Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Nach Adware Angriff,Hijack.Host (https://www.trojaner-board.de/185076-adware-angriff-hijack-host.html)

MrKaru 06.04.2017 08:39
Nach Adware Angriff,Hijack.Host
 
Guten Morgen,
Das ist mein erstes mal hier, also hoffe ich mal das ich nichts falsch mache.
Ich hatte vor kurzem eine sehr nervige Adware auf meinem PC,die nicht nur
überall Werbung angezeigt hat und all meine Browser abstürzen lassen hat,sondern
anscheinend (so sagt es mir Windows jedenfalls) mein Windows Defender per Grupp-
enrichtlinien abgeschaltet hat und immer noch abgeschaltet ist da ich es nicht gebacken kriege sie wieder anzustellen.
Das ist aber nur Eins von Zwei Problemen.
Denn ganz nebenbei sagt der Anti-Malware von Malwarebytes mir nun das ich ca. über
20 Fälle der Bedrohung durch eine Datei namens Hijack.Host habe die sich im Pfad
Windows/System32/drivers/etc/hosts eingenistet hat.
Gut was tut man dann? Natürlich löschen gesagt getan,gelöscht.
Nach dem Neustart nochmal laufen lassen. Dauert ca 5-8 Minuten;wieder ca. 20 Fälle aber
endweder waren sie nie weg oder sie kommen immer wieder.
Ich wäre über jede Hilfe unendlich Dankbar!
SuchlaufLog:
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 06.04.2017
Suchlaufzeit: 09:02
Protokolldatei: SuchlaufLog.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2017.04.06.02
Rootkit-Datenbank: v2017.04.02.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: Pascal

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 306185
Abgelaufene Zeit: 4 Min., 46 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 93
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 92.53.119.169 469ba60d9681f961064c-3cca6631dac1b4997db921c060b712f6.r30.cf2.rackcdn.com), Ersetzt,[05d5d8154a5eee4857593b0f34cdda26]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1      123.sogou.com
 127.0.0.1      ), Ersetzt,[835731bc4d5bf244842cd278748d27d9]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[efeb3eaf02a66bcbd1dfdc6e9e63ca36]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[fbdf6a831e8ad165238d53f7679a57a9]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[c3175697e5c32b0b8729b2989968e11f]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[18c239b461478fa7228e1e2c1ce53ac6]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[7e5c638a0e9a7bbb3878f852ce336c94]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0), Ersetzt,[3c9e22cbd7d1c274496793b726dba35d]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0), Ersetzt,[9a40cd205c4cd363139d351557aaec14]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0), Ersetzt,[c8128d606a3ea98ddbd57cceb34efc04]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0), Ersetzt,[42983eaf7a2e41f5228e7fcb847d3dc3]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1), Ersetzt,[5c7ea944525680b67937d377679a24dc]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[a634eb022f79c670e1cfbe8cbb4638c8]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[b327fdf056524ee8ecc41d2d6e93b54b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[f7e3c12ce0c850e6e9c7a4a64fb2ca36]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[d109faf3e0c815217e325beffa07f010]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[508a618c347420164769cc7eb948b24e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 12), Ersetzt,[a7336885307863d3a9070a40df22a55b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[f4e656971494f442ae021634b24fe719]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1      down.baidu2016.com
 127.0.0.1), Ersetzt,[5e7cbf2e05a393a3a8085cee917009f7]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t
 127.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[8555a24b9018d95d337d78d221e0bf41]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (      down.baidu2016.com
 127.0.0.1      1), Ersetzt,[588212db1395d75fe4cce3679c659769]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[25b52bc2783050e6ad0338122dd4659b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0), Ersetzt,[31a95a93ebbda3934c6405459c65b050]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0), Ersetzt,[be1c0ce1e8c0a49298182c1ed22f51af]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.), Ersetzt,[92488964a107280e258b1c2e53aed52b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.), Ersetzt,[66742ebfaefae650416fd8725da42dd3]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[c3179a53dccc2a0c298782c80ff2f20e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[8d4de30a792f3204b7f907432dd44eb2]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[ad2d5697d9cf25114f6152f8b44d46ba]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[875302eb5058a88edcd41d2d2ed340c0]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.), Ersetzt,[b92117d66345be783a76f258c43d11ef]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[eaf046a701a7a294e9c75af039c8eb15]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0), Ersetzt,[6575f1fc2c7cfc3a5e52103aee132cd4]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.), Ersetzt,[7a60f4f9a70142f4169aea607e836f91]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[2cae14d994144aecf5bbe46631d018e8]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[7565925b9612ed49a907f95128d93ac6]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.1), Ersetzt,[f8e2a24b3d6bc373317f6edcc140629e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[5e7c7a736a3eba7c416fde6cad543cc4]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[736727c66b3df145763af555a16057a9]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[da0038b5159345f19f111e2c7f82956b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[32a85a9301a71d19e0d045058a779d63]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[4b8fe60702a6b1854c64f05a55ac5ca4]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1      123.s), Ersetzt,[499166871e8a94a27a36d87246bb6d93]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (      down.baidu2016.com
 127.0.0.1      123.sogou.co), Ersetzt,[8a507d7003a5d2646947c28814ed1fe1]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (      down.baidu2016.com
 127.0.0.1      1), Ersetzt,[4d8da548ebbd8da9763a3e0cf30e718f]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0.), Ersetzt,[aa3031bc228681b567490d3dda27d62a]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[2ab0707df7b12e08456b65e5738e39c7]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[6e6cec01f5b342f4d6da2c1eac55c937]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[e3f72ac3d2d6dd5937790c3e956cad53]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1      1), Ersetzt,[d802c5287d2b6fc7c0f017336a975ca4]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[459537b6f2b65bdb0ba5e565cb366e92]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.1), Ersetzt,[7367bd30515771c5edc3014921e038c8]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[a6341dd050588ea8fdb31f2b18e928d8]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127), Ersetzt,[be1ca04d891ffd391a961b2fd62bea16]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t
 127.0.0.1      down.baidu2016.com
 1), Ersetzt,[ae2c7677396fe74f535db39751b02bd5]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[00daf1fc9b0d1422446c6dddc53cbd43]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[885222cbe8c043f30fa12a200001e020]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[607afdf0dbcd2e08fbb5b09a2ed305fb]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[6872ac4163453402436d4bff32cf13ed]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1      12), Ersetzt,[b22843aab2f63cfa8b25e5654eb3847c]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[1dbd8469cddbac8a10a04901867b07f9]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 1), Ersetzt,[d5058b621395a5910aa6ea60dc258f71]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t
 127.0.0.1      down.baidu2016.com
 127.0), Ersetzt,[1ac00be27e2a8da950600a40ff02926e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[bd1dd11c6c3cc076f8b80644af5252ae]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1      12), Ersetzt,[11c9e5089e0a3303ae0243070cf533cd]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[defc6e7fb9efb6806f41aaa028d9dc24]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[ac2eec01f0b8979f89270a40f30e9e62]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (      down.baidu2016.com
 127.0.0.1      123.sogou), Ersetzt,[d802737a9c0c88ae248cd971b051817f]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[4595ae3f723643f3357b69e18a77ea16]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127), Ersetzt,[7961519c97113402efc1e565ef12f808]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 12), Ersetzt,[a634f8f5406857dfc7e9272346bbce32]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0), Ersetzt,[15c50de07434171fa7091733d928cf31]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[64762fbee7c1ad89189886c4d32efa06]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[bc1e32bbc6e2033377397cce68991ae6]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[16c4db128a1e9e984c6406443cc5cb35]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t
 127.0.0.1      down.baidu2016.com
 12), Ersetzt,[13c7db12fbad7db9981877d3b24f53ad]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[7664effeb0f8fc3a446c0545b34e956b]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1      123), Ersetzt,[b921d11c792f4fe7f7b91b2fa75a6f91]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (1      down.baidu2016.com
 127.0.0.1      123.sogo), Ersetzt,[0eccad4066423df9e9c71b2f827fb34d]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (1      down.baidu2016.com
 127.0.0.1      1), Ersetzt,[9f3b4ca154540135129e1e2ccc355fa1]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1      down.baidu2016.com
 127.0.0.1      123.), Ersetzt,[528808e53b6d20164d63103a15eca25e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (    down.baidu2016.com
 127.0.0.1      123), Ersetzt,[c119836a40682115119f5cee14ede21e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1      down.baidu2016.com
 127.0.0.1      12), Ersetzt,[ac2e2ac3c5e3e0567f3156f4b24fbb45]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[e4f6bd30a701b28409a7eb5fe61bc739]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1      down.baidu2016.com
 127.0.0.1  ), Ersetzt,[6c6e9d50495f4fe79c149fab7c85b749]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.), Ersetzt,[32a8d31aefb97db9ab05ba90f9087987]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (
 127.0.0.1      down.baidu2016.com
 127.0.0.1    ), Ersetzt,[ffdb39b402a646f07c34f8529d64b848]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1      123), Ersetzt,[895142abdccc1620eac606447c8512ee]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1      down.baidu2016.com
 127.0.0.1 ), Ersetzt,[e5f55b92c9dfa3938030e26818e9b050]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1      123.so), Ersetzt,[7e5c30bd7f2983b3149c4109748da25e]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1      down.baidu2016.com
 127.0.0.1      ), Ersetzt,[3f9bfbf26a3e94a2a8082624c53c7987]
Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1      down.baidu2016.com
 127.0.0.1), Ersetzt,[04d69657fcace94dab057cce936eea16]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Mfg!

cosinus 06.04.2017 10:47
Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

MrKaru 06.04.2017 11:04
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Pascal (Administrator) auf DESKTOP-NBS516K (06-04-2017 11:55:08)
Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir10056_9357
Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe
(WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe
(WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe
(WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Razer Inc) C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper64.exe
(Razer, Inc.) C:\Users\Pascal\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\rzcefrenderprocess.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16696840 2016-09-14] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-06] (AVAST Software)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2013-12-17] (AVM Berlin)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RoccatIskuFX] => C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe [540672 2014-10-19] (ROCCAT GmbH)
HKLM-x32\...\Run: [RoccatKoneXTDOptical] => C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.EXE [552960 2014-04-14] (ROCCAT GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.)
HKLM-x32\...\Run: [Kraken71ChromaHelper] => C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe [1600096 2017-02-14] (Razer Inc)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Discord] => C:\Users\Pascal\AppData\Local\Discord\app-0.0.297\Discord.exe [64290304 2017-01-04] (Hammer & Chisel, Inc.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Steam] => E:\Neuer Ordner\steam.exe [3019552 2017-03-23] (Valve Corporation)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Spotify Web Helper] => C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-01] (Spotify Ltd)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [1690248 2016-12-01] (BlueStack Systems, Inc.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Gaijin.Net Agent] => C:\Users\Pascal\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [1912840 2017-02-19] ()
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3044816 2017-03-14] (Electronic Arts)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] ()
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\Dxtory Software\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [f.lux] => C:\Users\Pascal\AppData\Local\FluxSoftware\Flux\flux.exe [1024240 2016-12-06] (Flux Software LLC)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [SuperF4] => C:\Users\Pascal\AppData\Roaming\SuperF4\SuperF4.exe [40960 2015-08-24] (Stefan Sundin)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Chromium] => c:\users\pascal\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [VHMHR88UKJGKO0T] => "C:\Program Files\SH8GW5V5VQ\SH8GW5V5V.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [6159] => "C:\Users\Pascal\AppData\Roaming\45786296\827204.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [ruOj4cTpe+.exe] => C:\Program Files\Microsoft Office\XCR5RZM7N2TK0\ruOj4cTpe+.exe -r1_5 -r2_1
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [UMRTDY6K0MWO87K] => "C:\Program Files\LZAE7O812S\LZAE7O812.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [5LDEE8ZQ7YU0R81] => "C:\Program Files\R825KEPMNZ\R825KEPMN.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [OPKXB4WC5AAA46E] => "C:\Program Files\V389U12JRN\V389U12JR.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [W55ARE7PITE99EB] => "C:\Program Files\L9X4M63QIN\L9X4M63QI.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27545048 2017-03-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {0e0919c9-b364-11e6-a29d-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {bd04f186-b1b0-11e6-a29a-7085c209549d} - "G:\pushinst.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa05-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa2a-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa3f-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c75a8-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c7cb1-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe"
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-06] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk [2017-04-05]
ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScpToolkit Tray Notifications.lnk [2017-04-05]
ShortcutTarget: ScpToolkit Tray Notifications.lnk -> C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe (Scarlet.Crush Productions)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Winsock: Catalog5-x64 05 C:\Windows\system32\NSBlockA.dll => Keine Datei  <===== ACHTUNG
Winsock: Catalog5-x64 08 C:\Windows\system32\NSBlockB.dll => Keine Datei  <===== ACHTUNG
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{da0d42d9-18de-4b46-bcb2-42561cb5aa05}: [DhcpNameServer] 192.168.2.1
ManualProxies:

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt
SearchScopes: HKU\S-1-5-21-3959254474-2508283465-2998445632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605 [2017-04-06]
FF Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-04-05]
FF Extension: (Disable Prefetch) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\features\{54afb0fe-8646-4f03-a4d4-2020d0431a86}\disable-prefetch@mozilla.org.xpi [2017-04-05]
FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-29] [ist nicht signiert]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-06]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-04-06] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-04-06] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-11-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-23] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-23] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin HKU\S-1-5-21-3959254474-2508283465-2998445632-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-09] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-11-15] (Microsoft Corporation)
StartMenuInternet: FIREFOX.EXE - firefox.exe
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2017-04-05]

Chrome:
=======
CHR DefaultProfile: ChromeDefaultData2
CHR HomePage: ChromeDefaultData2 -> hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkOOmCCYjHgvUD8zQEC2onXZ0flEr-hZWd-RsmvP_SOpJeDvIzZP42wPMaHzmlcwF5M2qhrDaNB_0LXaMiqZuPt8E_yuCQj_6tziC2-4Yiln3v_mF3_BbWZUEu8CFqbQehiNhUZhTVLvtVv-RuFDbrzEm355f3f06ikvqBZITQ,,
CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.youndoo.com/?z=6387f3cc1cb544525b2e38agdz9t8g1c5m0t0ebe5o&from=amz&uid=ST1000DM003-1SB102_Z9A3CK7CXXXXZ9A3CK7C&type=hp"
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-04-06] <==== ACHTUNG
CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - Chrome.exe

Opera:
=======
OPR Extension: (VK+OK AdBlock) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\fgfffefkfpmbjmhofnofmiikiolcbhll [2017-04-05]
OPR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-04-05]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U4 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [487432 2017-03-21] (Avira Operations GmbH & Co. KG)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7398336 2017-04-06] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-06] (AVAST Software)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] ()
S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [486936 2016-12-01] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [470552 2016-12-01] (BlueStack Systems, Inc.)
S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [511512 2016-12-01] (BlueStack Systems, Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-02-08] (Digital Wave Ltd.)
R2 Ds3Service; C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe [389632 2016-01-10] (Scarlet.Crush Productions) [Datei ist nicht signiert]
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395024 2017-01-19] (EasyAntiCheat Ltd)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-11-25] ()
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-23] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-02-23] (NVIDIA Corporation)
R2 Online Manager Service; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe [3076096 2016-09-21] (Deutsche Telekom AG) [Datei ist nicht signiert]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2123240 2017-03-14] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184688 2017-03-14] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD)
R2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH)
R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69768 2017-02-15] (Razer Inc.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] ()
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s [X]
S2 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [307736 2017-04-06] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-04-06] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334088 2017-04-06] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-04-06] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-04-06] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32600 2017-04-06] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [127112 2017-04-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [101152 2017-04-06] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-04-06] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1005048 2017-04-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [556784 2017-04-06] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [164064 2017-04-06] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [339696 2017-04-06] (AVAST Software)
R4 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [161824 2017-03-21] (Avira Operations GmbH & Co. KG)
U4 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [163976 2017-03-21] (Avira Operations GmbH & Co. KG)
R4 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [44488 2017-03-21] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2013-12-17] (AVM Berlin)
S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-12-01] (BlueStack Systems)
S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-11-08] (Bluestack System Inc. )
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 FairplayKD; C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [78856 2017-02-12] (Multi Theft Auto)
R3 fwlanusb6; C:\Windows\system32\DRIVERS\fwlanusb6.sys [1327744 2014-03-27] (AVM GmbH)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2017-02-02] (LogMeIn Inc.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-11-25] (Huawei Technologies Co., Ltd.)
S3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-04-01] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2017-04-06] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys [14569528 2017-02-24] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2017-02-23] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47672 2017-01-20] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [59448 2017-02-23] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWOW64\DRIVERS\papycpu2.sys [1984 2003-01-17] () [Datei ist nicht signiert]
S0x01000000 papyjoy; C:\Windows\SysWOW64\DRIVERS\papyjoy.sys [1856 2003-01-17] () [Datei ist nicht signiert]
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.)
R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 TelekomNM6; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 VBAudioVACMME; C:\Windows\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider)
R3 VBAudioVMVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2017-02-10] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2016-10-20] (WinISO.com)
S3 xhunter1; C:\Windows\xhunter1.sys [36832 2017-04-01] (Wellbia.com Co., Ltd.)
R4 avusbflt; System32\Drivers\avusbflt.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-04-06 11:55 - 2017-04-06 11:55 - 00000000 ____D C:\FRST
2017-04-06 11:54 - 2017-04-06 11:54 - 02424832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381248740.pdf
2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Desktop\Versand 1.pdf
2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381243888.pdf
2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Desktop\Versand 2.pdf
2017-04-06 11:16 - 2017-04-06 11:16 - 00000000 ____D C:\Users\Pascal\Desktop\Bilder
2017-04-06 10:41 - 2017-04-06 10:41 - 00000179 _____ C:\Users\Pascal\Desktop\XBox tec Ausfall.txt
2017-04-06 10:07 - 2017-04-06 10:07 - 00017002 _____ C:\Users\Pascal\Desktop\SuchlaufLog.txt
2017-04-06 09:47 - 2017-04-06 09:47 - 00004466 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-04-06 09:36 - 2017-04-06 09:36 - 00032600 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2017-04-06 09:36 - 2017-04-06 09:36 - 00004044 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1491464191
2017-04-06 09:36 - 2017-04-06 09:36 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-04-06 09:35 - 2017-04-06 09:35 - 01005048 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00556784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00399944 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-04-06 09:35 - 2017-04-06 09:35 - 00339696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00334088 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbloga.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00307736 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00189768 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsha.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00164064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00127112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00101152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00075704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00048528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbuniva.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00038296 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-04-06 09:35 - 2017-04-06 09:35 - 00003994 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2017-04-06 09:35 - 2017-04-06 09:35 - 00001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\AVAST Software
2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Program Files\Common Files\AV
2017-04-06 09:34 - 2017-04-06 09:49 - 00000000 ____D C:\ProgramData\AVAST Software
2017-04-06 09:34 - 2017-04-06 09:37 - 00000000 ____D C:\Users\Pascal\Desktop\Schutz
2017-04-06 09:34 - 2017-04-06 09:36 - 00000000 ____D C:\Program Files\AVAST Software
2017-04-06 09:34 - 2017-04-06 09:34 - 06654960 _____ (AVAST Software) C:\Users\Pascal\Downloads\avast_free_antivirus_setup_online.exe
2017-04-06 08:15 - 2017-04-06 08:58 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WhatsApp
2017-04-06 08:15 - 2017-04-06 08:15 - 00002292 _____ C:\Users\Pascal\Desktop\WhatsApp.lnk
2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Local\WhatsApp
2017-04-06 08:13 - 2017-04-06 08:13 - 01496584 _____ C:\Users\Pascal\Downloads\WhatsApp3699Setup - CHIP-Installer.exe
2017-04-06 07:56 - 2017-04-06 07:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Eric_Zhang
2017-04-05 21:24 - 2017-04-05 21:24 - 01663904 _____ (Malwarebytes) C:\Users\Pascal\Downloads\JRT.exe
2017-04-05 21:21 - 2017-04-05 21:21 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001.exe
2017-04-05 13:39 - 2017-04-05 13:39 - 00001157 _____ C:\Users\Public\Desktop\PDF24.lnk
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Users\Pascal\AppData\Local\PDF24
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Program Files (x86)\PDF24
2017-04-05 13:38 - 2017-04-05 13:38 - 01496584 _____ C:\Users\Pascal\Downloads\PDF24 Creator - CHIP-Installer.exe
2017-04-05 13:36 - 2017-04-05 13:36 - 00038301 _____ C:\Users\Pascal\Downloads\images.pdf
2017-04-05 13:09 - 2017-04-05 13:09 - 00001154 _____ C:\Users\Pascal\Desktop\Opera.lnk
2017-04-05 12:45 - 2017-04-05 13:36 - 00000000 ____D C:\Users\Pascal\Desktop\Bewerbung
2017-04-05 12:22 - 2017-04-06 09:02 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-04-05 12:22 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-04-05 12:22 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-04-05 12:22 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2017-04-05 12:18 - 2017-04-05 21:14 - 00000000 ____D C:\Users\Pascal\Documents\Anti
2017-04-05 12:18 - 2017-04-05 21:12 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\uTorrent
2017-04-05 11:55 - 2017-04-05 11:55 - 00003738 _____ C:\Windows\System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B}
2017-04-05 11:46 - 2017-04-05 11:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\CrashDumps
2017-04-05 11:40 - 2017-04-05 11:40 - 00000000 ____D C:\Users\Pascal\AppData\Local\PeerDistRepub
2017-04-05 11:38 - 2017-04-05 11:39 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe
2017-04-05 11:33 - 2017-04-05 11:33 - 00001357 _____ C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk
2017-04-05 11:06 - 2017-04-05 21:25 - 00000000 ____D C:\AdwCleaner
2017-04-05 11:06 - 2017-04-05 21:23 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045.exe
2017-04-05 11:02 - 2017-04-05 11:08 - 00000000 ____D C:\Program Files\ZMWCF16IVP
2017-04-05 10:55 - 2017-04-06 09:54 - 00000000 ____D C:\ProgramData\Avira
2017-04-05 10:55 - 2017-04-06 09:54 - 00000000 ____D C:\Program Files (x86)\Avira
2017-04-05 10:55 - 2017-03-21 14:01 - 00163976 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2017-04-05 10:55 - 2017-03-21 14:01 - 00161824 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2017-04-05 10:55 - 2017-03-21 14:01 - 00044488 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2017-04-05 10:52 - 2017-04-05 10:52 - 01496584 _____ C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe
2017-04-05 10:40 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\SUSG1LUFVL
2017-04-05 10:37 - 2017-04-05 21:25 - 00000008 __RSH C:\Users\Pascal\ntuser.pol
2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\ZOTH2H4HUY
2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\NYCW0JIKE4
2017-04-05 10:04 - 2017-04-05 13:19 - 00141312 ___SH C:\Users\Pascal\Downloads\Thumbs.db
2017-04-05 09:59 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\MTSV8KJOJA
2017-04-05 09:59 - 2017-04-05 09:59 - 00720033 _____ C:\Windows\unins000.exe
2017-04-05 09:59 - 2017-04-05 09:59 - 00042558 _____ C:\Windows\unins000.dat
2017-04-05 09:57 - 2017-04-05 11:07 - 00000000 ____D C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048
2017-04-05 09:57 - 2017-04-05 10:06 - 00000000 ____D C:\Windows\system32\SSL
2017-04-05 09:56 - 2017-04-05 09:56 - 00000000 ____D C:\Windows\system32\sstmp
2017-04-05 09:55 - 2017-04-05 12:32 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Dkulyjegerward
2017-04-05 09:55 - 2017-04-05 09:55 - 00006058 _____ C:\Windows\System32\Tasks\Cdusmezeent Engine
2017-04-04 19:21 - 2017-04-04 19:21 - 00000783 _____ C:\Users\Pascal\Downloads\Cyber Dragons (Jermaine Leach).ydk
2017-04-04 19:19 - 2017-04-04 19:19 - 00000798 _____ C:\Users\Pascal\Downloads\Barian Warrior Rank 4 (Sercan Tepeler).ydk
2017-04-04 19:17 - 2017-04-04 19:17 - 00000748 _____ C:\Users\Pascal\Downloads\Crystron (Berkay Gündar).ydk
2017-04-04 19:17 - 2017-04-04 19:17 - 00000745 _____ C:\Users\Pascal\Downloads\Blackwing Quasar (Samed Yazar).ydk
2017-04-04 19:16 - 2017-04-04 19:16 - 00000746 _____ C:\Users\Pascal\Downloads\D_D_D's (Emre Canyurt).ydk
2017-04-04 19:06 - 2017-04-04 19:06 - 00000762 _____ C:\Users\Pascal\Downloads\Darklords (Lucas Bartolomeu De Oliveira).ydk
2017-04-04 19:01 - 2017-04-04 19:01 - 00000750 _____ C:\Users\Pascal\Downloads\D_D Yang Zings (Giannis Feidakis).ydk
2017-04-04 19:01 - 2017-04-04 19:01 - 00000744 _____ C:\Users\Pascal\Downloads\PSY-Frames (Nick Dietz).ydk
2017-04-04 12:25 - 2017-04-04 12:34 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted Backups
2017-04-04 09:00 - 2017-04-04 09:11 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted
2017-04-04 08:58 - 2017-04-04 08:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed Most Wanted 2005
2017-04-04 07:50 - 2017-04-05 08:06 - 00000074 _____ C:\Users\Pascal\AppData\Roaming\WB.CFG
2017-04-03 20:24 - 2017-04-03 20:24 - 00013824 ___SH C:\Users\Pascal\Desktop\Thumbs.db
2017-04-03 20:22 - 2017-04-03 20:22 - 00000000 ____D C:\ProgramData\PopCap Games
2017-04-03 20:20 - 2017-04-05 12:50 - 00000577 _____ C:\Users\Public\Desktop\Plants vs. Zombies.lnk
2017-04-03 20:20 - 2017-04-03 20:20 - 00000000 ____D C:\Users\Pascal\Desktop\CUE In ISO
2017-04-03 20:19 - 2017-04-05 12:49 - 00002388 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
2017-04-03 20:18 - 2017-04-05 12:30 - 00000000 ____D C:\Users\Pascal\AppData\Local\Lafesas
2017-04-03 20:18 - 2017-04-05 10:23 - 00000296 _____ C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job
2017-04-03 20:18 - 2017-04-03 20:18 - 00002836 _____ C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}
2017-04-03 20:17 - 2017-04-03 20:17 - 07898096 _____ (WinISO Computing Inc.) C:\Users\Pascal\Downloads\winiso.exe
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WinISO Computing
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Local\WinISO Computing
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Program Files (x86)\WinISO Computing
2017-04-03 20:17 - 2016-10-20 17:13 - 00204032 _____ (WinISO.com) C:\Windows\system32\Drivers\WinisoCDBus.sys
2017-04-02 20:21 - 2017-04-02 20:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\One Finger Death Punch 1.0
2017-04-02 19:35 - 2017-04-02 19:35 - 00000000 ____D C:\Users\Public\Documents\Team17
2017-04-02 19:33 - 2017-04-02 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Worms W.M.D. [GOG.com]
2017-04-02 19:20 - 2017-04-02 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One
2017-04-02 12:21 - 2017-04-02 12:21 - 00000000 ____D C:\ProgramData\Nefarius Software Solutions
2017-04-01 20:32 - 2017-04-01 20:33 - 00000000 ____D C:\Users\Pascal\Desktop\PS3 Controller
2017-04-01 20:27 - 2017-04-05 21:25 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-04-01 20:27 - 2017-04-01 20:27 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbK.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00083552 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusbK.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00047200 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusbK.sys
2017-04-01 20:26 - 2017-04-01 20:26 - 00003960 _____ C:\Windows\System32\Tasks\updater
2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScpToolkit
2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\Program Files\Nefarius Software Solutions
2017-04-01 20:25 - 2017-04-01 20:25 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Nefarius Software Solutions
2017-04-01 20:24 - 2017-04-01 20:25 - 23361996 _____ (Nefarius Software Solutions) C:\Users\Pascal\Downloads\ScpToolkit_Setup.exe
2017-04-01 20:18 - 2017-04-05 12:50 - 00000687 _____ C:\Users\Public\Desktop\The Saboteur.lnk
2017-04-01 20:18 - 2017-04-01 20:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Saboteur [GOG.com]
2017-04-01 20:17 - 2017-04-05 09:56 - 00000000 ____D C:\Program Files\MotioninJoy
2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\MotioninJoy
2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2017-04-01 20:17 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2017-04-01 20:16 - 2012-05-12 06:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Pascal\Downloads\MotioninJoy_071001_signed.exe
2017-04-01 20:12 - 2017-04-01 20:12 - 00000000 ____D C:\Users\Pascal\AppData\Local\BetterDS3
2017-04-01 20:11 - 2017-04-01 20:11 - 00759932 _____ C:\Users\Pascal\Downloads\BetterDS3_1.5.3.zip
2017-04-01 20:11 - 2017-04-01 20:11 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-04-01 20:11 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Pascal\Downloads\Better DS3.exe
2017-04-01 20:10 - 2017-04-01 20:10 - 01496584 _____ C:\Users\Pascal\Downloads\Better DS3 - CHIP-Installer.exe
2017-04-01 16:47 - 2017-04-01 16:47 - 00000947 _____ C:\Users\Pascal\Downloads\60-Card Infernoid Zoodiacs (Ryan Murakami).ydk
2017-03-29 21:58 - 2017-03-29 21:58 - 00000732 _____ C:\Users\Pascal\Downloads\Chain Burn (Jameson Mcgranahan).ydk
2017-03-29 21:57 - 2017-03-29 21:57 - 00000749 _____ C:\Users\Pascal\Downloads\Dark Synchro (Duelist Unknown).ydk
2017-03-29 21:56 - 2017-03-29 21:56 - 00000776 _____ C:\Users\Pascal\Downloads\Reckless Blue-Eyes (Carlos Adams).ydk
2017-03-28 21:18 - 2017-04-05 12:49 - 00000465 _____ C:\Users\Pascal\Desktop\Ygopro.lnk
2017-03-28 21:16 - 2017-03-28 21:17 - 40482992 _____ C:\Users\Pascal\Downloads\ygopro-1.033.D-Percy.exe
2017-03-28 15:03 - 2017-03-28 15:03 - 00000209 _____ C:\Users\Pascal\Desktop\Chivalry Medieval Warfare.url
2017-03-27 22:07 - 2017-04-05 12:50 - 00000943 _____ C:\Users\Public\Desktop\Yu-Gi-Oh! The Dawn of a New Era.lnk
2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\Users\Pascal\Documents\System Files
2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yu-Gi-Oh! The Dawn of a New Era
2017-03-27 22:03 - 2017-03-27 22:03 - 00000000 ____D C:\Yu-Gi-Oh! The Dawn of a New Era
2017-03-27 21:59 - 2017-03-27 22:03 - 780766672 _____ (Kaiba Corporation ) C:\Users\Pascal\Downloads\Yu-Gi-Oh! The Dawn of a New Era - Setup.exe
2017-03-25 16:45 - 2017-03-25 16:45 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Cruderocks
2017-03-25 13:18 - 2017-04-01 20:33 - 00036832 _____ (Wellbia.com Co., Ltd.) C:\Windows\xhunter1.sys
2017-03-21 20:27 - 2017-03-22 23:45 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\RenPy
2017-03-20 21:10 - 2017-03-20 21:10 - 00000209 _____ C:\Users\Pascal\Desktop\FreeStyle Football.url
2017-03-18 22:22 - 2017-03-27 21:22 - 00000000 ____D C:\Users\Pascal\BrawlhallaReplays
2017-03-18 22:14 - 2017-03-18 22:14 - 00000209 _____ C:\Users\Pascal\Desktop\Brawlhalla.url
2017-03-18 22:10 - 2017-03-18 22:10 - 01090920 _____ (Unity Technologies ApS) C:\Users\Pascal\Downloads\UnityWebPlayer(1).exe
2017-03-18 18:22 - 2017-03-18 18:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BioShock Infinite
2017-03-18 13:17 - 2017-03-18 13:18 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\HelloGames
2017-03-18 13:17 - 2017-03-18 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No Man's Sky [GOG.com]
2017-03-17 11:33 - 2017-03-17 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spec Ops The Line
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Public\Documents\Sports Interactive
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\Documents\Sports Interactive
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\AppData\Local\Sports Interactive
2017-03-15 16:48 - 2017-03-15 16:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sports Interactive
2017-03-15 16:45 - 2017-03-15 16:47 - 00000000 ____D C:\Program Files (x86)\Sports Interactive
2017-03-15 08:55 - 2017-03-15 08:55 - 00000000 ____D C:\ProgramData\360TSBackup
2017-03-14 23:06 - 2017-03-14 23:06 - 00000209 _____ C:\Users\Pascal\Desktop\RaceRoom Racing Experience.url
2017-03-14 22:27 - 2017-03-14 22:27 - 00423376 _____ C:\Windows\system32\FNTCACHE.DAT
2017-03-14 19:36 - 2017-04-05 12:50 - 00001273 _____ C:\Users\Public\Desktop\OBS Studio.lnk
2017-03-14 19:36 - 2017-04-04 16:11 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\obs-studio
2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio
2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\Program Files (x86)\obs-studio
2017-03-14 19:33 - 2017-03-14 19:35 - 113001480 _____ (obsproject.com) C:\Users\Pascal\Downloads\OBS-Studio-18.0.1-Full-Installer.exe
2017-03-14 13:07 - 2017-03-14 13:07 - 00000000 __SHD C:\$360Section
2017-03-14 13:02 - 2017-03-14 22:27 - 00000000 ____D C:\Windows\Tasks\360Disabled
2017-03-14 13:02 - 2017-03-14 13:07 - 00000000 ____D C:\ProgramData\360Quarant
2017-03-14 13:01 - 2017-03-15 19:45 - 00000000 ____D C:\Program Files (x86)\360
2017-03-14 13:01 - 2017-03-03 13:30 - 00095232 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys
2017-03-14 13:00 - 2017-03-14 13:00 - 50956720 _____ C:\Users\Pascal\Downloads\360TS_Setup.exe
2017-03-14 13:00 - 2017-03-14 13:00 - 01477032 _____ (QIHU 360 SOFTWARE CO. LIMITED) C:\Users\Pascal\Downloads\360TS_Setup_Mini.exe
2017-03-13 21:20 - 2017-04-05 12:49 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SuperF4.lnk
2017-03-13 21:20 - 2017-03-13 21:20 - 00111535 _____ C:\Users\Pascal\Downloads\SuperF4-1.3.exe
2017-03-13 21:20 - 2017-03-13 21:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\SuperF4
2017-03-13 21:16 - 2017-04-05 12:49 - 00002165 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\f.lux.lnk
2017-03-13 21:16 - 2017-03-13 21:16 - 00496896 _____ C:\Users\Pascal\Downloads\flux-setup.exe
2017-03-13 21:16 - 2017-03-13 21:16 - 00000000 ____D C:\Users\Pascal\AppData\Local\FluxSoftware
2017-03-11 20:05 - 2017-03-11 20:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light [GOG.com]
2017-03-10 16:59 - 2017-02-23 10:17 - 00136064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2017-03-10 16:59 - 2017-01-26 02:13 - 00103936 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-03-10 16:59 - 2017-01-26 02:12 - 00326656 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-03-10 16:59 - 2017-01-26 02:09 - 00322560 _____ C:\Windows\system32\vulkan-1.dll
2017-03-10 16:59 - 2017-01-26 02:09 - 00118272 _____ C:\Windows\system32\vulkaninfo.exe
2017-03-10 16:57 - 2017-02-24 00:55 - 00047664 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 40192056 _____ C:\Windows\system32\nvcompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 35272760 _____ C:\Windows\SysWOW64\nvcompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 34992184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 19007528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 14674896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 11122728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 11019888 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 09306312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 08990256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 03168192 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 02717752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01985080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6437878.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01589696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6437878.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01052096 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00989632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00959424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00946456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFTH264.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00944224 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFThevc.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00910784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00721768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFTH264.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00719856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFThevc.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00687408 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00618416 _____ (NVIDIA Corporation) C:\Windows\system32\nvmcumd.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00609728 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00605120 _____ (NVIDIA Corporation) C:\Windows\system32\nvDecMFTMjpeg.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00576008 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00573632 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00499136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00483384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvDecMFTMjpeg.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00447984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\system32\nv-vk64.json
2017-03-09 23:56 - 2017-03-09 23:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Just Cause 3
2017-03-09 21:47 - 2017-03-19 20:15 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-03-07 16:17 - 2017-03-07 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultimate Marvel vs. Capcom 3

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-04-06 11:29 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Spotify
2017-04-06 11:05 - 2017-03-02 18:19 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Mozilla
2017-04-06 10:20 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Spotify
2017-04-06 10:06 - 2016-07-16 13:36 - 00000000 ____D C:\Windows\CbsTemp
2017-04-06 09:54 - 2016-11-23 21:23 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-06 09:40 - 2017-01-02 22:34 - 00002642 _____ C:\Users\Public\Desktop\Skype.lnk
2017-04-06 09:40 - 2017-01-02 22:34 - 00000000 ____D C:\ProgramData\Skype
2017-04-06 09:40 - 2016-11-23 21:12 - 00000000 ____D C:\Users\Pascal
2017-04-06 09:06 - 2016-07-16 13:45 - 00000000 ____D C:\Windows\INF
2017-04-06 09:03 - 2016-11-23 21:16 - 07102098 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-06 09:03 - 2016-07-17 00:51 - 03524346 _____ C:\Windows\system32\perfh007.dat
2017-04-06 09:03 - 2016-07-17 00:51 - 00960498 _____ C:\Windows\system32\perfc007.dat
2017-04-06 09:01 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA
2017-04-06 08:58 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Overwolf
2017-04-06 08:57 - 2016-11-23 21:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-06 08:57 - 2016-07-16 13:47 - 00000000 ___HD C:\Windows\ELAMBKUP
2017-04-06 08:57 - 2016-07-16 08:04 - 00262144 _____ C:\Windows\system32\config\BBI
2017-04-06 08:15 - 2016-11-23 21:54 - 00000000 ____D C:\Users\Pascal\AppData\Local\SquirrelTemp
2017-04-06 07:41 - 2016-12-19 00:40 - 00004174 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BDE79071-9BD6-497A-92EE-45EFD20BC43B}
2017-04-05 21:55 - 2016-11-23 21:11 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-04-05 21:22 - 2016-11-23 21:49 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\uTorrent
2017-04-05 12:50 - 2017-03-03 11:06 - 00001360 _____ C:\Users\Public\Desktop\Online Manager.lnk
2017-04-05 12:50 - 2017-03-02 18:19 - 00001134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-05 12:50 - 2017-03-02 18:19 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-04-05 12:50 - 2017-03-02 18:15 - 00001154 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 43.lnk
2017-04-05 12:50 - 2017-02-12 19:27 - 00001030 _____ C:\Users\Public\Desktop\WinFF.lnk
2017-04-05 12:50 - 2017-02-12 13:28 - 00001156 _____ C:\Users\Public\Desktop\Adobe Photoshop CS6.lnk
2017-04-05 12:50 - 2017-02-09 11:02 - 00001089 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk
2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\Users\Public\Desktop\Audacity.lnk
2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2017-04-05 12:50 - 2017-02-08 13:30 - 00001483 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-04-05 12:50 - 2017-02-07 15:41 - 00001058 _____ C:\Users\Public\Desktop\HiSuite.lnk
2017-04-05 12:50 - 2017-01-30 18:56 - 00001148 _____ C:\Users\Public\Desktop\Overwolf.lnk
2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk
2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
2017-04-05 12:50 - 2017-01-27 02:17 - 00001013 _____ C:\Users\Public\Desktop\Mass Effect 3.lnk
2017-04-05 12:50 - 2017-01-27 01:02 - 00000915 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk
2017-04-05 12:50 - 2017-01-26 23:23 - 00000902 _____ C:\Users\Public\Desktop\Mass Effect.lnk
2017-04-05 12:50 - 2017-01-26 21:21 - 00001060 _____ C:\Users\Public\Desktop\Origin.lnk
2017-04-05 12:50 - 2017-01-26 20:24 - 00000908 _____ C:\Users\Public\Desktop\Battle.net.lnk
2017-04-05 12:50 - 2017-01-13 01:06 - 00000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2017-04-05 12:50 - 2016-12-19 00:38 - 00000664 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontier Launchpad.lnk
2017-04-05 12:50 - 2016-11-27 13:37 - 00001371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-05 12:50 - 2016-11-27 13:37 - 00001353 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-05 12:50 - 2016-11-23 23:08 - 00000963 _____ C:\Users\Public\Desktop\MegaDownloader.lnk
2017-04-05 12:50 - 2016-11-23 22:55 - 00000842 _____ C:\Users\Public\Desktop\The Sims 3 Complete Collection.lnk
2017-04-05 12:50 - 2016-11-23 21:56 - 00000594 _____ C:\Users\Public\Desktop\Steam.lnk
2017-04-05 12:50 - 2016-11-23 21:47 - 00001755 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-04-05 12:50 - 2016-11-23 21:38 - 00001321 _____ C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2017-04-05 12:50 - 2016-11-23 21:23 - 00001339 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2017-04-05 12:49 - 2017-03-03 11:06 - 00001662 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Online Manager.lnk
2017-04-05 12:49 - 2017-03-03 11:06 - 00001372 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Online Manager.lnk
2017-04-05 12:49 - 2017-02-04 17:21 - 00000670 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2.lnk
2017-04-05 12:49 - 2017-01-30 18:56 - 00001287 _____ C:\Users\Pascal\Desktop\TeamSpeak 3 Client.lnk
2017-04-05 12:49 - 2017-01-30 18:56 - 00001245 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2017-04-05 12:49 - 2017-01-28 21:47 - 00001158 _____ C:\Users\Pascal\Desktop\Cheat Engine.lnk
2017-04-05 12:49 - 2017-01-27 13:40 - 00000594 _____ C:\Users\Pascal\Desktop\Steam.lnk
2017-04-05 12:49 - 2017-01-26 20:19 - 00001278 _____ C:\Users\Pascal\Desktop\Uplay.lnk
2017-04-05 12:49 - 2017-01-07 15:48 - 00001080 _____ C:\Users\Pascal\Desktop\SpeedFan.lnk
2017-04-05 12:49 - 2017-01-02 12:36 - 00001904 _____ C:\Users\Pascal\Desktop\Roccat Kone XTD Optical.lnk
2017-04-05 12:49 - 2016-12-14 00:44 - 00001766 _____ C:\Users\Pascal\Desktop\Isku FX.lnk
2017-04-05 12:49 - 2016-12-14 00:17 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk
2017-04-05 12:49 - 2016-11-23 22:56 - 00001855 _____ C:\Users\Pascal\Desktop\Spotify.lnk
2017-04-05 12:49 - 2016-11-23 22:56 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2017-04-05 12:49 - 2016-11-23 21:54 - 00002242 _____ C:\Users\Pascal\Desktop\Discord.lnk
2017-04-05 12:49 - 2016-11-23 21:50 - 00002663 _____ C:\Users\Pascal\Desktop\µTorrent.lnk
2017-04-05 12:49 - 2016-11-23 21:14 - 00002390 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ___RD C:\Windows\PrintDialog
2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\AppReadiness
2017-04-05 11:42 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\ConnectedDevicesPlatform
2017-04-05 10:23 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\LiveKernelReports
2017-04-05 09:55 - 2016-12-18 20:53 - 00000000 ____D C:\Program Files\Microsoft Office
2017-04-04 16:38 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\TS3Client
2017-04-04 13:53 - 2017-02-10 09:56 - 00004490 _____ C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml
2017-04-04 09:08 - 2016-12-22 00:31 - 00000000 ____D C:\Users\Pascal\Documents\My Games
2017-04-03 19:09 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\Packages
2017-04-03 16:30 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-03 10:15 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\spool
2017-04-02 20:22 - 2016-11-23 21:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\ElevatedDiagnostics
2017-04-02 00:28 - 2017-03-02 18:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-02 00:28 - 2016-12-19 23:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-28 20:11 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\VirtualStore
2017-03-28 14:00 - 2017-02-09 10:55 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Audacity
2017-03-26 23:21 - 2017-01-26 21:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Origin
2017-03-26 23:21 - 2017-01-26 21:19 - 00000000 ____D C:\ProgramData\Origin
2017-03-24 19:39 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client
2017-03-24 17:21 - 2017-01-30 18:56 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-03-20 20:00 - 2017-03-06 11:50 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-03-20 13:41 - 2017-03-06 11:41 - 00000000 ____D C:\ProgramData\McAfee
2017-03-20 11:35 - 2017-02-10 23:01 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\DVDVideoSoft
2017-03-19 14:06 - 2016-12-01 19:54 - 00000000 ____D C:\ProgramData\Steam
2017-03-18 22:11 - 2017-03-02 18:21 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Unity
2017-03-17 15:52 - 2017-01-26 20:19 - 00000000 ____D C:\Users\Pascal\AppData\Local\Ubisoft Game Launcher
2017-03-15 19:45 - 2016-11-23 21:12 - 00000000 ____D C:\Users\defaultuser0
2017-03-14 18:00 - 2017-02-09 11:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Sony
2017-03-14 13:08 - 2017-02-21 16:18 - 00000000 ____D C:\Users\Pascal\AppData\Local\LogMeIn Hamachi
2017-03-14 13:08 - 2017-01-23 17:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Notepad++
2017-03-14 13:08 - 2017-01-07 15:48 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-14 13:08 - 2016-11-23 22:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Skype
2017-03-14 13:08 - 2016-11-23 21:09 - 00000000 ____D C:\Windows\Panther
2017-03-14 13:04 - 2017-02-04 17:15 - 00003464 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-03-14 13:04 - 2017-01-30 18:56 - 00003304 _____ C:\Windows\System32\Tasks\Overwolf Updater Task
2017-03-14 13:02 - 2017-03-02 18:15 - 00003320 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488471357
2017-03-14 13:02 - 2017-02-08 13:29 - 00002956 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2017-02-08 13:29 - 00002838 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2017-02-08 13:29 - 00002786 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2016-12-09 22:48 - 00002772 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2017-03-14 13:02 - 2016-11-27 13:36 - 00003556 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-03-14 13:02 - 2016-11-27 13:36 - 00003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-03-14 11:03 - 2017-01-26 21:21 - 00000000 ____D C:\Program Files (x86)\Origin
2017-03-11 23:26 - 2017-01-26 20:24 - 00000000 ____D C:\Users\Pascal\AppData\Local\Battle.net
2017-03-11 23:26 - 2017-01-26 20:23 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-03-10 19:38 - 2016-11-23 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-03-10 07:17 - 2016-07-16 13:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-03-10 07:17 - 2016-07-16 13:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-09 14:22 - 2017-03-02 18:15 - 00000000 ____D C:\Program Files\Opera

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-02-10 09:56 - 2017-04-04 13:53 - 0004490 _____ () C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml
2017-04-04 07:50 - 2017-04-05 08:06 - 0000074 _____ () C:\Users\Pascal\AppData\Roaming\WB.CFG
2017-04-05 11:33 - 2017-04-05 11:33 - 0001357 _____ () C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk
2016-11-23 21:20 - 2016-11-23 21:20 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job


Einige Dateien in TEMP:
====================
2017-04-05 11:10 - 2017-04-06 08:58 - 0619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll
2017-04-06 09:40 - 2017-04-06 09:40 - 14456872 _____ (Microsoft Corporation) C:\Users\Pascal\AppData\Local\Temp\vc_redist.x86.exe

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-04-02 18:44

==================== Ende von FRST.txt ============================

MrKaru 06.04.2017 11:05
FRST Additions Logfile:
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (06-04-2017 11:55:33)
Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir10056_9357
Windows 10 Pro Version 1607 (X64) (2016-11-23 19:12:30)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3959254474-2508283465-2998445632-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3959254474-2508283465-2998445632-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3959254474-2508283465-2998445632-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-3959254474-2508283465-2998445632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3959254474-2508283465-2998445632-1003 - Limited - Enabled)
Pascal (S-1-5-21-3959254474-2508283465-2998445632-1001 - Administrator - Enabled) => C:\Users\Pascal

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

µTorrent (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\uTorrent) (Version: 3.4.9.43388 - BitTorrent Inc.)
3CXPhone (HKLM-x32\...\{0DF8FA4D-299C-4250-9F09-C14E47E12224}) (Version: 4.0.26523.0 - 3CX)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
AlienFX for IskuFX (HKLM-x32\...\InstallShield_{2C3FC2CC-0A8B-409E-B487-8CD54F4DC1D4}) (Version: 1.02 - Roccat GmbH)
AlienFX for IskuFX (Version: 1.02 - Roccat GmbH) Hidden
Ansel (Version: 378.78 - NVIDIA Corporation) Hidden
Aufstieg des Hexenkönigs™ (HKLM-x32\...\{B931FB80-537A-4600-00AD-AC5DEDB6C25B}) (Version:  - )
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.78.7302 - BlueStack Systems, Inc.)
Brawlhalla (HKLM\...\Steam App 291550) (Version:  - Blue Mammoth Games)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version:  - Torn Banner Studios)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version:  - Valve)
Discord (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
Epic Games Launcher (HKLM-x32\...\{4755FB10-B694-4B0F-BCDE-F390B957CD96}) (Version: 1.1.90.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
f.lux (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Flux) (Version:  - )
F1 2016 (HKLM\...\Steam App 391040) (Version:  - Codemasters)
FreeArc 0.666 (HKLM-x32\...\FreeArc) (Version: 0.666 - Bulat Ziganshin)
FreeStyle Football (HKLM\...\Steam App 568810) (Version:  - Joycity)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
H1Z1: King of the Kill (HKLM\...\Steam App 433850) (Version:  - Daybreak Game Company)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kinect for Windows Speech Recognition Language Pack (de-DE) (HKLM-x32\...\{898AA67F-99B8-4C7F-9611-B11F98EF6E78}) (Version: 11.0.7413.611 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32\...\{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32\...\{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32\...\{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32\...\{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version:  - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.558 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.558 - LogMeIn, Inc.) Hidden
Mafia III (HKLM\...\Steam App 360430) (Version:  - Hangar 13)
MAGIX Music Maker 2016 Premium Update (Version: 22.0.3.63 - MAGIX Software GmbH) Hidden
MAGIX Music Maker 2016 Premium Update (Version: 22.0.5.74 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Managed DirectX (0900) (x32 Version: 4.09.00.0900 - Microsoft) Hidden
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Mass Effect™ 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.2.1604.0 - Electronic Arts)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24516 (HKLM-x32\...\{c325004c-5538-45b3-a7ad-94473a4dcd3b}) (Version: 14.0.24516.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 52.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 52.0.2 (x86 de)) (Version: 52.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MTA:SA v1.5.3 (HKLM-x32\...\MTA:SA 1.5) (Version: v1.5.3 - Multi Theft Auto)
NASCAR® Racing 2003 Season (HKLM-x32\...\{ACC2E059-40E9-4464-B18D-C9BDD9A02CED}) (Version:  - Sierra Entertainment)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.3.2 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 378.78 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.4.0.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.4.0.70 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.78 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.23 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.16.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 18.0.1 - OBS Project)
Online Manager (HKLM-x32\...\Online Manager) (Version: 2.02 - Deutsche Telekom AG)
Online Manager (Version: 2.02 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
Opera Stable 43.0.2442.1144 (HKLM-x32\...\Opera 43.0.2442.1144) (Version: 43.0.2442.1144 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.5.30491 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.103.44.0 - Overwolf Ltd.)
PDF24 Creator 8.1.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PES Professionals Patch 2017 V2 V2 (HKLM-x32\...\PES Professionals Patch 2017 V2 V2) (Version: V2 - PES Professionals)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DG0-PlanetSide 2) (Version:  - Sony Online Entertainment)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DGC-PlanetSide 2) (Version: 1.0.3.192 - Daybreak Game Company)
Plants vs. Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
RaceRoom Racing Experience  (HKLM\...\Steam App 211500) (Version:  - Sector3 Studios)
Razer Chroma SDK Core Components (HKLM-x32\...\Razer Chroma SDK) (Version: 1.14.2 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.17.302 - Razer Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7936 - Realtek Semiconductor Corp.)
ROCCAT Isku FX Keyboard Driver (HKLM-x32\...\{DC69933C-E7B0-455D-8E54-FAC1EEF046FF}) (Version:  - Roccat GmbH)
ROCCAT Kone XTD Optical Mouse Driver (HKLM-x32\...\{AD43B296-FE63-42C0-AA39-D8759B905420}) (Version:  - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0015 - Roccat GmbH)
SafeZone Stable 3.55.2393.596 (x32 Version: 3.55.2393.596 - Avast Software) Hidden
ScpToolkit (HKLM\...\{AC052048-9828-45E3-872B-04CE30A3B58B}) (Version: 1.6.238.16010 - Nefarius Software Solutions)
Scribus 1.4.6 (HKLM-x32\...\Scribus 1.4.6) (Version: 1.4.6 - The Scribus Team)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
Sid Meier's Civilization VI (HKLM\...\Steam App 289070) (Version:  - Firaxis)
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Spotify) (Version: 1.0.52.725.g943b26a8 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SuperF4 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\SuperF4) (Version: 1.3 - Stefan Sundin)
Team Fortress 2 (HKLM\...\Steam App 440) (Version:  - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\TeamSpeak 3 Client) (Version: 3.1.0 - TeamSpeak Systems GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version:  - Ubisoft Montreal)
Unity Web Player (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\UnityWebPlayer) (Version: 5.3.8f1 - Unity Technologies ApS)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version:  - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version:  - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
VBCABLE, The Virtual Audio Cable (HKLM\...\VB:VBCABLE {87459874-1236-4469}) (Version:  - VB-Audio Software)
Vegas Pro 13.0 (64-bit) (HKLM\...\{D264BD11-6A9B-11E4-A4F7-F04DA23A5C58}) (Version: 13.0.428 - Sony)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
Voicemeeter, The Virtual Mixing Console (HKLM-x32\...\VB:Voicemeeter {17359A74-1236-5467}) (Version:  - VB-Audio Software)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
War Thunder (HKLM\...\Steam App 236390) (Version:  - Gaijin Entertainment)
WhatsApp (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\WhatsApp) (Version: 0.2.3699 - WhatsApp)
WinISO (HKLM-x32\...\WinISO) (Version: 6.4.1.6137 - WinISO Computing Inc.)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0DDC38B9-2ABC-4047-A0EB-725D94EF2E32} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} => C:\Users\Pascal\AppData\Local\Lafesas\sync.exe
Task: {1329C2F6-C4BA-4D0B-ABCF-76C371F1440E} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-03-21] (Overwolf LTD)
Task: {2524814B-75BC-4B9E-905E-D1B4E6C034E0} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {2CB9E534-7179-4767-A507-15226E0FB1E0} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-02-23] (NVIDIA Corporation)
Task: {319CD93D-EFB6-4F43-84EC-4799DA209C36} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-06] (AVAST Software)
Task: {3E251701-C90A-4C21-905A-00FAD98BD76A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {46627DDA-595A-4E74-A24C-B72ECFA99E5E} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-02-23] (NVIDIA Corporation)
Task: {4B22C211-4B14-4CAB-A75A-C9798A378749} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {539F7043-4785-4A26-AB46-A96DF2BC3B3C} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-02-23] (NVIDIA Corporation)
Task: {5F906855-AC11-46CB-AE0F-457BE062401C} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {7F828514-1063-4857-B54D-6F287D51BEED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {86FFF51A-B889-4EAE-8744-FADCC6282324} - System32\Tasks\SafeZone scheduled Autoupdate 1491464191 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)
Task: {8823F342-6FC1-4DB1-81FB-EE2171B3589C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {89AB2E6E-B3BF-4EA7-AF6C-08572CD29D63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {9B2F52A4-3F4F-4B00-B4E6-C770E1E72CC9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {AC1D292C-3B38-4F40-87EC-72770B25CF58} - System32\Tasks\Opera scheduled Autoupdate 1488471357 => C:\Program Files\Opera\launcher.exe [2017-02-27] (Opera Software)
Task: {B452DF3B-CC73-4F26-A9C9-9A5A4F15807F} - System32\Tasks\updater => C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpUpdater.exe [2016-01-10] (Nefarius Software Solutions)
Task: {B534A77D-568D-4D49-AE5F-C04943B3A13E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-06] (Adobe Systems Incorporated)
Task: {C2236E80-FF55-4AF3-8983-DA0EC61C4DB6} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-02-19] (Adobe Systems Incorporated)
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - System32\Tasks\Cdusmezeent Engine => C:\Program Files (x86)\Ghezeentghicay\zernly.exe
Task: {C936D059-AE7D-42A9-974D-A8BEA5AC2F63} - System32\Tasks\{BF57B4F5-D0F8-4F2C-A03D-C8454499F1F5} => pcalua.exe -a D:\eauninstall.exe -d D:\
Task: {E1784AF7-9DBF-45E7-91A2-E7B1D24CD587} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-06] (AVAST Software)
Task: {F48C5C35-1CE4-4B3C-A780-ECDCC01B63CD} - System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} => pcalua.exe -a "C:\Program Files (x86)\Common Files\ZumFix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\ZumFix\uninstall.dat" -a uninstallme 107D25D2-8157-4685-A6F7-6B6BC6263AA7 DeviceId=3be95ac1-32fa-4efb-d976-f9ecc5042de7 BarcodeId=51557003 ChannelId=3 DistributerName=APSFWemonetize

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job =>

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-11-23 21:24 - 2017-02-23 10:28 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-04-02 18:45 - 2017-04-02 18:45 - 00309760 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\ReactiveSockets\ced6a6793b1806f6dbe2e73d73a91244\ReactiveSockets.ni.dll
2014-05-02 11:52 - 2014-05-02 11:52 - 00599040 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\irrKlang.NET4.dll
2014-05-02 06:55 - 2014-05-02 06:55 - 00185344 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpflac.dll
2014-05-02 06:05 - 2014-05-02 06:05 - 00173056 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpmp3.dll
2016-11-25 08:16 - 2016-11-25 08:16 - 00192200 _____ () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
2017-02-08 13:29 - 2017-02-23 20:35 - 04489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-25 01:20 - 2016-09-25 01:21 - 00189264 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-11-15 16:22 - 2016-11-15 16:22 - 08909504 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-02-13 00:31 - 2017-02-13 00:31 - 00230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2016-11-23 21:41 - 2016-09-07 06:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 18:48 - 2016-12-21 09:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-22 11:19 - 2017-02-22 11:19 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 13:30 - 2017-02-06 13:30 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 02259968 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\ffmpeg.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 02917376 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\libglesv2.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 00095232 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\libegl.dll
2017-04-06 08:58 - 2017-04-06 08:58 - 00486912 _____ () \\?\C:\Users\Pascal\AppData\Local\Temp\71A5.tmp.node
2017-01-19 05:22 - 2017-01-19 05:22 - 00298448 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
2017-01-11 18:48 - 2016-12-21 08:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 18:48 - 2016-12-21 08:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 53908056 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_browser.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 59948632 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_child.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 02559576 _____ () C:\Program Files\Opera\43.0.2442.1144\libglesv2.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 00100952 _____ () C:\Program Files\Opera\43.0.2442.1144\libegl.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2017-01-26 21:21 - 2017-03-14 11:03 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 03774400 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00900032 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-04-05 11:10 - 2017-04-06 08:58 - 00619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll
2017-03-21 22:03 - 2017-03-21 22:03 - 67310648 _____ () C:\Program Files (x86)\Overwolf\0.103.44.0\libcef.DLL
2016-12-14 00:42 - 2012-07-08 17:31 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\hiddriver.dll
2017-01-02 12:34 - 2014-03-18 10:45 - 00045056 _____ () C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\hiddriver.dll
2017-02-20 10:10 - 2017-02-20 10:10 - 00143824 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 50656768 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 01874944 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 00075264 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll
2017-02-08 13:29 - 2017-02-23 16:30 - 00338488 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00252352 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2017-02-08 13:29 - 2017-02-23 16:30 - 02443320 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00385592 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2017-02-08 13:30 - 2017-02-23 16:30 - 00543288 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00468536 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-11-15 16:23 - 2016-11-15 16:23 - 08909504 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [432]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [432]
AlternateDataStreams: C:\Users\Pascal:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT2 [432]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-16 13:47 - 2017-04-06 10:20 - 00007580 ____A C:\Windows\system32\Drivers\etc\hosts

 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 127.0.0.1      union.baidu2019.com
 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 127.0.0.1      union.baidu2019.com
 92.53.119.169 a.bf-ad.net                                                                                                                               
 92.53.119.169 a.visualrevenue.com                                                                                                               
 92.53.119.169 a1.vdna-assets.com                                                                                                               
 92.53.119.169 a248.e.akamai.net                                                                                                               
 92.53.119.169 aax.amazon-adsystem.com                                                                                                       
 92.53.119.169 ad.crwdcntrl.net                                                                                                                       
 92.53.119.169 ad.mail.ru                                                                                                                               
 92.53.119.169 ade.clmbtech.com                                                                                                                       
 92.53.119.169 ads.adfox.ru                                                                                                                               
 92.53.119.169 ads.pubmatic.com                                                                                                                       
 92.53.119.169 apis.google.com                                                                                                                       
 92.53.119.169 asset.pagefair.net                                                                                                               
 92.53.119.169 assets.adobedtm.com                                                                                                               
 92.53.119.169 assets.flocktory.com                                                                                                               
 92.53.119.169 autocontext.begun.ru                                                                                                               
 92.53.119.169 b.grvcdn.com                                                                                                                               
 92.53.119.169 b.ns1p.net                                                                                                                               
 92.53.119.169 b.scorecardresearch.com                                                                                                       
 92.53.119.169 b.wal.co                                                                                                                                       
 92.53.119.169 babator-stg-cdn.babator.com                                                                                               
 92.53.119.169 beacon.krxd.net                                                                                                                       
 92.53.119.169 beacon.walmart.com                                                                                                               
 92.53.119.169 c.amazon-adsystem.com                                                                                                       
 92.53.119.169 c.vepxl1.net                                                                                                                               
 92.53.119.169 c2.taboola.com                                                                                                                       
 92.53.119.169 cdn.3lift.com                                                                                                                       
 92.53.119.169 cdn.admixer.net                                                                                                                       
 92.53.119.169 cdn.brcdn.com                                                                                                                       
 92.53.119.169 cdn.cxense.com                                                                                                                       
 92.53.119.169 cdn.interactivemedia.ne                                                                                                       
 92.53.119.169 cdn.krxd.net                                                                                                                               
 92.53.119.169 cdn.lenmit.com                                                                                                                       
 92.53.119.169 cdn.livefyre.com                                                                                                                       
 92.53.119.169 cdn.m-pathy.com                                                                                                                       
 92.53.119.169 cdn.mathjax.org                                                                                                                       
 92.53.119.169 cdn.mxpnl.com                                                                                                                       
 92.53.119.169 cdn.onthe.io                                                                                                                               
 92.53.119.169 cdn.optimizely.com                                                                                                               
 92.53.119.169 cdn.prom.st                                                                                                                               
 92.53.119.169 cdn.pushwoosh.com                                                                                                               
 92.53.119.169 cdn.scarabresearch.com                                                                                                       
 92.53.119.169 cdn.taboola.com                                                                                                                       
 92.53.119.169 cdn.taplytics.com                                                                                                               
 92.53.119.169 cdn.tt.omtrdc.net                                                                                                               
 92.53.119.169 cdn.unid.go.com                                                                                                                       
 92.53.119.169 cdn1.graphiq.com                                                                                                                       
 92.53.119.169 cdn3.optimizely.com                                                                                                               
 92.53.119.169 cdnjs.cloudflare.com                                                                                                               
 92.53.119.169 cdnssl.clicktale.net                                                                                                               
 92.53.119.169 comet.yahoo.com                                                                                                                       
 92.53.119.169 consent.truste.com                                                                                                               
 92.53.119.169 content.adriver.ru                                                                                                               
 92.53.119.169 contextual.media.net                                                                                                               
 92.53.119.169 cstatic.weborama.fr                                                                                                               
 92.53.119.169 d134l0cdryxgwa.cloudfront.net                                                                                       
 92.53.119.169 d2oh4tlt9mrke9.cloudfront.net                                                                                       
 92.53.119.169 dpm.demdex.net                                                                                                                       
 92.53.119.169 e.monetate.net                                                                                                                       
 92.53.119.169 edge.quantserve.com                                                                                                               
 92.53.119.169 edx-uk.s3ae.com                                                                                                                       
 92.53.119.169 eu-services.babator.com                                                                                                       
 92.53.119.169 fc.yahoo.com                                                                                                                               
 92.53.119.169 gaua.hit.gemius.pl                                                                                                               
 92.53.119.169 gde-default.hit.gemius.pl                                                                                               
 92.53.119.169 go.flx1.com                                                                                                                               
 92.53.119.169 googleadservices.com                                                                                                               
 92.53.119.169 hpr.outbrain.com                                                                                                                       
 92.53.119.169 i.cricketcb.com                                                                                                                       
 92.53.119.169 i.tfag.de                                                                                                                               
 92.53.119.169 ib.adnxs.com                                                                                                                               
 92.53.119.169 imagesrv.adition.com                                                                                                               
 92.53.119.169 img.imgsmail.ru                                                                                                                       
 92.53.119.169 img7.auto.ria.com                                                                                                               
 92.53.119.169 j.ophan.co.uk                                                                                                                       
 92.53.119.169 js-agent.newrelic.com                                                                                                       
 92.53.119.169 js-sec.indexww.com                                                                                                               
 92.53.119.169 js.revsci.net                                                                                                                       
 92.53.119.169 js.ui-portal.de                                                                                                                       
 92.53.119.169 kamradamnaradost.ru                                                                                                               
 92.53.119.169 kpmediagaua.hit.gemius.pl                                                                                               
 92.53.119.169 level1cdn.com                                                                                                                       
 92.53.119.169 mc.yandex.ru                                                                                                                               
 92.53.119.169 ml314.com                                                                                                                               
 92.53.119.169 mtrx.go.sonobi.com                                                                                                               
 92.53.119.169 ninja.onap.io                                                                                                                       
 92.53.119.169 o.aolcdn.com                                                                                                                               
 92.53.119.169 odb.outbrain.com                                                                                                                       
 92.53.119.169 ok-bar.love.mail.ru                                                                                                               
 92.53.119.169 ok-portal.mail.ru                                                                                                               
 92.53.119.169 optimize-stats.voxmedia.com                                                                                               
 92.53.119.169 p.d.0fmm.com                                                                                                                               
 92.53.119.169 p.t-online.de                                                                                                                       
 92.53.119.169 pagead2.googlesyndication.com                                                                                       

Da befinden sich 60 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3959254474-2508283465-2998445632-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pascal\Pictures\Cool_Desktop_Wallpapers_with_Nvidia_Logo_in_Black_and_Green-1360x768.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
HKLM\...\StartupApproved\Run32: => "avgnt"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Gaijin.Net Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "SuperF4"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "f.lux"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{6DC6B0E4-B86F-453F-AFA5-E4839E53DD7D}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{D4D10190-59E1-4A96-8D8E-793DDBB2D763}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{772F321C-16DF-4C1F-A0F6-63CAF831811D}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{BEA8259B-7D01-44A2-9FF6-25124EF224D2}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{FAACF73E-D625-44CD-853F-891509F551B2}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{D2B0BC15-D518-4585-AB3E-47A7700B4AA4}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{C50678ED-E3F3-4AA3-9A6C-3069F6CDB719}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{EFACD55C-979F-4E4B-9AF0-A7CC9B48F74B}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [{4705292B-D46B-4A3D-B527-3783D8E1AE3C}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe
FirewallRules: [{786F89FF-F2FB-4A85-84B2-4F898D864FE0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

==================== Wiederherstellungspunkte =========================

17-03-2017 11:44:32 DirectX wurde installiert
24-03-2017 20:48:55 Geplanter Prüfpunkt
01-04-2017 20:18:07 DirectX wurde installiert
03-04-2017 20:19:35 DirectX wurde installiert
05-04-2017 11:29:54 Nach dem Adware angriff
05-04-2017 21:27:17 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: LogMeIn Hamachi Virtual Ethernet Adapter
Description: LogMeIn Hamachi Virtual Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn Inc.
Service: Hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "WmiApRpl" in der DLL "C:\Windows\system32\wbem\wmiaprpl.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (04/06/2017 11:03:32 AM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Das Serverdienst-Leistungsobjekt kann nicht geöffnet werden. Die ersten vier Bytes (DWORD) des Datenabschnitts enthalten den Statuscode.

Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "MSDTC" in der DLL "C:\Windows\system32\msdtcuiu.DLL" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "Lsa" in der DLL "C:\Windows\System32\Secur32.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "ESENT" in der DLL "C:\Windows\system32\esentprf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (04/06/2017 11:03:31 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm League of Legends.exe, Version 7.7.182.1428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 11bc

Startzeit: 01d2aeb2423b1a5c

Beendigungszeit: 4294967295

Anwendungspfad: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.169\deploy\League of Legends.exe

Berichts-ID: e71524e6-1aa7-11e7-a2dd-7085c209549d

Vollständiger Name des fehlerhaften Pakets:

Auf das fehlerhafte Paket bezogene Anwendungs-ID:

Error: (04/06/2017 09:35:28 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST Software\Avast\setup\iplugins\IStats.dll".
Die abhängige Assemblierung "Avast.VC110.CRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/06/2017 07:40:57 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0


Systemfehler:
=============
Error: (04/06/2017 11:03:24 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (04/06/2017 09:54:13 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (04/06/2017 08:59:16 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Avira Webschutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der Dienst konnte nicht gestartet werden.

Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Avira Email-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der Dienst konnte nicht gestartet werden.

Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (04/06/2017 08:57:50 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (04/06/2017 08:57:50 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (04/06/2017 08:57:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinDefend" wurde aufgrund folgenden Fehlers nicht gestartet:
Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.


CodeIntegrity:
===================================
  Date: 2017-04-06 11:53:07.421
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 11:53:07.410
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 11:52:15.426
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 11:52:15.356
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 08:57:49.637
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-04-06 08:12:41.630
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 08:12:41.560
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 08:12:07.830
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 08:12:07.815
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.

  Date: 2017-04-06 08:11:36.702
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 30%
Installierter physikalischer RAM: 16321.99 MB
Verfügbarer physikalischer RAM: 11304.32 MB
Summe virtueller Speicher: 18753.99 MB
Verfügbarer virtueller Speicher: 12596.12 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:232.44 GB) (Free:90 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.41 GB) (Free:129.29 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C802C2A9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C802C2D1)
Partition 1: (Not Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

==================== Ende von Addition.txt ============================
--- --- ---

cosinus 06.04.2017 11:08
Bitte Avast deinstallieren, am besten mit revo. Das Teil können wir einfach nicht mehr guten Gewissens empfehlen. => Antivirensoftware: Schutz Für Ihre Dateien, Aber Auf Kosten Ihrer Privatsphäre? | Emsisoft Blog

Auch andere Freewareanbieter wie Avira, AVG oder Panda springen auf diesen oder ähnlichen Zügen rauf, basteln Junkware in die Setups, arbeiten mit ASK zusammen etc; so was ist bei Sicherheitssoftware einfach inakzeptabel.


Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Avast Free Antivirus

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 






Gib Bescheid wenn Avast weg ist; wenn wir hier durch sind, kannst du auf einen anderen Virenscanner umsteigen, Infos folgen dann im Abschlussposting. Bitte JETZT nix mehr ohne Absprache installieren!

MrKaru 06.04.2017 11:15
Avast ist runter.

cosinus 06.04.2017 11:20
Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

MrKaru 06.04.2017 11:35
Code:
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 10.0.9200 Windows 10 x64

Account is Administrative

Internet Explorer version: 11.576.14393.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 3.192000 GHz
Memory total: 17114845184, free: 13719511040

Downloaded database version: v2017.04.06.02
Downloaded database version: v2017.04.02.01
Downloaded database version: v2017.04.03.01
=======================================
Initializing...
Driver version: 0.3.0.4
------------ Kernel report ------------
    04/06/2017 12:23:49
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\cng.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volume.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\drivers\iorate.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\ElbyCDIO.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_a140581a8f8b58b7\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\e1i63x64.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\nvvhci.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\ScpVBus.sys
\SystemRoot\System32\drivers\VClone.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win7.sys
\SystemRoot\system32\DRIVERS\vbaudio_cable64_win7.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\fwlanusb6.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\wcifs.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\wcnfs.sys
\SystemRoot\System32\drivers\registry.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\system32\drivers\mmcss.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\Windows\system32\drivers\rzpnk.sys
\??\C:\Windows\system32\drivers\rzpmgrk.sys
\??\C:\Windows\SysWoW64\speedfan.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\drivers\WinisoCDBus.sys
\SystemRoot\System32\drivers\condrv.sys
\SystemRoot\System32\drivers\tunnel.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2017.04.06.02
  rootkit: v2017.04.02.01

<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffac09534ee060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffac09534eeae0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffac09534ee060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffac0952341690, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b16c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b19400, DeviceName: \Device\00000032\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffac09534ef060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffac0953404ae0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffac09534ef060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffac0952b14c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b15e40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952a83060, DeviceName: \Device\00000031\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C802C2A9

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1953312768
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Drive 1
This is a System drive
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C802C2D1

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048  Numsec = 487469056
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Other (0x27)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 487471104  Numsec = 921600
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Done!
File "C:\Users\Pascal\AppData\Local\Comms\UnistoreDB\store.vol" is sparse (flags = 32768)
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Scan finished
Creating System Restore point...
Cleaning up...
Removal successful. No system shutdown is required.
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-487471104-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removal finished

cosinus 06.04.2017 11:48
Anleitung richtig lesen - richtiges Log posten.

MrKaru 06.04.2017 11:50
Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.04.06.02
  rootkit: v2017.04.02.01

Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]

06.04.2017 12:23:53
mbar-log-2017-04-06 (12-23-53).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309147
Time elapsed: 8 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 92
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a.bf-ad.net                                                                                                                                ) Good: () -> Replace on reboot. [607a5a938622d660308039119d6413ed]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [efeb32bbf6b22e08a50b99b1ba47926e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [1dbd2ebf1e8ac86e8729e5659869b34d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.) Good: () -> Replace on reboot. [e1f939b40c9cc86ee0d082c824ddd030]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [e7f3c825317770c65f518ac0df2251af]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [f6e4737ab4f4e254c3ed1a30fc05f50b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czz) Good: () -> Replace on reboot. [a139ea0324846dc9139d07439f621ae6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czz) Good: () -> Replace on reboot. [4e8c14d9ebbd66d005ab96b451b002fe]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsy) Good: () -> Replace on reboot. [fddd5d905553290d8d236fdbdf22db25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzsy) Good: () -> Replace on reboot. [8456a845efb92214b7f990baf90845bb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzx) Good: () -> Replace on reboot. [5486cc2180281a1cded2b595e918b44c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [12c82bc220881125555beb5f1ae7926e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [6f6b07e6bcec7fb7cbe5b3977a87a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [4e8cab4205a3a393f4bc59f142bfdb25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [b822f1fcd4d41c1a3c7473d708f905fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [86548b628127979f4a6679d17f829967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.) Good: () -> Replace on reboot. [8357c726b2f6b482129ec28842bfad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [8e4c5a93a008a195e5cbad9dc73a0bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
 127.0.0.1      www.czzsyzx) Good: () -> Replace on reboot. [895128c5a800db5bcae64bffa25f5ba5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [786232bbd1d73204f4bc76d4b24f9b65]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zgm.com
 127.0.0.1      www.czzsyzxl.com
 ) Good: () -> Replace on reboot. [eaf043aa3672072ffdb392b80af7d030]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [d406717c1791fd39f5bbf1596d943dc3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czz) Good: () -> Replace on reboot. [a03ada13deca290d931d0941926f10f0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czz) Good: () -> Replace on reboot. [37a379748b1d251109a7c981da279769]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzs) Good: () -> Replace on reboot. [a83249a4396f70c67937af9be51cac54]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzs) Good: () -> Replace on reboot. [8753e20b941438feb8f8f45638c9e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [5d7d97565a4e4de9fdb3d07aaf526898]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [0ad018d503a550e6b7f92b1fda2743bd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [eeecf1fc3c6c9e98169a1a30e8197789]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [4496cc2106a28caacbe554f6778a738d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.cz) Good: () -> Replace on reboot. [1fbb628b8f194cea8927a2a89a6711ef]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [43975c91bcec52e44b651b2fd42df10f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsy) Good: () -> Replace on reboot. [bd1d7a73c5e3eb4bd0e057f3c8393fc1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
 127.0.0.1      www.czzs) Good: () -> Replace on reboot. [439718d5e6c20036b9f73416c0412ed2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [fcdec12cd5d30b2b515f69e1b44db54b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [7c5e638adbcd092d525e08428c754bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyzx) Good: () -> Replace on reboot. [c218ce1f4860b581169ab9918c75fb05]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [6a700de06246f442803087c391702cd4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [1ebc727b10981224218f0c3e6998916f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [904a925b1395fa3cfbb5a2a860a1e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [706a836a258347efbdf30446f11044bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [4a909e4fb2f639fd911fb29811f0e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 127.) Good: () -> Replace on reboot. [0cce2dc08c1ce0563779123850b107f9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
 127.0.0.1      www.czzsyzxl.com
 127.0.0.1  ) Good: () -> Replace on reboot. [499132bb01a776c059578bbf22df3bc5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
 127.0.0.1      www.czzsyzxl.com
 ) Good: () -> Replace on reboot. [bd1dcc21565286b0149ca3a7ce33b14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czzs) Good: () -> Replace on reboot. [eaf08d608523e84e2789b19923de8878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [ae2c00ed9711af87585819312ad7f20e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.) Good: () -> Replace on reboot. [cd0da6475a4ef83ea40c3e0c6f928779]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [aa30b5380c9c7cba1d93aaa0d62b0af6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 ) Good: () -> Replace on reboot. [ffdb5d90a800e155e0d0aaa02ad72bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [f6e41bd27f29c274f7b91139fa072bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzx) Good: () -> Replace on reboot. [f5e5d617bbed34022c842c1e1ee327d9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [62788469713772c4f8b86fdba160728e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.c) Good: () -> Replace on reboot. [29b1d31a6048989e416fd674709143bd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www) Good: () -> Replace on reboot. [904ad21b5454df57cde346046e93936d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [03d7e30a2187ab8b565a4703ba47b947]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [31a918d55f4947ef0aa6450526db0cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [39a103ea6840bc7a4967034703fe2ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.) Good: () -> Replace on reboot. [4e8c44a9268241f5c6eab59515ec5ca4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 1) Good: () -> Replace on reboot. [08d2618cc9dfc86ef7b995b5ce332fd1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [d80234b9ccdcfe38139de66408f90cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www) Good: () -> Replace on reboot. [9e3c0de00e9a69cdac04d17933ce3bc5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czz) Good: () -> Replace on reboot. [ae2c20cd11974bebe0d08dbd50b1b749]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.c) Good: () -> Replace on reboot. [22b800edb3f565d1f4bc410934cd0cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 1) Good: () -> Replace on reboot. [7565b13cc5e34de9d7d94efcd32e19e7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [32a822cb9216e6508a26ff4bf40d0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [6b6f7875e2c65dd9159bcc7e11f037c9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
 127.0.0.1      www.czzsyzxl.com
 127.0.0.) Good: () -> Replace on reboot. [f0ea7e6f28801c1abff1b991f50c23dd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [9842c627e0c84fe7f8b8cf7b9e63b44c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.c) Good: () -> Replace on reboot. [1dbd16d7c7e1191d941c76d406fbc838]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.) Good: () -> Replace on reboot. [6773707dddcb3501e2ced47633cebd43]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czzsy) Good: () -> Replace on reboot. [c81206e78820e94d2987024811f035cb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [23b78e5f6e3aa1958a2697b3a45dc13f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [3c9edb12c7e12c0ac0f0dc6e16ebfd03]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [a8323ab3446446f0832d4bff52af916f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.) Good: () -> Replace on reboot. [8159d21b71376fc7624e52f8d130a65a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com) Good: () -> Replace on reboot. [6179faf3307860d6892751f9a35e47b9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 12) Good: () -> Replace on reboot. [02d8f2fbbcecc1757937c48628d90000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (yzgm.com
 127.0.0.1      www.czzsyzxl.com
 127.0.0) Good: () -> Replace on reboot. [fae0df0e6b3d1d193f71a7a32bd6e61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (yzgm.com
 127.0.0.1      www.czzsyzxl.com
 ) Good: () -> Replace on reboot. [627810dd1692b3830ea279d1bc45c739]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 127) Good: () -> Replace on reboot. [13c7d617c5e339fd3c7493b748b9b14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m.com
 127.0.0.1      www.czzsyzxl.com
 12) Good: () -> Replace on reboot. [5b7fd21b792f270f3e7253f74cb56a96]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
 127.0.0.1      www.czzsyzxl.com
 1) Good: () -> Replace on reboot. [0fcb9c51dccc52e499170644ad54ae52]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
 127.0.0.1      www.czzsyzxl.) Good: () -> Replace on reboot. [03d71ecf248478becfe10644639e2bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
 127.0.0.1      www.czzsyzxl.) Good: () -> Replace on reboot. [cb0f7d7041679a9cf2be9eac18e9dd23]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 1.www.czzsyzgm.com
 127.0.0.1      www.czzsyz) Good: () -> Replace on reboot. [439718d5e5c3e452555bcf7b17ea0bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
 127.0.0.1      www.czzsyzxl.co) Good: () -> Replace on reboot. [f4e61dd0edbb2d093f715bef3bc635cb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.com
 12) Good: () -> Replace on reboot. [d5057e6f664205318d235cee8a7705fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
 127.0.0.1      www.czzsyzxl) Good: () -> Replace on reboot. [15c54ba2693fcd691f91094108f9d42c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.com
 127.0) Good: () -> Replace on reboot. [25b5bd30396f52e4dfd1b4960ef3e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
 127.0.0.1      www.czzsyzxl.com
) Good: () -> Replace on reboot. [b42637b64a5e290d5a5650faf40dde22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
 127.0.0.1      www.czzsyzx) Good: () -> Replace on reboot. [2eac8568a7016fc7dad655f5f50c32ce]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 06.04.2017 12:07
Du sollst was machen wenn MBAR fündig wurde?

MrKaru 06.04.2017 15:29
Läuft gerade :)

Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.04.06.02
  rootkit: v2017.04.02.01

Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]

06.04.2017 13:12:48
mbar-log-2017-04-06 (13-12-48).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309154
Time elapsed: 8 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 91
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a.visualrevenue.com                                                                                                                ) Good: () -> Replace on reboot. [62788d6041679a9cd8d89eacd22fc739]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [3e9c24c963459e9806aacf7b22df44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [2fab16d7891fc472ab054109cb368977]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [8d4d7d70e8c0e94da10fa9a1ce3357a9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [904a4aa3e1c7bf773c7452f825dc4bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [ba2044a9ccdcf93db6fa88c2c73a2ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [2baf00ed4266e94dc7e925250df40df3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
x) Good: () -> Replace on reboot. [607a14d9c7e16dc903ad39119869cb35]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
x) Good: () -> Replace on reboot. [23b7d01d218760d6dad6c882a1601de3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.) Good: () -> Replace on reboot. [6d6da64717915adca9071139ae538c74]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [5f7b07e63e6a42f4f4bc0446738e9070]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [c21835b8ccdc47efd7d98ac0d82939c7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [e3f7f6f7bfe9280e0da3b991ab5626da]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 1) Good: () -> Replace on reboot. [5c7e925b733539fd0da350fac14015eb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [ae2c2cc118904aecf9b7440612efaa56]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.c) Good: () -> Replace on reboot. [d8025d90dbcdf244d9d7ef5b34cd5ea2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [d40699541098ba7ca60a7cce8f720ef2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com
xl.) Good: () -> Replace on reboot. [29b1ffee792ffd39832d202af30e1be5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [409ad5188c1c60d6bdf31b2fe61bba46]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1      union.baidu2019.com
xl.com
 12) Good: () -> Replace on reboot. [6e6c727b02a683b33e7246047190a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [904ae5084e5aca6c238d242660a1966a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [5288509db8f053e3149c400ab64b22de]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [8a50c528d7d155e13779e169976ab14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [c61435b83a6e1a1c7838a4a6e819e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [8e4c45a8decabf778f2179d15fa25da3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [16c49b525652989ea40c36149071b64a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [a63405e807a1e84ea60a78d2818024dc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [42985f8e2f79979f7e32fc4ee12048b8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [5f7bf7f6bfe9072f169a33178f728d73]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com) Good: () -> Replace on reboot. [4397fbf2beea0234c5eb5eec5fa21ee2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [dcfe4f9ecbddb581317f1535a0617c84]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
x) Good: () -> Replace on reboot. [0ecc638a7335b77fe5cb5cee30d1df21]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [eaf08c611f89ce681a96153556abc937]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [8b4fcc21d8d06ec857590743907129d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [0bcf559815932115ebc51f2be120a65a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl.) Good: () -> Replace on reboot. [0ad034b9f8b06accb4fc0f3b43be44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [da00ae3f495f47ef4a669fab33cec13f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [d2086d80693fec4a4967183214ed7d83]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [6872737a0d9b66d006aa202a40c130d0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [cd0d37b69414f343218f143621e07987]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [1ac0529b96129a9cfbb562e818e9e61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 127.0.) Good: () -> Replace on reboot. [16c4cf1e9c0cb185c1ef96b4768b46ba]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1      union.baidu2019.com
xl.com
 127.0.0.1    ) Good: () -> Replace on reboot. [2fabd01d6e3ab284c8e828223cc53ac6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1      union.baidu2019.com
xl.com
 12) Good: () -> Replace on reboot. [26b4dd101b8df93d2d833a10a55c44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [706a9b5243652e08b2fe5febb84947b9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [4d8d7677c7e1072fa20eb7937e83669a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [a83209e45c4c3402d3dd2e1c4fb220e0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [20ba6b821692ba7c882863e712ef857b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.com
 12) Good: () -> Replace on reboot. [ae2c7f6ed8d063d3c8e83c0e0ef37f81]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [18c28568594f54e2961a3e0c48b98878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
 127.0.0.1      union.baidu2019.com
xl.) Good: () -> Replace on reboot. [409ab6375256e155555b4505f70aac54]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [568437b6882055e15957183244bd59a7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.co) Good: () -> Replace on reboot. [5c7ebb32a107290d7b357fcb9d64ad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.) Good: () -> Replace on reboot. [be1c9b528127ee487f3183c759a8b64a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [48926a8316920a2cf0c06fdbfb0650b0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [0dcdf1fca2061b1bd0e01b2fca37e719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [dcfea4498523a78f5f51e961c839629e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [499199543276c472e3cde66461a0f50b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 127) Good: () -> Replace on reboot. [f1e94da07d2b142287294a00ed1438c8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [3d9d8865e6c205310aa69ab0827f31cf]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.) Good: () -> Replace on reboot. [d901af3e5e4ad95d8c24d575db266b95]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [479315d86b3ded49e3cd9baf4ab7f30d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [9941618c02a62d092a8668e257aa8878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.com
 127) Good: () -> Replace on reboot. [23b788650e9ac175a60ad476010018e8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [b62486676d3b9d996b45103a3ec3ee12]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
xl.com
 1) Good: () -> Replace on reboot. [499144a920887cba69473812f70ade22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1      union.baidu2019.com
xl.com
 127.0.0.1 ) Good: () -> Replace on reboot. [2ab041ac792f2412ffb174d6847d21df]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [31a99b5223852412169a2921bf4242be]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.co) Good: () -> Replace on reboot. [4b8f36b7931526107d334efc3dc419e7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.c) Good: () -> Replace on reboot. [20bad518198f0630e9c72525f11017e9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
x) Good: () -> Replace on reboot. [508a74791296cb6b4e62bd8d0ff2d927]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [ad2d40ad4860cd6903adc98150b1fc04]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [c81257964860e254129e0743c938f40c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [27b3f0fdaff955e1a808381220e1a759]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.c) Good: () -> Replace on reboot. [f2e81ecf5157ee482f81ce7c5ca5fd03]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [4d8d4aa3ccdce1551f91e26804fdb34d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.com
 127.) Good: () -> Replace on reboot. [8357e904edbbd3630ca4e66403fed927]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com
xl.com
 127.0.0.1) Good: () -> Replace on reboot. [ffdba746dccc4cea179966e4d42d7c84]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com
xl.com
 12) Good: () -> Replace on reboot. [19c1e30a278178be8c243b0f05fc40c0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
xl.com
 127.0) Good: () -> Replace on reboot. [f7e38f5e9d0b95a12f81c08afe03fc04]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1      union.baidu2019.com
xl.com
 127.) Good: () -> Replace on reboot. [a93118d5693fee4806aa4307ae5322de]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com
xl.com
 127) Good: () -> Replace on reboot. [9644707dcddbeb4bab0591b946bba759]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [5a8034b9792fd75faa06b09a69989967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [9248905d347465d1c2ee9fab0ff2ce32]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
xl) Good: () -> Replace on reboot. [5585ed0056520d29654b9ab0e120bf41]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [9446db1261471d197b358cbe41c00cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com
 127.) Good: () -> Replace on reboot. [f0ea8c617a2e2a0c6749381214ed0af6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [4e8c38b54167d363713fc387a45df907]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com
 127.0.0) Good: () -> Replace on reboot. [32a8db12c0e8f93db8f862e8e0213ac6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com
xl.com
 ) Good: () -> Replace on reboot. [e2f801eca60243f37b35b09a946d8b75]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com
xl.) Good: () -> Replace on reboot. [fddd4ca1179178be743cd179c938c33d]

Physical Sectors Detected: 0
(No malicious items detected)

(end)
So nun nach meiner Abwesenheit habe ich es NOCHMAL gemacht Ergebnis:
Hijack kommt immer wieder :
Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.04.06.02
  rootkit: v2017.04.02.01

Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]

06.04.2017 16:16:02
mbar-log-2017-04-06 (16-16-02).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309681
Time elapsed: 8 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 90
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a1.vdna-assets.com                                                                                                                ) Good: () -> Replace on reboot. [ae2cfeef0c9c0f27d0e0cc7e3ac7a060]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 9) Good: () -> Replace on reboot. [ac2e14d9e8c0c76f0aa63a1025dc3fc1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [f7e3f7f6beea082e1e92f456ea1712ee]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [37a3ab42cfd94bebd1df46045ba629d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [7565d21b98101c1ac7e94604877a6f91]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [30aa608ddcccd264783871d9a55c7987]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [588245a8b7f160d6dcd405456d94d729]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [d90116d760483df91b95fd4df70a9d63]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [5882e10c4e5a71c5f8b842086e93ca36]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [7e5c608dd4d4fd39605091b9669bd22e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [21b9b439e1c795a1a20e42082ad75ba5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [05d53cb11692b383aa0684c641c08878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 92.53.) Good: () -> Replace on reboot. [29b1ca231a8ea393eac60743ca378e72]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [37a3c12c495f57df179988c2fc056b95]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.co) Good: () -> Replace on reboot. [68725e8fe4c48da9c1efe26858a9758b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [91499954b9efdb5bf9b794b62ad729d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [32a8d11c951370c6456b6ae031d03cc4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [af2beeff9810a4927838c08a34cdcb35]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1      union.baidu2019.com


 92.53.1) Good: () -> Replace on reboot. [ab2f1dd07f2988aeb8f884c61ce5c23e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [766448a5535568ceefc18fbb5ca5ec14]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [3aa02ac31f89d3632090b793d42d9967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [94462dc03d6b6bcba20e92b8e120d42c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [578311dc238542f4664a22280bf6db25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [4b8fb03d198f280e723e4ffb09f8a858]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [eeec7776f8b0072fbcf4c189e819d22e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [fae00ce1abfd290db7f9a2a86f9229d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [e7f3618c169288ae8030222846bbe41c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [6c6e8964a602d6609020db6f847d0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [a139945985239e9818988ebc14ed34cc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [67737e6f28809c9a149cb8929d6449b7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [845633baa50357dfdbd52129b44db947]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [4991886506a2a591e7c960ea02ffd729]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [5d7dcf1e1a8e26108030123857aa6898]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [6773cb22307886b0d2dead9ddc250bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [e2f866876a3e4de903ad193190719e62]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [fddde9045553d660f7b92a2026db2dd3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [5e7cdf0e34743105248cf5553bc6847c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [e5f527c6eabeb97d0fa1ae9cbf42c040]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [fbdfc8251890fb3bded2f65453ae0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [17c3905d2088270f9a1688c2cd3428d8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92.53.119.1) Good: () -> Replace on reboot. [27b3ffee8424181e644cec5e19e854ac]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1      union.baidu2019.com


 92.53.119.169 a1.v) Good: () -> Replace on reboot. [cc0e68855e4a2c0ab1ffd2784bb6857b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1      union.baidu2019.com


 92.53.1) Good: () -> Replace on reboot. [855543aa63458caa02ae87c320e105fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [e1f9e508f9af82b4fdb355f5768be51b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [cd0df8f52f7915210ba586c4f0112ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 9) Good: () -> Replace on reboot. [e6f434b963455ed803ad321813eed12f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [8f4ba944624635011c940f3b34cde719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 92.53.1) Good: () -> Replace on reboot. [ca100edfaff9ab8becc419318b76f10f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [d307707d1791d066edc36cdefd0453ad]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [e0fa8865783095a11799ea6009f8ae52]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [9644cf1edeca51e5268a2e1c8978e51b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com) Good: () -> Replace on reboot. [17c3e706e9bf77bfb9f7c7836a97e31d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.c) Good: () -> Replace on reboot. [18c2d91426825adcfcb4a0aa55acad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [bb1fa845387067cf258b4a001be6e020]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [e6f419d4f8b0ac8adad65ded827f9967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [786240ad70389e9809a75befc43da15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


 9) Good: () -> Replace on reboot. [11c9c4292d7b41f5bdf3c288a55c6997]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92.53.11) Good: () -> Replace on reboot. [65755d90b4f4003608a8c48643be6c94]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [fcde7e6fcedabc7ae2cedb6fa45dc43c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.c) Good: () -> Replace on reboot. [c812f0fda701e452cde3ef5b59a803fd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com
) Good: () -> Replace on reboot. [04d64ba26a3e1b1becc4de6c7c85be42]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92) Good: () -> Replace on reboot. [e1f9608d9e0a87af634d064415ec5fa1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 92.53.11) Good: () -> Replace on reboot. [04d600edaefa201699179cae60a1a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [fcdeec01e1c71a1c317f3812738ecd33]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com


 92.53.) Good: () -> Replace on reboot. [a1397578e1c7fd395e52b694a958ef11]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1      union.baidu2019.com


 92.53.119.169 a) Good: () -> Replace on reboot. [0ecc9756dbcdc175e4ccda707a87de22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [e1f914d95a4e37ffc9e70d3d827f4bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com) Good: () -> Replace on reboot. [c6142fbe63453600298756f40bf68080]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.co) Good: () -> Replace on reboot. [9149c825941481b5ac0460ea3cc5ee12]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com

) Good: () -> Replace on reboot. [ddfdf7f6981082b4b4fc0e3c8081ca36]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [1bbfc726416767cf3c7405451de48c74]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
 127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [8c4e35b8d7d15cda2b85a6a454ad7d83]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [6f6b608d288081b5f0c0a5a51de4b848]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.co) Good: () -> Replace on reboot. [4f8b3cb1aefa55e1b4fceb5f45bcb14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
 127.0.0.1      union.baidu2019.com


 92.5) Good: () -> Replace on reboot. [cd0d37b6426646f0654b78d2cd34639d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


 92.53.119) Good: () -> Replace on reboot. [1dbdcd20396f1224d6da252548b99a66]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1      union.baidu2019.com


 92.53.119.169 ) Good: () -> Replace on reboot. [75652fbe8c1c48eea30d004a7f8221df]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1      union.baidu2019.com


 92.53.1) Good: () -> Replace on reboot. [37a3826be2c675c1cbe5e862000116ea]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
 127.0.0.1      union.baidu2019.com


 92.53.119.) Good: () -> Replace on reboot. [6a70f9f45b4d55e1e5cbdd6d0ef3cf31]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.1      union.baidu2019.com


 92.53.119) Good: () -> Replace on reboot. [c41610dd495fa6904a66c28834cd817f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com


 92.53.11) Good: () -> Replace on reboot. [12c88f5ed1d770c6e6ca51f9946d7090]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1      union.baidu2019.com


 9) Good: () -> Replace on reboot. [57833bb2d0d895a11a96e66443bee61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1      union.baidu2019.com


 9) Good: () -> Replace on reboot. [a535d51868408fa7fcb4e268e918dc24]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [99415d900c9c02349e123f0b09f87789]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
 127.0.0.1      union.baidu2019.com


 92.) Good: () -> Replace on reboot. [f5e55598575105317e32d278a55c9e62]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92.53.119) Good: () -> Replace on reboot. [53877578feaa0f27e4cc7eccfe03e917]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
 127.0.0.1      union.baidu2019.com


 ) Good: () -> Replace on reboot. [34a6717c733594a26a46f456d829e719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92.53.119.16) Good: () -> Replace on reboot. [d5051ad38523a096f7b92e1c1de48f71]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1      union.baidu2019.com


 92.53) Good: () -> Replace on reboot. [12c8e00d22866ec85f5163e7bf42e41c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
 127.0.0.1      union.baidu2019.com


) Good: () -> Replace on reboot. [8f4baa43aff9ce686a463f0bba4752ae]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 06.04.2017 21:18
Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Wir haben leider noch ne ältere Anleitung vom adwCleaner, bitte nochmal ausführen und so einstellen:

http://saved.im/mtg4nzk1egdo/malware...r-settings.png




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


MrKaru 07.04.2017 07:54
AdwCleaner Logfile:
Code:
# AdwCleaner v6.045 - Bericht erstellt am 07/04/2017 um 08:44:52
# Aktualisiert am 28/03/2017 von Malwarebytes
# Datenbank : 2017-04-06.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : Pascal - DESKTOP-NBS516K
# Gestartet von : C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Keine schädlichen Dienste gefunden.


***** [ Ordner ] *****

Keine schädlichen Ordner gefunden.


***** [ Dateien ] *****

Keine schädlichen Dateien gefunden.


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Keine infizierten Verknüpfungen gefunden.


***** [ Aufgabenplanung ] *****

Keine schädlichen Aufgaben gefunden.


***** [ Registrierungsdatenbank ] *****

Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.


***** [ Internetbrowser ] *****

Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [17274 Bytes] - [05/04/2017 11:09:03]
C:\AdwCleaner\AdwCleaner[C2].txt - [3509 Bytes] - [05/04/2017 11:40:20]
C:\AdwCleaner\AdwCleaner[C3].txt - [1564 Bytes] - [05/04/2017 11:44:15]
C:\AdwCleaner\AdwCleaner[C4].txt - [1674 Bytes] - [05/04/2017 11:49:58]
C:\AdwCleaner\AdwCleaner[C5].txt - [2055 Bytes] - [05/04/2017 21:25:51]
C:\AdwCleaner\AdwCleaner[S0].txt - [15673 Bytes] - [05/04/2017 11:07:48]
C:\AdwCleaner\AdwCleaner[S1].txt - [3971 Bytes] - [05/04/2017 11:40:01]
C:\AdwCleaner\AdwCleaner[S2].txt - [1702 Bytes] - [05/04/2017 11:43:57]
C:\AdwCleaner\AdwCleaner[S3].txt - [1855 Bytes] - [05/04/2017 11:47:03]
C:\AdwCleaner\AdwCleaner[S4].txt - [1994 Bytes] - [05/04/2017 11:53:01]
C:\AdwCleaner\AdwCleaner[S5].txt - [2067 Bytes] - [05/04/2017 12:11:27]
C:\AdwCleaner\AdwCleaner[S6].txt - [2084 Bytes] - [05/04/2017 21:24:46]
C:\AdwCleaner\AdwCleaner[S7].txt - [2078 Bytes] - [07/04/2017 08:44:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [2151 Bytes] ##########
--- --- ---


Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.2 (03.10.2017)
Operating System: Windows 10 Pro x64
Ran by Pascal (Administrator) on 07.04.2017 at  8:46:33,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.04.2017 at  8:47:11,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Das normale Anti-Malware Programm von Malewarebytes findet immernoch die Hijacks.

cosinus 07.04.2017 08:16
Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken

http://www.trojaner-board.de/picture...&pictureid=611


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:12 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131