1F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BBC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BEC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C73.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C79.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8CF6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D3F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D45.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8DC2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E8E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F6A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8FD3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9017.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9026.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\908F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\90F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\90F3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\915B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\91AF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\91BF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9237.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\927B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\928B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9303.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9338.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9357.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\93DF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9404.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9427.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\94BB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\94D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9587.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\958D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9627.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9649.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9653.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\96F3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9706.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\972F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97BF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97C2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97FB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\987F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\988B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\98C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\98E9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9957.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\995A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9993.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\99F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A14.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A46.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A6F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9AE0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9B12.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9B4A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9BAC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9BEE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9C26.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9C68.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9CAA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D25.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D67.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9DDE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9DF1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9E23.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EB9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EBD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EE0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9F7A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9F95.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9FAC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A036.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A068.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A081.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A102.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A125.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A15C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A1CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A201.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A248.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A27B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A2BD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A323.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A347.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A36A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A3C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A3F0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A404.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A436.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A4CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A4D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A512.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A58C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A5A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A5CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A623.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A649.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A673.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A69A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A734.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A73F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A757.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A7B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A7F1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A81B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A823.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8E0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8E7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A979.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A9AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A9C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AA36.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AA87.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AAFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AB02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AB54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ABBF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ABC9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AC10.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AC8B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ACA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ACCD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AcerPortalSetup.exe
C:\Users\Susanne\AppData\Local\Temp\AD66.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AD80.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AD99.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE33.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE84.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AEFF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF28.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF3D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF50.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AFDA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AFF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\avgnt.exe
C:\Users\Susanne\AppData\Local\Temp\B00D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B08.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B0B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B0C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B18C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B195.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B24C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B252.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B268.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B30E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B328.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B334.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B3DA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B400.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B414.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B5B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B616.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B648.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B67D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B6E2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B705.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B73A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7CD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7F6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B89D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B8A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B8D2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B959.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B98F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B9D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA6A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA9F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BAC3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB46.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB6B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC22.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC6B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD0D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD37.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD42.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BDBA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE03.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE1D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE96.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BEF9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BF72.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BF8A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BFF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BingSvc.exe
C:\Users\Susanne\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Susanne\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Susanne\AppData\Local\Temp\C03E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C066.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C0B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C10A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C142.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C17D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C1C6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C21E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C249.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C292.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C309.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C325.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C35F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C3D5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C41B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C420.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C4B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C4D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C50B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C51.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C58D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C5A4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C5B8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C659.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C670.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C684.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C715.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C73C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C750.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C7D2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C808.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C81C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C89E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C8D4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C908.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C95A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C9E3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C9FE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CA27.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CAB0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CACA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CB02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CB87.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CBCE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CBF9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CC62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CCB5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CCBA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD4E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD72.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD76.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE0A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE42.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CED6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CEDB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CEFF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CFA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CFBB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D054.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D078.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D120.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D134.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D1DD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D201.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D299.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D2D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D32A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D3F7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D450.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D4B3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D54B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D570.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D617.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D64B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D6D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D708.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D790.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D7C4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D881.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D88B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D947.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D94D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DA09.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DABF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DAF5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DBC1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DBCA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DC8D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DCA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DD4A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DD62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DDB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DE16.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DF40.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DF48.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DFFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E014.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E08.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E136.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E1CA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E1F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E2AF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E2C5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E391.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E3D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E495.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E580.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E67B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E738.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E7A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E875.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E881.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E932.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E94D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E9EE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EA19.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EAAB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EAE5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EBA2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EBF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EC5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EC6E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ECB0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ED3A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ED6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EDDA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EE06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EE8F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EEA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EEE2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EF63.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EF9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F01F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F05B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F13A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F1F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F215.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F2BE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F2E2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F38A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F466.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F523.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F5EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F786.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F803.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F82.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F8CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F8E0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F98C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F9AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FA1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FA97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FAA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FB54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FB62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FC20.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FC2F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FCEB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FCFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FDA8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FDD7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FE64.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FE94.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FF21.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FF9F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FFDD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\McCSPInstall.dll
C:\Users\Susanne\AppData\Local\Temp\mccspuninstall.exe
C:\Users\Susanne\AppData\Local\Temp\oct48D7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\oct49E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\octA62E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-03-23 13:54

==================== Ende von FRST.txt ============================

Addition.txt

Code:

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-03-09 11:49 - 2016-03-23 16:25 - 0001035 _____ () C:\Users\Susanne\AppData\Roaming\SAS7_000.DAT
2015-11-20 11:01 - 2015-11-20 11:01 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Einige Dateien in TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\0NPZDBEQSA.exe
C:\Users\Susanne\AppData\Local\Temp\103F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\105D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\110B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1149.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\11D7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1205.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\127.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1294.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1360.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\140A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\140D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\14D6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\14E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\156.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1592.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\15B5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\166E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1681.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\173D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\17C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\17FA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\18A3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\18D5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\195F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1A2B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1AE8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1BA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1C70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1D4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1DE7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1E09.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1E4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1EA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1ED5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1F70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\1FA1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\202C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\206D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\20F9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2129.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\213.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\21C5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\21F6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2281.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\22F1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\234D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\23AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\240A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\245A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\24D6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2526.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2592.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\25D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\264F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\269F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\271B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\276B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\27D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2828.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2894.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\28E4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2960.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\29A1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A1D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2A6D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2AE9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2B58.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2BA5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2C24.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2C62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2D00.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2D2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2DBD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2DFA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2E79.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2EA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2F45.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\2F73.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3011.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3030.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\30EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\30ED.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\31A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\31C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3265.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3285.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3331.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3342.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\33EE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\340E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\34AA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\34CA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3567.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3577.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3633.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3643.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\36FF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3710.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\37AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\37EB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3878.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38B7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\38D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3934.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3974.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3A01.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3A30.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3ACD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3B2B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3B89.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3C75.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3D40.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3D41.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3DEE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3E0C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3EC9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3EF7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3F86.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\3FD3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4052.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\408F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\40FF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\416B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4180.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\41CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4228.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4297.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4313.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4344.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4410.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\448.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\449.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\44AA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\453A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4586.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4606.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4643.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4672.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\472E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\474F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4825.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\482B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4839.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\48E7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\48F5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\49B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\49D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4A8F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4B49.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4B5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4C15.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4C37.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4D13.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4D4E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4DC0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4E8C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4ED7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4F39.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\4F5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5005.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\505F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\50C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\513A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\517E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\524A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5274.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5307.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5330.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\53D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\53FD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\542F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\548F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\54C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\554C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5551.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\55C4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5608.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5690.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\56D4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\575C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5791.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5838.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\585D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5923.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5977.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\59EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5A2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5A53.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5AEA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5B0F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5BFB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5C33.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5DBB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5E97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5F63.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\5F76.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\601F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6062.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\60EB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\612E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\61B8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\61EA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6284.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\62A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6350.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\63D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\641C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\64AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\64E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6579.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\65B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6654.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6671.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\66E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6711.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\673D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\67E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\683B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6876.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\68FD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6907.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6942.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\69C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6A0F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6A80.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6B4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6B97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6C28.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6C54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6CF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6D2F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6E1E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6EC8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6F38.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\6FA3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7004.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\707F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\70C1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\715B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\719C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7208.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7259.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7325.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\73A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\73B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7401.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\746A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\74EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7536.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\75A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7602.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7675.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\76DE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\779B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\77CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7867.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\78E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7933.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\79B4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\79EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7A70.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7B7B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7B88.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7C47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7C54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7D13.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7D20.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7DD0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7DEC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7E7D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7ED1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7F35.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\7F49.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8005.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\806.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\808E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\80D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\816A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\817.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\81CC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\81FE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8236.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82E9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\82F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8394.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\83CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8460.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\848B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\852C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8547.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\857B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\85E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8623.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8637.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\86A5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\86EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8703.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8771.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\87CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\87CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\882D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\888C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8897.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\88EA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8968.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\89A6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\89F0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8A24.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8A53.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8ACB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8AF0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8B1F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BBC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8BEC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C73.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8C79.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8CF6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D3F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8D45.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8DC2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E0B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E8E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8E9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F5B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8F6A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\8FD3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9017.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9026.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\908F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\90F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\90F3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\915B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\91AF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\91BF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9237.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\927B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\928B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9303.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9338.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9357.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\93DF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9404.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9427.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\94BB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\94D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9587.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\958D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9627.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9649.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9653.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\96F3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9706.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\972F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97BF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97C2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\97FB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\987F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\988B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\98C7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\98E9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9957.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\995A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9993.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\99F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A14.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A46.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9A6F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9AE0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9B12.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9B4A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9BAC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9BEE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9C26.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9C68.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9CAA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D25.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9D67.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9DDE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9DF1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9E23.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EB9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EBD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9EE0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9F7A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9F95.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\9FAC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A036.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A068.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A081.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A102.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A125.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A15C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A1CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A201.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A248.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A27B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A2BD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A323.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A347.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A36A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A3C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A3F0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A404.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A436.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A4CB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A4D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A512.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A58C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A5A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A5CE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A623.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A649.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A673.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A69A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A734.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A73F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A757.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A7B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A7F1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A81B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A823.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8AD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8E0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A8E7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A979.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A9AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\A9C3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AA36.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AA87.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AAFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AB02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AB54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ABBF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ABC9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AC10.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AC8B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ACA4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ACCD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AcerPortalSetup.exe
C:\Users\Susanne\AppData\Local\Temp\AD66.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AD80.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AD99.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE33.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE4C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AE84.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AEFF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF28.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF3D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AF50.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AFDA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\AFF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\avgnt.exe
C:\Users\Susanne\AppData\Local\Temp\B00D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B08.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B0B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B0C9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B18C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B195.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B24C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B252.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B268.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B30E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B328.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B334.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B3DA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B400.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B414.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4A7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4D0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B4EC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B5B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B616.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B648.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B67D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B6E2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B705.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B73A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7CD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7D1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B7F6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B89D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B8A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B8D2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B959.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B98F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\B9D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA6A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BA9F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BAC3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB46.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB6B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BB9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC22.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC47.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BC6B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD0D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD37.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BD42.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BDBA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE03.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE1D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BE96.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BEF9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BF72.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BF8A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BFF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\BingSvc.exe
C:\Users\Susanne\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Susanne\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Susanne\AppData\Local\Temp\C03E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C066.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C0B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C10A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C142.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C17D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C1C6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C21E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C249.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C292.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C309.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C325.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C35F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C3D5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C41B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C420.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C4B1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C4D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C50B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C51.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C58D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C5A4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C5B8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C659.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C670.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C684.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C715.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C73C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C750.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C7D2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C808.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C81C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C89E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C8D4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C908.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C95A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C9E3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\C9FE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CA27.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CAB0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CACA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CB02.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CB87.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CBCE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CBF9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CC62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CCB5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CCBA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD4E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD72.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CD76.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE0A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CE42.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CED6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CEDB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CEFF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CFA7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\CFBB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D054.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D078.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D120.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D134.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D1DD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D201.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D299.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D2D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D2E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D32A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D3F7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D450.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D4B3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D54B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D570.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D617.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D64B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D6D3.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D708.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D790.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D7C4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D881.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D88B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D947.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\D94D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DA09.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DABF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DAF5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DBC1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DBCA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DC8D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DCA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DD4A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DD62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DDB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DE16.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DF40.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DF48.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\DFFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E014.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E08.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E136.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E1CA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E1F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E2AF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E2C5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E391.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E3D8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E495.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E580.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E67B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E738.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E7A9.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E875.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E881.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E932.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E94D.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\E9EE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EA19.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EAAB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EAE5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EBA2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EBF4.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EC5.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EC6E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ECB0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ED3A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\ED6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EDDA.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EE06.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EE8F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EEA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EEE2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EF63.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\EF9E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F01F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F05B.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F13A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F1F2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F215.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F2BE.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F2E2.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F38A.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F466.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F523.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F5EF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F786.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F803.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F82.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F8CF.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F8E0.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F98C.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\F9AC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FA1.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FA97.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FAA6.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FB54.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FB62.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FC20.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FC2F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FCEB.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FCFC.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FDA8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FDD7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FE64.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FE94.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FF21.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FF9F.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\FFDD.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\McCSPInstall.dll
C:\Users\Susanne\AppData\Local\Temp\mccspuninstall.exe
C:\Users\Susanne\AppData\Local\Temp\oct48D7.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\oct49E8.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\octA62E.tmp.exe
C:\Users\Susanne\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-03-23 13:54

==================== Ende von FRST.txt ============================


cosinus 24.03.2016 09:37

Log von JRT fehlt

Infiziert16 24.03.2016 09:45

Sorry.

JRT.txt

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 10 Home x64
Ran by Susanne (Administrator) on 24.03.2016 at  9:40:33,87
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 5

Failed to delete: C:\ProgramData\pdfforge (Folder)
Successfully deleted: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi (File)
Successfully deleted: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\trovi.xml (File)
Successfully deleted: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\Web Search.xml (File)
Successfully deleted: C:\Windows\prefetch\AVIRA_FREE_ANTIVIRUS141_DE.EX-F5E62DD7.pf (File)

Deleted the following from C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\1rpc1w7u.default\prefs.js
user_pref(browser.urlbar.suggest.searches, true);



Registry: 6

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\win_en_77 (Registry Value)
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\PCSUUCDRV (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{F5F9F0DE-7D1F-4055-908E-0B1F2199753C} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38279E1A-7019-40C1-B579-E99DFB3312E8} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38279E1A-7019-40C1-B579-E99DFB3312E8} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{23FD9C33-A9E1-48A1-8404-E5925CF1C8E1} (Registry Value)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.03.2016 at  9:42:14,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


cosinus 24.03.2016 09:52

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Untersuchen klicken.

http://www.trojaner-board.de/picture...&pictureid=611

Infiziert16 24.03.2016 09:57

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
durchgeführt von Susanne (2016-03-24 09:55:52)
Gestartet von C:\Users\Susanne\Desktop
Windows 10 Home (X64) (2016-02-27 01:32:28)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-2477115574-1701539732-1998124351-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2477115574-1701539732-1998124351-503 - Limited - Disabled)
Gast (S-1-5-21-2477115574-1701539732-1998124351-501 - Limited - Disabled)
Susanne (S-1-5-21-2477115574-1701539732-1998124351-1001 - Administrator - Enabled) => C:\Users\Susanne

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

12 Labours of Hercules III: Girl Power (x32 Version: 3.0.2.118 - WildTangent) Hidden
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.03.2003 - Acer Incorporated)
abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 3.06.2000.22 - Acer Incorporated)
Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3005 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3001 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.09.2002 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8109 - Acer Incorporated)
Acer Quick Access (HKLM\...\{E3678E72-78E3-4F91-A9FB-913876FF6DA2}) (Version: 2.00.3008 - Acer Incorporated)
Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 2.01.3002 - Acer Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.15.2000.1 - Acer Incorporated)
App Explorer (HKU\S-1-5-21-2477115574-1701539732-1998124351-1001\...\Host App Service) (Version: 0.271.1.403 - SweetLabs)
Autostart-Manager (HKLM-x32\...\{E0D34E99-B4E5-481D-A1A7-27BE957F5167}) (Version: 6.04.0000 - Wirth IT Design )
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5427.02 - CyberLink Corp.)
Dragon NaturallySpeaking 13 (HKLM-x32\...\{33EA20FB-5389-4938-BA59-2BCD9BB68F41}) (Version: 13.00.000 - Nuance Communications Inc.)
DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3011 - Acer Incorporated)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.16.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
Foxit PhantomPDF (HKLM-x32\...\{A4023BDF-82D5-412D-9D58-8C2819EBFE2E}) (Version: 7.0.410.326 - Foxit Software Inc.)
Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 13.0.0.6 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 13.0.0.6 - WildTangent, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Home Makeover (x32 Version: 3.0.2.59 - WildTangent) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1153 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.15.4268 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.0.1081 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.253.0 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Match Snowscapes (x32 Version: 3.0.2.118 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.97 - WildTangent) Hidden
Manager (x32 Version: 4.0.1.25166 - 2015 pdfforge GmbH. All rights reserved) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 45.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 en-US)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
OpenOffice 4.1.2 (HKLM-x32\...\{F5CAB1AF-7B1A-4CEC-B829-A3F699473AE1}) (Version: 4.12.9782 - Apache Software Foundation)
PDF Architect 4 (HKLM-x32\...\PDF Architect 4) (Version: 4.0.34.26215 - pdfforge GmbH)
PDF Architect 4 Create Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden
PDF Architect 4 Edit Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden
PDF Architect 4 View Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.2.2 - pdfforge)
Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden
Qualcomm Atheros QCA9377 Wireless LAN & Bluetooth Installer (HKLM-x32\...\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.067 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7553 - Realtek Semiconductor Corp.)
Rory's Restaurant (x32 Version: 3.0.2.126 - WildTangent) Hidden
Runefall (x32 Version: 3.0.2.126 - WildTangent) Hidden
Skype™ 7.21 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vegas World (x32 Version: 13.0.0.6 - WildTangent) Hidden
Villagers and Heroes (x32 Version: 13.0.0.6 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.11.16 - WildTangent) Hidden
WildTangent Games App (x32 Version: 4.1.1.8 - WildTangent) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-2477115574-1701539732-1998124351-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Susanne\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\FileCoAuth.exe (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0291517A-ADC9-4890-94B3-F5D11BDA8B4B} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2016-01-14] (Acer Incorporated)
Task: {400DCB6D-B12F-428F-ABF6-25DDE86CA46B} - System32\Tasks\FUBTrackingByPLD => C:\OEM\Preload\FubTracking\FubTracking.exe [2015-05-14] ()
Task: {41F824CA-8126-46F6-8589-0A201DC1FA6F} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-03-09] (Dropbox, Inc.)
Task: {4AF95F03-4CAD-4E9F-8E2E-36075A783D99} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-28] (Google Inc.)
Task: {4F117C79-2706-4FBF-A748-C0259F51CEFA} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2015-09-04] (Acer Incorporated)
Task: {6A1AECEC-0766-473B-AE79-EAAA31DE758F} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2015-07-10] ()
Task: {6A250F7B-4F8A-4FEA-8CAE-31F28DA85202} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [2015-07-10] ()
Task: {85285946-FCED-43C1-859E-C1FE679B81CE} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2015-05-14] (Acer Incorporated)
Task: {86B3CB6C-402E-454E-B7A4-B6D6C8EB60FA} - System32\Tasks\App Explorer => C:\Users\Susanne\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2016-03-11] (SweetLabs, Inc)
Task: {882F4B4B-9BE7-424D-A203-D0F67719B1F8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-28] (Google Inc.)
Task: {93C99DC9-B400-40D5-A6DF-4310EAF3F1A6} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2015-04-30] (AVAST Software)
Task: {AB15F7B9-3F16-456C-AED2-CAEB09090E32} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Power Management\ePowerButton_NB.exe [2015-05-14] (Acer Incorporated)
Task: {B3A682EC-386B-4A48-A19C-5D208B7DC13E} - System32\Tasks\CreateExplorerShellUnelevatedTask => /NOUACCHECK
Task: {B9F5CEF5-54D1-4EE9-A26D-8D280ABE2D25} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2016-01-19] (Acer)
Task: {C905BBF2-F276-4946-929D-A612EFFFC343} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation)
Task: {D4F39899-6417-43E0-963F-D3A3BF9AB9A7} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-09-04] (Acer Incorporated)
Task: {D580BF3C-83CE-4E6B-B1A1-20EB95353BC4} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-13] (TODO: <Company name>)
Task: {D7FD2D15-FB9E-480C-A442-4F941D160320} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-03-09] (Dropbox, Inc.)
Task: {DAB41F47-25BA-4E2A-8E0C-4844D9D3C4A1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-03-09] (Microsoft Corporation)
Task: {E0C21389-EC01-402F-A776-C3731FA73825} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2015-04-30] (AVAST Software)
Task: {FBE1992D-A1B2-44DD-9601-A1A2F799B096} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2015-07-10] ()

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-11-20 19:23 - 2015-11-20 19:23 - 00032768 _____ () C:\Windows\SYSTEM32\licensemanagerapi.dll
2015-11-20 19:23 - 2015-11-20 19:23 - 00404480 _____ () C:\Windows\System32\diagtrack_wininternal.dll
2015-08-31 11:50 - 2015-04-30 01:04 - 00445240 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
2016-02-28 08:44 - 2015-09-17 07:48 - 02494712 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-02-28 08:44 - 2015-09-17 07:48 - 02494712 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-02-28 08:43 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-02-28 08:44 - 2015-11-25 05:20 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-02-28 08:44 - 2015-11-25 05:17 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-02-28 08:44 - 2015-11-25 05:17 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-02-28 08:44 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-06-24 01:07 - 2015-06-24 01:07 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Temp:0FF263E8 [548]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\amazon.com -> amazon.com
IE trusted site: HKU\.DEFAULT\...\amazon.de -> hxxps://amazon.de
IE trusted site: HKU\S-1-5-21-2477115574-1701539732-1998124351-1001\...\amazon.de -> hxxps://amazon.de

==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2015-07-10 12:04 - 2016-02-28 18:43 - 00000967 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      down.baidu2016.com
127.0.0.1      123.sogou.com
127.0.0.1      www.czzsyzgm.com
127.0.0.1      www.czzsyzxl.com

==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-2477115574-1701539732-1998124351-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Acer01.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{91692DC0-BF42-45CE-82A5-6E667F038C2E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DA225F5C-C571-418A-9132-30223D45C585}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{227DE642-B4A4-40DB-B65D-741AF59B20FE}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{153D9351-68F9-4CE6-AE66-5419EB374260}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{D1449E72-5288-4FF3-88B1-34F6AC527BFF}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{05EBF720-9C08-4032-9F83-DDB35AB3D67E}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{9374E55F-F31F-454E-8D92-4D68414A5ACB}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{BA76611A-53EA-4E98-9240-01D77C34D7E0}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{45443C93-E541-41BB-9502-672F40AEFFE1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{F7B7B3E5-EA02-428E-B068-37A3BF5E830D}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{75669CFA-EBD6-4AF2-8EDB-6077B6B53D17}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{EE98714F-FFA3-46B2-B6D0-F086D939D2BC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{75DC015D-F7D6-4152-9FDF-038DE22FD3BE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{E89C100D-8BA5-4C8C-9E7B-D812A535FB0E}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{795B88F5-2F99-47B6-9AFE-4B2CA6587E81}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{C54F60D7-E4CC-4AB2-BF8E-7A6EE2F002F8}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{A8593181-F401-464F-B743-899DFD183587}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{A794FE14-0806-42E7-A923-6945BE8AF4FA}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{1B0D6997-AE85-4623-9600-D9EEB4196177}] => (Allow) LPort=51001
FirewallRules: [{85F9E250-7CBD-4EC3-9106-3C7982395946}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{A7B1DAD4-CD3F-4928-B614-93926475E314}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{B55CA5B1-6412-4B03-9CBF-21EAE2A160BD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

==================== Wiederherstellungspunkte =========================

23-03-2016 14:03:46 Windows Update
23-03-2016 15:27:27 Malwarebytes Anti-Rootkit Restore Point
23-03-2016 16:55:30 Malwarebytes Anti-Rootkit Restore Point
24-03-2016 09:40:34 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/24/2016 09:40:41 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (03/24/2016 09:40:22 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP-82HIVNU6)
Description: Bei der Aktivierung der App „9E2F88E3.Twitter_wgeqdkkx372wm!x554f661dyd360y462cy8743yf8a99b7d41dbx“ ist folgender Fehler aufgetreten: -2147024770. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/23/2016 10:16:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP-82HIVNU6)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/23/2016 10:16:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP-82HIVNU6)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/23/2016 08:19:09 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP-82HIVNU6)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/23/2016 04:56:11 PM) (Source: DNS logging) (EventID: 0) (User: )
Description: Logger: Socket error: 10054

Error: (03/23/2016 04:55:37 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (03/23/2016 04:52:31 PM) (Source: DNS logging) (EventID: 0) (User: )
Description: Logger: Socket error: 10054

Error: (03/23/2016 04:52:29 PM) (Source: DNS logging) (EventID: 0) (User: )
Description: Logger: Socket error: 10054

Error: (03/23/2016 04:25:24 PM) (Source: DNS logging) (EventID: 0) (User: )
Description: Logger: Socket error: 10054


Systemfehler:
=============
Error: (03/24/2016 08:51:33 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {B91D5831-B1BD-4608-8198-D72E155020F7}

Error: (03/24/2016 08:45:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (03/24/2016 08:44:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Synchronisierungshost_Session2" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/24/2016 08:44:12 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PDF Architect 4" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "User Experience Improvement Program" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Security Assist" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "GamesAppIntegrationService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/24/2016 08:43:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ePower Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


CodeIntegrity:
===================================
  Date: 2016-03-23 14:35:41.551
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.523
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.454
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.439
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.308
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.295
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.268
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.255
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.222
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-03-23 14:35:41.209
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-4210U CPU @ 1.70GHz
Prozentuale Nutzung des RAM: 23%
Installierter physikalischer RAM: 8113.32 MB
Verfügbarer physikalischer RAM: 6177.19 MB
Summe virtueller Speicher: 16817.32 MB
Verfügbarer virtueller Speicher: 15019.93 MB

==================== Laufwerke ================================

Drive c: (Acer) (Fixed) (Total:930.91 GB) (Free:875.18 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: BABCDC06)

Partition: GPT.

==================== Ende von Addition.txt ============================


cosinus 24.03.2016 10:07

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM-x32\...\Run: [win_en_77] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei
FF NewTab: about:newtab
AlternateDataStreams: C:\ProgramData\Temp:0FF263E8 [548]
hosts:
emptytemp:


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Infiziert16 24.03.2016 11:55

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
durchgeführt von Susanne (2016-03-24 11:46:57) Run:1
Gestartet von C:\Users\Susanne\Desktop
Geladene Profile: Susanne (Verfügbare Profile: Susanne)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
HKLM-x32\...\Run: [win_en_77] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei
FF NewTab: about:newtab
AlternateDataStreams: C:\ProgramData\Temp:0FF263E8 [548]
hosts:
emptytemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\win_en_77 => Wert nicht gefunden.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => Schlüssel nicht gefunden.
Firefox "newtab" erfolgreich entfernt
C:\ProgramData\Temp => ":0FF263E8" ADS erfolgreich entfernt.
C:\Windows\System32\Drivers\etc\hosts => erfolgreich verschoben
Hosts erfolgreich wiederhergestellt.
EmptyTemp: => 2.3 GB temporäre Dateien entfernt.


Das System musste neu gestartet werden.

==== Ende von Fixlog 11:50:19 ====


cosinus 24.03.2016 11:59

Okay, dann Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte:


1. Schritt: MBAM

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




2. Schritt: ESET

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




3. Schritt: SecurityCheck

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

Infiziert16 24.03.2016 12:25

Code:

Malwarebytes Anti-Malware
www.malwarebytes.org


Update, 24.03.2016 12:03, SYSTEM, LAPTOP-82HIVNU6, Manual, Rootkit Database, 2016.2.8.1, 2016.3.12.1,
Update, 24.03.2016 12:03, SYSTEM, LAPTOP-82HIVNU6, Manual, Remediation Database, 2016.2.12.1, 2016.3.18.1,
Update, 24.03.2016 12:03, SYSTEM, LAPTOP-82HIVNU6, Manual, Domain Database, 2016.2.16.8, 2016.3.23.8,
Update, 24.03.2016 12:03, SYSTEM, LAPTOP-82HIVNU6, Manual, IP Database, 2016.2.8.1, 2016.3.21.3,
Update, 24.03.2016 12:03, SYSTEM, LAPTOP-82HIVNU6, Manual, Malware Database, 2016.2.16.6, 2016.3.24.2,

(end)


cosinus 24.03.2016 12:28

poste bitte das richtige Log von MBAM

Infiziert16 24.03.2016 13:50

Er bietet mir nur ein Schutzprotokoll an.

log.txt

Code:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=da41df42449e0840a20fde7be02e1bdb
# end=init
# utc_time=2016-03-24 11:26:30
# local_time=2016-03-24 12:26:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 28736
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=da41df42449e0840a20fde7be02e1bdb
# end=updated
# utc_time=2016-03-24 11:36:16
# local_time=2016-03-24 12:36:16 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=da41df42449e0840a20fde7be02e1bdb
# engine=28736
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-03-24 12:43:06
# local_time=2016-03-24 01:43:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 20817 22297398 0 0
# scanned=170339
# found=5
# cleaned=0
# scan_time=4009
sh=06016E1D51521E52E98E3195AC021D61AC3F5156 ft=1 fh=6ddffeee52663c62 vn="Variante von Win32/ELEX.HI evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\SearchesToYesbnd\bugreport.exe.vir"
sh=47A25602A2172CF3A2E1CC54703A2E9F7DF41112 ft=1 fh=8df17d7a5e89b937 vn="Variante von Win32/ELEX.HH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\WinTaske\WinTaske\WinTaske.exe.vir"
sh=48EDCB782728D189F2C5CA243E666685C0E87A1C ft=1 fh=0ee125dee523cd73 vn="möglicherweise unbekannter Virus NewHeur_PE Virus" ac=I fn="C:\OEM\Preload\APP\PERSONIFY\Preinstalled.Personify.2.10.5.3.-.Setup.exe"
sh=C233CEC24528E16A5A1C39572293A0433817F478 ft=1 fh=f324c5f6628935c4 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe"
sh=148BC745CB91B9DFDD09FF955DCE01CA6DC10F5A ft=1 fh=cce6864c1bf4fbda vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\Downloads\PDFCreator-2_2_2-setup.exe"

checkup.txt

Code:

Results of screen317's Security Check version 1.009 
  x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Windows Defender 
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Flash Player        20.0.0.306 
 Mozilla Firefox (45.0.1)
 Google Chrome (48.0.2564.116)
 Google Chrome (49.0.2623.87)
````````Process Check: objlist.exe by Laurent```````` 
 Windows Defender MSMpEng.exe
 Malwarebytes Anti-Malware mbam.exe 
 Windows Defender MpCmdRun.exe 
 AVAST Software SecureLine VpnSvc.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````


cosinus 24.03.2016 14:11

Dann hast du da irgendwas falsch gemacht. Gab es denn Funde?

Infiziert16 24.03.2016 14:25

Zitat:

Zitat von cosinus (Beitrag 1573329)
Dann hast du da irgendwas falsch gemacht. Gab es denn Funde?

Ja, es gab mehrere Funde. Ich bin den Schritten gefolgt und habe den PC dann neu gestartet.

Soll ich es noch einmal machen?

cosinus 24.03.2016 14:40

Malwarebytes Anti-Malware Logfile finden - Anleitungen

Infiziert16 24.03.2016 14:50

Zitat:

Zitat von cosinus (Beitrag 1573335)
Malwarebytes Anti-Malware Logfile finden - Anleitungen

Das habe ich extra gelesen, aber es erscheint nur das:

http://up.picr.de/24969403bk.jpg


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:05 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130