| AlfBauer | 21.09.2017 16:53 |
hallo, ok, sorry. hier nochmal die files:
[CODE]Additional
FRST Logfile: Code:
scan result of Farbar Recovery Scan Tool (x86) Version: 20-09-2017
Ran by Admin (21-09-2017 16:18:07)
Running from C:\Users\Admin\Desktop
Microsoft Windows 7 Ultimate Service Pack 1 (X86) (2015-01-09 05:03:06)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Admin (S-1-5-21-3638998829-643590200-863451022-1000 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-3638998829-643590200-863451022-500 - Administrator - Disabled)
Guest (S-1-5-21-3638998829-643590200-863451022-501 - Limited - Disabled) => C:\Users\Guest.Admin-PC
HomeGroupUser$ (S-1-5-21-3638998829-643590200-863451022-1005 - Limited - Enabled)
UpdatusUser (S-1-5-21-3638998829-643590200-863451022-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
3G Mobile Hotspot (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE Corporation)
7-Zip 16.04 (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
AMD Catalyst Install Manager (HKLM\...\{370E3242-3D7D-3F45-A95A-A986CBF0534B}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Components Setup (HKLM\...\{BDDEE95D-0671-4A38-AAF3-2A7D5801B323}) (Version: 1.00.0000 - Vimicro Corporation) Hidden
dtac aircard (HKLM\...\{93D34EE3-99B3-4DB1-8B0A-0A657466F90D}) (Version: 1.0.0.0 - dtac aircard)
Glary Utilities 5.58 (HKLM\...\Glary Utilities 5) (Version: 5.58.0.79 - Glarysoft Ltd)
Google Chrome (HKLM\...\Google Chrome) (Version: 60.0.3112.90 - Google Inc.)
Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
HotKeyBind 1.2 (HKLM\...\HotKeyBind_is1) (Version: 1.2 - Marco Barisione)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Microsoft .NET Framework 4.7 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 51.0.1 (x86 en-US)) (Version: 51.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 2 (HKLM\...\{4F0E15EA-F64C-11E5-9992-E717EA7DB0C8}) (Version: 2.0.3 - Werner Schweer and Others)
OEM Application Profile (HKLM\...\{ADAED067-B399-069C-3B99-29D93AACA64E}) (Version: 1.00.0000 - Ihr Firmenname)
PdaNet+ for Android 4.19 (HKLM\...\PdaNet_is1) (Version: - June Fabrics Technology Inc)
Python 2.7.13 (HKLM\...\{4A656C6C-D24A-473F-9747-3A8D00907A03}) (Version: 2.7.13150 - Python Software Foundation)
Revo Uninstaller 2.0.0 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.0 - VS Revo Group, Ltd.)
Skype™ 7.35 (HKLM\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.35.103 - Skype Technologies S.A.)
TAP-Windows 9.21.1 (HKLM\...\TAP-Windows) (Version: 9.21.1 - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VA HausDesigner Professional 2.0 (HKLM\...\{676BE939-4A20-4AFC-8A05-F929575219D4}) (Version: 2.01.0000 - VA Software Ltd.)
Windows Driver Package - Silicon Integrated Systems (uagp35) System (04/14/2010 7.2.0.1232) (HKLM\...\421AF4FC7DA3FA928071877E7EE33B3D2690C950) (Version: 04/14/2010 7.2.0.1232 - Silicon Integrated Systems)
Windows Resource Kit Tools (HKLM\...\{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}) (Version: 5.2.3790 - Microsoft Corporation)
ZTE Drivers v1.2074.0.5 (HKLM\...\{204694D0-D396-4435-900B-9D8448C4DF3E}) (Version: 1.2074.0.5 - ZTE CORPORATION)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x86.dll [2014-04-15] (Foxit Corporation)
ContextMenuHandlers1: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files\Glary Utilities 5\ContextHandler.dll [2016-06-23] (Glarysoft Ltd)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files\Glary Utilities 5\ContextHandler.dll [2016-06-23] (Glarysoft Ltd)
ContextMenuHandlers3: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files\AMD\ATI.ACE\Core-Static\atiacmxx.dll [2015-10-19] (Advanced Micro Devices, Inc.)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2009-05-01] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files\Glary Utilities 5\ContextHandler.dll [2016-06-23] (Glarysoft Ltd)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1A124166-8A33-4280-A102-4B2500B3AD21} - System32\Tasks\{75ADB40A-DE00-4815-83C1-F04DA3DCF1B5} => C:\Windows\system32\pcalua.exe -a "C:\Program Files\PdaNet for Android\drvins.exe" -d "C:\Program Files\PdaNet for Android"
Task: {1B9FC48A-CFF9-458C-AB9B-753784D87339} - System32\Tasks\d7e74ea7dc102706e549add1f2b2a478 => sc start d7e74ea7dc102706e549add1f2b2a478 <==== ATTENTION
Task: {25CF07B8-3E30-4EC8-B538-0D1AA4F84521} - System32\Tasks\{6D4E2D18-F741-439E-AE48-8904EDA48DF4} => C:\Windows\system32\pcalua.exe -a E:\Data\setup.exe -d E:\Data
Task: {3EF2E332-A5EE-4BA5-8356-EEB6C7402BBE} - System32\Tasks\{7605C983-44DA-4217-863C-FFD67EC79AE8} => C:\Windows\system32\pcalua.exe -a "C:\Users\Admin\Downloads\A4 PC Camera K\A4 PC Camera K.exe" -d "C:\Users\Admin\Downloads\A4 PC Camera K"
Task: {416A3F88-1939-4DA6-B4FB-6A82F6A96477} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-29] (Google Inc.)
Task: {531FBF5B-AB79-4A38-ABA2-D7AAA44522AB} - System32\Tasks\{E76917BE-1FFE-4A81-920B-2C1B6766D76D} => C:\Windows\system32\pcalua.exe -a C:\Users\Admin\Downloads\setup_titanic_mystery_2_CB-DL-Manager.exe -d C:\Users\Admin\Downloads
Task: {8BBA1893-4BA5-4D5C-8083-EB2FE24AEE0A} - System32\Tasks\{3F38DC33-F532-4487-B430-9241116C927E} => C:\Windows\system32\pcalua.exe -a C:\Users\Admin\Downloads\Connection_Manager_generic_EN_DE\Connection_Manager_generic_DE_EN\Install.exe -d C:\Users\Admin\Downloads\Connection_Manager_generic_EN_DE\Connection_Manager_generic_DE_EN
Task: {9E986D9B-8BFF-4623-8E22-70D8ADDC017A} - System32\Tasks\GU5SkipUAC => C:\Program Files\Glary Utilities 5\Integrator.exe [2016-08-19] (Glarysoft Ltd)
Task: {B527215E-AD58-4FC7-90BD-99EFD5D33594} - System32\Tasks\GlaryInitialize 5 => C:\Program Files\Glary Utilities 5\Initialize.exe [2016-08-19] (Glarysoft Ltd)
Task: {BC8E1A49-94C9-4584-A350-3EF39BB0370A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: {BF182101-B2F7-48E8-8D2B-D1C7C59C1C85} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-29] (Google Inc.)
Task: {C7831B34-A5C4-4423-8AC8-AC0DE83D0343} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {EAD2E0FE-55ED-4593-B41C-3127EDBE2860} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3638998829-643590200-863451022-1000
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\system32\Macromed\Flash\FlashUtil32_25_0_0_148_pepper.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\3G Mobile Hotspot.lnk -> C:\Program Files\3G Mobile Hotspot\LaunchWebUI.exe () -> hxxp://m.home
ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\Users\Public\Desktop\3G Mobile Hotspot.lnk -> C:\Program Files\3G Mobile Hotspot\LaunchWebUI.exe () -> hxxp://m.home
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
==================== Loaded Modules (Whitelisted) ==============
2017-08-09 03:48 - 2017-08-02 14:24 - 002881368 _____ () C:\Program Files\Google\Chrome\Application\60.0.3112.90\libglesv2.dll
2017-08-09 03:48 - 2017-08-02 14:24 - 000086360 _____ () C:\Program Files\Google\Chrome\Application\60.0.3112.90\libegl.dll
2016-08-19 16:31 - 2016-08-19 16:31 - 000086992 _____ () C:\Program Files\Glary Utilities 5\zlib1.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:20C00621 [132]
AlternateDataStreams: C:\ProgramData\TEMP:260575F1 [125]
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134]
AlternateDataStreams: C:\ProgramData\TEMP:4A471456 [129]
AlternateDataStreams: C:\ProgramData\TEMP:72C99D4E [226]
AlternateDataStreams: C:\ProgramData\TEMP:E6ECD578 [146]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 10:04 - 2016-09-03 10:44 - 000000035 _____ C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3638998829-643590200-863451022-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AntiRansomwareService => 3
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: CG6Service => 2
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: nvUpdatusService => 2
MSCONFIG\startupfolder: C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk => C:\Windows\pss\PdaNet Desktop.lnk.Startup
MSCONFIG\startupreg: autodetect => C:\Windows\system32\SupportAppXL\AutoDect.exe
MSCONFIG\startupreg: BigDog303 => C:\Windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files\Bluestacks\HD-Agent.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 6\CyberGhost.exe" /autostart /min
MSCONFIG\startupreg: Domino => C:\Windows\Domino.exe
MSCONFIG\startupreg: emsisoft anti-malware => "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: GUDelayStartup => "C:\Program Files\Glary Utilities 5\StartupManager.exe" -delayrun
MSCONFIG\startupreg: MalTray => C:\Program Files\Glarysoft\Malware Hunter\mhtray.exe /autorun
MSCONFIG\startupreg: Malwarebytes TrayApp => D:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
MSCONFIG\startupreg: MSC => "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: NetWorx => "C:\Program Files\NetWorx\networx.exe" /auto
MSCONFIG\startupreg: OPENVPN-GUI => C:\Program Files\OpenVPN\bin\openvpn-gui.exe
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: UnlockerAssistant => "C:\Program Files\Unlocker\UnlockerAssistant.exe"
MSCONFIG\startupreg: VMSnap3 => C:\Windows\VMSnap3.exe
MSCONFIG\startupreg: ZALFree => "C:\Program Files\Zemana AntiLogger Free\AntiLogger Free.exe" /MINIMIZED
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{4F134C82-E35B-4575-9DE3-551378DB3771}] => (Allow) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{2C948013-6B0F-4022-B2CB-C5C5CD582683}] => (Allow) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TelnetServer-TlntSvr-TCP-In] => (Allow) %systemroot%\system32\tlntsvr.exe
FirewallRules: [TelnetServer-Tlntadmn-RPC-In] => (Allow) %systemroot%\system32\tlntsvr.exe
FirewallRules: [{B1D77F7A-7646-4174-B614-512697A58779}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{15D2AC9D-1095-40A1-A27E-46F3D092E2B4}F:\ultrasurf\u1304.exe] => (Allow) F:\ultrasurf\u1304.exe
FirewallRules: [UDP Query User{C590EB11-97D8-41D4-9D08-E4B6C8F99358}F:\ultrasurf\u1304.exe] => (Allow) F:\ultrasurf\u1304.exe
FirewallRules: [{16E11037-31E7-4F4F-9A09-542F94C0FB04}] => (Allow) C:\Program Files\Apowersoft\Apowersoft Free Audio Recorder\Apowersoft Free Audio Recorder.exe
FirewallRules: [{28180659-0F52-4A73-8C6B-0B353562D920}] => (Allow) C:\Program Files\Apowersoft\Apowersoft Free Audio Recorder\Apowersoft Free Audio Recorder.exe
FirewallRules: [TCP Query User{6F4A9CD0-09B7-4B8E-9F08-D08BECE8A883}D:\globe\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe] => (Allow) D:\globe\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [UDP Query User{AE457788-5E21-4E97-8C62-EFCEEA6820C5}D:\globe\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe] => (Allow) D:\globe\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [TCP Query User{EEB1CA35-92F3-4C6A-B865-FAD8FF5C9AEE}D:\globe\b593s-22 debranding files\b593s-22_multicast_upgrade_tool.exe] => (Allow) D:\globe\b593s-22 debranding files\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [UDP Query User{6F6A35F1-EE0B-4C83-9BC9-966A922C2502}D:\globe\b593s-22 debranding files\b593s-22_multicast_upgrade_tool.exe] => (Allow) D:\globe\b593s-22 debranding files\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [TCP Query User{E4FA19DC-8B10-4DB4-A52D-98FAEBF2C096}C:\users\admin\downloads\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [UDP Query User{2B3CF287-033B-41FA-AA0F-E7B569AE64FC}C:\users\admin\downloads\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\b593s-931_unlock&debrand\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [{50002869-26DA-435C-A493-A8F009F653E5}] => (Allow) LPort=23
FirewallRules: [{AB94EFF7-947C-4159-BF92-CE26E9D717CD}] => (Allow) LPort=53
FirewallRules: [{0452FFD5-D5D4-4C79-B153-60751A35D4C8}] => (Allow) C:\Program Files\Anyplace Control Portable\apc_host.exe
FirewallRules: [{C43B94A1-D31D-47E9-A50D-4A83BFD44F52}] => (Allow) C:\Program Files\Anyplace Control Portable\apc_host.exe
FirewallRules: [TCP Query User{DFD55FC0-D800-4AD1-BFC6-EAF3230311D6}C:\users\admin\downloads\b593_upgrade.exe] => (Allow) C:\users\admin\downloads\b593_upgrade.exe
FirewallRules: [UDP Query User{5AD1218A-254A-4903-BB98-34937390A692}C:\users\admin\downloads\b593_upgrade.exe] => (Allow) C:\users\admin\downloads\b593_upgrade.exe
FirewallRules: [TCP Query User{B6A9A002-EC69-46A4-8EB6-07FEA74225DA}C:\users\admin\downloads\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [UDP Query User{39BA8986-54A6-4C47-A41D-8733C5C66B81}C:\users\admin\downloads\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [TCP Query User{7E63576D-4F5E-49DA-9097-1DEDC4D5E623}C:\users\admin\downloads\b593_upgrade\b593_upgrade.exe] => (Allow) C:\users\admin\downloads\b593_upgrade\b593_upgrade.exe
FirewallRules: [UDP Query User{7F51BF9B-6050-46B5-ADCB-E0F5B3DB154B}C:\users\admin\downloads\b593_upgrade\b593_upgrade.exe] => (Allow) C:\users\admin\downloads\b593_upgrade\b593_upgrade.exe
FirewallRules: [TCP Query User{625FF1E5-5D6A-44AD-819B-155260AFE0EC}D:\wimax\bm622i_v100r001phlc08b029pst03.exe] => (Allow) D:\wimax\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [UDP Query User{73BFDD8D-3596-4715-BCAE-CE5997F588CF}D:\wimax\bm622i_v100r001phlc08b029pst03.exe] => (Allow) D:\wimax\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [TCP Query User{5323AB2B-F27E-41EA-B01E-AFA6F2572465}C:\users\admin\downloads\work\work.exe] => (Allow) C:\users\admin\downloads\work\work.exe
FirewallRules: [UDP Query User{58C4ED29-5FEF-421C-8AA1-BD540921110B}C:\users\admin\downloads\work\work.exe] => (Allow) C:\users\admin\downloads\work\work.exe
FirewallRules: [TCP Query User{FCA99FA8-AFA9-4E12-8E24-53DC6AD299E1}D:\wimax\bm622_v100r001phlc08b024pst10\bm622_v100r001phlc08b024pst10.exe] => (Allow) D:\wimax\bm622_v100r001phlc08b024pst10\bm622_v100r001phlc08b024pst10.exe
FirewallRules: [UDP Query User{1CA16650-60E4-4737-B468-DB0968C50019}D:\wimax\bm622_v100r001phlc08b024pst10\bm622_v100r001phlc08b024pst10.exe] => (Allow) D:\wimax\bm622_v100r001phlc08b024pst10\bm622_v100r001phlc08b024pst10.exe
FirewallRules: [TCP Query User{42092016-874C-4A02-953F-A0F90630B516}C:\users\admin\appdata\local\temp\temp1_bm622i_v100r001phlc08b029pst03.zip\bm622i_v100r001phlc08b029pst03.exe] => (Allow) C:\users\admin\appdata\local\temp\temp1_bm622i_v100r001phlc08b029pst03.zip\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [UDP Query User{91B8B76A-54BD-4334-963C-3086A3F8784E}C:\users\admin\appdata\local\temp\temp1_bm622i_v100r001phlc08b029pst03.zip\bm622i_v100r001phlc08b029pst03.exe] => (Allow) C:\users\admin\appdata\local\temp\temp1_bm622i_v100r001phlc08b029pst03.zip\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [TCP Query User{3224FCDF-4387-41B4-BA0F-B1BC85070742}C:\users\admin\downloads\bm622i_v100r001phlc08b029pst03.exe] => (Allow) C:\users\admin\downloads\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [UDP Query User{D5E6AB4B-C44C-4CE0-8BDD-401AE48E249E}C:\users\admin\downloads\bm622i_v100r001phlc08b029pst03.exe] => (Allow) C:\users\admin\downloads\bm622i_v100r001phlc08b029pst03.exe
FirewallRules: [TCP Query User{0B6F567F-7816-4012-9B7C-68236F16746F}D:\wimax\work\work.exe] => (Allow) D:\wimax\work\work.exe
FirewallRules: [UDP Query User{76C0B35E-65C1-4F01-A5C9-89BFABCB5A9E}D:\wimax\work\work.exe] => (Allow) D:\wimax\work\work.exe
FirewallRules: [TCP Query User{7803CAD1-51EF-4F59-8FD1-DB1CA0A11121}D:\ultrasurf\ultrasurf 1402\u1402.exe] => (Block) D:\ultrasurf\ultrasurf 1402\u1402.exe
FirewallRules: [UDP Query User{7E699EB0-4145-4B33-AFF2-376D1F79504D}D:\ultrasurf\ultrasurf 1402\u1402.exe] => (Block) D:\ultrasurf\ultrasurf 1402\u1402.exe
FirewallRules: [TCP Query User{D4356853-8C76-4630-92E5-19B74D2ADEDE}D:\symbianize\b593\b593_upgrader_winboyssoft.exe] => (Allow) D:\symbianize\b593\b593_upgrader_winboyssoft.exe
FirewallRules: [UDP Query User{CF6B2F17-0096-4C56-8D6E-25F27A17E98C}D:\symbianize\b593\b593_upgrader_winboyssoft.exe] => (Allow) D:\symbianize\b593\b593_upgrader_winboyssoft.exe
FirewallRules: [{BE1BC2E2-80ED-4575-AC7E-1E458D9E1632}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{9BC8596C-DB94-4260-B305-907813378938}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{7BF45B1C-207D-46C7-945E-527B6C41E57B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3CD55293-E21C-469D-943D-6AA0B5037F60}] => (Allow) C:\Users\Admin\AppData\Local\temp\andy-x86\Setup.exe
FirewallRules: [{864B2BEA-D3FD-4535-8B4E-D96FB11A3304}] => (Allow) C:\Users\Admin\AppData\Local\temp\andy-x86\Setup.exe
FirewallRules: [{5932DF55-10C5-4694-82E5-02F10754C1FB}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{1586D371-9A79-438D-B586-5FCFA9B07653}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{22C68CEA-625F-4BE6-8547-B200161E1442}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{87118C53-593E-4941-90A3-7AFFA144F7B5}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{40355F00-E3B6-4359-B228-D8DAD45B069D}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{55928E2F-B1E8-4B07-BC48-AEC5BFF7343C}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{6C4FB459-0320-4FC0-8367-93BD92CE5F79}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{B6B0D8C3-66AE-4F18-A656-5038F11798C7}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{7415AE2B-2734-4160-8297-1B2569404B04}] => (Allow) C:\Users\Admin\AppData\Local\Temp\RemoveTemp.exe
FirewallRules: [{8C3EBDBC-8A67-41BA-AADB-324B2B1BCD05}] => (Allow) C:\Users\Admin\AppData\Local\Temp\RemoveTemp.exe
FirewallRules: [{7194D54E-05C0-4636-88F3-2C4112CACED9}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{B3693454-9CEA-4A00-B7D5-9B8408AC278D}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [TCP Query User{AFAF21FD-1DA9-41EE-AC2A-8427A8DDE91F}C:\program files\a-developer1412\http proxy injector\http proxy injector.exe] => (Allow) C:\program files\a-developer1412\http proxy injector\http proxy injector.exe
FirewallRules: [UDP Query User{55091EAF-0C94-4AC6-8234-7C79A8408268}C:\program files\a-developer1412\http proxy injector\http proxy injector.exe] => (Allow) C:\program files\a-developer1412\http proxy injector\http proxy injector.exe
FirewallRules: [TCP Query User{FCDF5F98-AB85-4B68-B315-66ADFA2BC8B6}C:\users\admin\downloads\neuer ordner\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\neuer ordner\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [UDP Query User{A4CE15F3-9DEA-4D1C-8088-29A4C3BD003E}C:\users\admin\downloads\neuer ordner\b593s-22_multicast_upgrade_tool.exe] => (Allow) C:\users\admin\downloads\neuer ordner\b593s-22_multicast_upgrade_tool.exe
FirewallRules: [TCP Query User{65C5360D-DD98-4195-8E24-B7BB434C49B7}C:\users\admin\downloads\proxylite vpn\lib\pinjector.exe] => (Allow) C:\users\admin\downloads\proxylite vpn\lib\pinjector.exe
FirewallRules: [UDP Query User{212714C3-88B6-4D2E-BAB9-FF679204F4A4}C:\users\admin\downloads\proxylite vpn\lib\pinjector.exe] => (Allow) C:\users\admin\downloads\proxylite vpn\lib\pinjector.exe
FirewallRules: [TCP Query User{4F140449-4ED1-4554-80C5-60157EF17BC5}C:\users\admin\downloads\ssr-win\shadowsocksr-dotnet2.0.exe] => (Allow) C:\users\admin\downloads\ssr-win\shadowsocksr-dotnet2.0.exe
FirewallRules: [UDP Query User{FACB4277-67B9-4F7F-94C0-983910DDF292}C:\users\admin\downloads\ssr-win\shadowsocksr-dotnet2.0.exe] => (Allow) C:\users\admin\downloads\ssr-win\shadowsocksr-dotnet2.0.exe
FirewallRules: [TCP Query User{CA2BFD6F-959B-4BEF-BDAE-D56EEFA6DF2A}C:\users\admin\downloads\clicknet vpn_v1.0\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\clicknet vpn_v1.0\lib\x-injector.exe
FirewallRules: [UDP Query User{CD0ECC18-DEAB-455A-BF00-62F480D1CB29}C:\users\admin\downloads\clicknet vpn_v1.0\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\clicknet vpn_v1.0\lib\x-injector.exe
FirewallRules: [TCP Query User{2F82BDC8-D03E-493F-8E85-EE43F5C292E1}C:\users\admin\downloads\clicknet vpn_v1.0\lib\c-payload.exe] => (Allow) C:\users\admin\downloads\clicknet vpn_v1.0\lib\c-payload.exe
FirewallRules: [UDP Query User{4D773382-F713-42BC-B8E3-EC395DBECAE3}C:\users\admin\downloads\clicknet vpn_v1.0\lib\c-payload.exe] => (Allow) C:\users\admin\downloads\clicknet vpn_v1.0\lib\c-payload.exe
FirewallRules: [TCP Query User{609E0AF0-FD59-425B-923C-D323CB0C6403}C:\users\admin\downloads\pc gui gtm no promo users v5.2\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\pc gui gtm no promo users v5.2\lib\x-injector.exe
FirewallRules: [UDP Query User{F863C1A5-45DB-456E-A57B-3AF0D4F88EFD}C:\users\admin\downloads\pc gui gtm no promo users v5.2\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\pc gui gtm no promo users v5.2\lib\x-injector.exe
FirewallRules: [TCP Query User{06E3AD5B-0E52-4637-8CA3-152831DC5AAC}C:\users\admin\downloads\pc gui #2 v5.3\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\pc gui #2 v5.3\lib\x-injector.exe
FirewallRules: [UDP Query User{21268207-E9BB-40FD-AF48-F20AA5BF8DA7}C:\users\admin\downloads\pc gui #2 v5.3\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\pc gui #2 v5.3\lib\x-injector.exe
FirewallRules: [{8F332538-5845-4318-AFFC-66922ECD892D}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{0F295FB8-B001-4177-B986-B36C74E1F3DE}C:\users\admin\downloads\skynetvpn_v6.1\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.1\lib\x-injector.exe
FirewallRules: [UDP Query User{A9925C6F-73D9-49C3-8D17-D18B981E42F6}C:\users\admin\downloads\skynetvpn_v6.1\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.1\lib\x-injector.exe
FirewallRules: [TCP Query User{BF3E515C-24CA-49CF-B35E-13D914076221}C:\users\admin\downloads\skynetvpn_v6.2\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.2\lib\x-injector.exe
FirewallRules: [UDP Query User{8198DC73-58EA-4327-B2AE-BB76AF078992}C:\users\admin\downloads\skynetvpn_v6.2\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.2\lib\x-injector.exe
FirewallRules: [TCP Query User{4E26D033-0451-4C23-A12C-47C4C653BF2A}C:\users\admin\downloads\skynetvpn_v6.3\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.3\lib\x-injector.exe
FirewallRules: [UDP Query User{13BA38B2-7C33-4B4A-B4D6-76C60182820F}C:\users\admin\downloads\skynetvpn_v6.3\lib\x-injector.exe] => (Allow) C:\users\admin\downloads\skynetvpn_v6.3\lib\x-injector.exe
==================== Restore Points =========================
12-09-2017 00:45:15 Windows Update
12-09-2017 17:37:36 Installed Python 2.7.13
13-09-2017 10:39:44 Revo Uninstaller's restore point - VA HausDesigner Professional 2.0
13-09-2017 10:50:07 Revo Uninstaller's restore point - VA HausDesigner Professional 2.0
13-09-2017 10:58:25 VA HausDesigner Professional 2.0 wurde installiert.
13-09-2017 12:07:19 Removed Python 2.7.13
13-09-2017 18:04:56 Checkpoint by HitmanPro
13-09-2017 18:06:06 Checkpoint by HitmanPro
13-09-2017 18:23:02 Installed Python 2.7.13
16-09-2017 16:16:24 Windows Update
18-09-2017 15:47:59 Windows Update
18-09-2017 16:00:35 Windows Update
21-09-2017 07:38:38 Installed Oracle VM VirtualBox 5.0.28
21-09-2017 07:44:48 Revo Uninstaller's restore point - Genymotion version 2.10.0
21-09-2017 07:46:18 Revo Uninstaller's restore point - Oracle VM VirtualBox 5.0.28
21-09-2017 15:04:06 Installed Oracle VM VirtualBox 5.0.28
21-09-2017 16:00:04 Revo Uninstaller's restore point - Genymotion version 2.10.0
21-09-2017 16:02:19 Revo Uninstaller's restore point - Oracle VM VirtualBox 5.0.28
21-09-2017 16:03:49 Revo Uninstaller's restore point - Security Task Manager 2.1i
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/21/2017 04:03:49 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Access is denied.
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6ce36c85-5736-4e4c-a1fe-814202512ab1}
Error: (09/21/2017 04:02:19 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Access is denied.
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6ce36c85-5736-4e4c-a1fe-814202512ab1}
Error: (09/21/2017 04:00:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Access is denied.
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6ce36c85-5736-4e4c-a1fe-814202512ab1}
Error: (09/21/2017 07:46:18 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Access is denied.
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6ce36c85-5736-4e4c-a1fe-814202512ab1}
Error: (09/21/2017 07:44:48 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Access is denied.
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6ce36c85-5736-4e4c-a1fe-814202512ab1}
Error: (09/21/2017 03:58:23 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\amd\ati.ace\core-static\SLSTaskbar64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/21/2017 03:58:00 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\glary utilities 5\DPInst64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/20/2017 07:20:49 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\amd\ati.ace\core-static\SLSTaskbar64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/20/2017 07:20:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\glary utilities 5\DPInst64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/19/2017 05:00:28 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\amd\ati.ace\core-static\SLSTaskbar64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (09/21/2017 07:31:45 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 117.2.0.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Installieren
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x86&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: Network Inspection System
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.13804.0
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
Error: (09/21/2017 07:31:43 AM) (Source: Microsoft Antimalware) (EventID: 2003) (User: )
Description: Beim Aktualisieren des Moduls wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Modulversion:
Vorherige Modulversion: 2.1.13804.0
Modultyp: Network Inspection System
Benutzer: NT AUTHORITY\NETWORK SERVICE
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
Error: (09/21/2017 07:31:43 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 117.2.0.0
Aktualisierungsquelle: Benutzer
Aktualisierungsphase: Installieren
Quellpfad:
Signaturtyp: Network Inspection System
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.13804.0
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
Error: (09/21/2017 07:31:38 AM) (Source: Microsoft Antimalware) (EventID: 2003) (User: )
Description: Beim Aktualisieren des Moduls wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Modulversion:
Vorherige Modulversion: 2.1.13804.0
Modultyp: Network Inspection System
Benutzer: NT AUTHORITY\NETWORK SERVICE
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
Error: (09/21/2017 07:31:38 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 117.2.0.0
Aktualisierungsquelle: Benutzer
Aktualisierungsphase: Installieren
Quellpfad:
Signaturtyp: Network Inspection System
Aktualisierungstyp: Delta
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.13804.0
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
Error: (09/21/2017 07:31:18 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.251.1146.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Herunterladen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.14104.0&avdelta=1.251.1146.0&asdelta=1.251.1146.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: AntiSpyware
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14104.0
Fehlercode: 0x80072ee2
Fehlerbeschreibung: The operation timed out
Error: (09/21/2017 07:31:18 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.251.1146.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Herunterladen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.14104.0&avdelta=1.251.1146.0&asdelta=1.251.1146.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: AntiVirus
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14104.0
Fehlercode: 0x80072ee2
Fehlerbeschreibung: The operation timed out
Error: (09/21/2017 07:28:03 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.251.1212.0)
Error: (09/21/2017 07:27:39 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.251.1146.0
Aktualisierungsquelle: Microsoft Update Server
Aktualisierungsphase: Installieren
Quellpfad: hxxp://www.microsoft.com
Signaturtyp: AntiVirus
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\SYSTEM
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14104.0
Fehlercode: 0x80070643
Fehlerbeschreibung: Fatal error during installation.
Error: (09/20/2017 07:32:00 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 117.2.0.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Installieren
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x86&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: Network Inspection System
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.13804.0
Fehlercode: 0x80070714
Fehlerbeschreibung: The specified image file did not contain a resource section.
CodeIntegrity:
===================================
Date: 2016-08-10 16:54:12.707
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-08-10 16:54:12.520
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-08-10 16:48:16.671
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-08-10 16:48:16.577
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 11:19:41.334
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 11:19:41.131
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 10:07:00.428
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 10:07:00.194
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 09:51:24.301
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-07-19 09:51:24.052
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD A4-6300 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 60%
Total physical RAM: 2266.84 MB
Available physical RAM: 899.08 MB
Total Virtual: 4532 MB
Available Virtual: 3029.77 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:97.56 GB) (Free:58.31 GB) NTFS
Drive d: () (Fixed) (Total:368.1 GB) (Free:362.4 GB) NTFS
Drive e: (ZTEMODEM) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: CF87CF87)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368.1 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
--- --- ---
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-09-2017
Ran by Admin (administrator) on ADMIN-PC (21-09-2017 16:16:47)
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available Profiles: Admin & UpdatusUser & Guest)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Englisch (USA)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Glarysoft Ltd) C:\Program Files\Glary Utilities 5\Integrator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-3638998829-643590200-863451022-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [43984 2016-08-19] (Glarysoft Ltd)
HKU\S-1-5-21-3638998829-643590200-863451022-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3638998829-643590200-863451022-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2015-01-12] (Microsoft Corporation)
HKU\S-1-5-18\...A8F59079A8D5}\localserver32: <==== ATTENTION
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\..\Interfaces\{0BED7AD2-755E-44D1-9D9B-1657F1FDCAFF}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{1E427959-5755-4CC4-8A30-8673A127C36A}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{523ED92C-5E3E-41E7-B899-657A4BD55EBB}: [DhcpNameServer] 192.168.254.254 192.168.254.254
Tcpip\..\Interfaces\{65053C49-DBB7-4B29-A63A-168EF42AACAC}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{72EE3E00-AA9C-494B-8385-63DB2FA0513F}: [DhcpNameServer] 8.8.8.8
Tcpip\..\Interfaces\{B023C994-B056-4D8E-83B6-F3ACC957E461}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{ED5D5634-DBDF-4983-AC44-FA0C54C54FEA}: [DhcpNameServer] 192.168.0.1 192.168.0.1
ManualProxies:
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3638998829-643590200-863451022-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
Toolbar: HKLM - No Name - {120A8821-2BEE-4C29-BCDA-62C577781992} - No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
FireFox:
========
FF DefaultProfile: n7ovz2d9.default
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n7ovz2d9.default [2017-09-13]
FF Homepage: Mozilla\Firefox\Profiles\n7ovz2d9.default -> google.com
FF Extension: (Quick Searcher v16.2) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n7ovz2d9.default\Extensions\mefhakmgclhhfbdadeojlkbllmecialg@chrome-store-foxified-1132576233 [2017-08-17]
FF HKLM\...\Firefox\Extensions: [@weather-hub] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n7ovz2d9.default\extensions\@weather-hub.xpi => not found
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-06] (Google Inc.)
Chrome:
=======
CHR HomePage: Default -> hxxp://google.de/
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR DefaultSearchURL: Default -> hxxp://mystartshield.com/results.php?pr=vmn&id=mystartshield&v=1_0_chromeextension_unknown__&campaignID=__campaign__&q={searchTerms}
CHR DefaultSearchKeyword: Default -> MyStartShield.com
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2017-09-21]
CHR Extension: (Easy Auto Refresh) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aabcgdmkeabbnleenpncegpcngjpnjkc [2017-06-22]
CHR Extension: (Google*Übersetzer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2016-12-19]
CHR Extension: (Google Präsentationen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-19]
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-19]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-18]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-18]
CHR Extension: (Google Tabellen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-19]
CHR Extension: (Whatshop) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgompabffjkokhbmiekkmbeodcfpcjop [2016-12-19]
CHR Extension: (Google Docs Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-19]
CHR Extension: (SimilarWeb - Traffic Rank & Website Analysis) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hoklmmgfnpapgjgcpechhaamimifchmp [2017-08-25]
CHR Extension: (New Tab Redirect) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna [2017-01-14]
CHR Extension: (Lightshot (Screenshot Tool)) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbniclmhobmnbdlbpiphghaielnnpgdp [2017-09-08]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-25]
CHR Extension: (Quick Searcher) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2017-08-17]
CHR Extension: (snapADDY Grabber) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pijkopmmbakjnkbhlhmoiakmdjomjppo [2017-09-20]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-18]
CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-10]
CHR HKLM\...\Chrome\Extension: [calegbidjlhjchbcefpcnpmpibcgdakc] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [kbejacapfbbfcbonimhhmpdbbpjdoplf] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [284872 2015-10-19] (Advanced Micro Devices, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [103696 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-11-14] (Microsoft Corporation)
R2 PlugPlay; C:\Windows\system32\umpnpmgr.dll [293376 2011-05-24] (Microsoft Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S3 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 1394ohci; C:\Windows\system32\drivers\1394ohci.sys [164864 2010-11-20] (Microsoft Corporation) [File not signed]
R3 amdhub30; C:\Windows\System32\DRIVERS\amdhub30.sys [86752 2016-08-30] (Advanced Micro Devices, INC.)
R0 amdide; C:\Windows\System32\DRIVERS\amdide.sys [11944 2016-08-30] (Advanced Micro Devices Inc.)
R3 amdxhc; C:\Windows\System32\DRIVERS\amdxhc.sys [179936 2016-08-30] (Advanced Micro Devices, INC.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\i386\AODDriver2.sys [50400 2014-02-11] (Advanced Micro Devices)
R1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [108544 2010-11-20] (Microsoft Corporation) [File not signed]
S3 DroidCam; C:\Windows\System32\DRIVERS\droidcam.sys [30008 2017-05-12] (Dev47Apps)
S3 DroidCamVideo; C:\Windows\System32\DRIVERS\droidcamvideo.sys [225720 2017-05-12] (Dev47Apps)
R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [62160 2016-07-11] ()
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17472 2016-08-19] (Glarysoft Ltd)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2016-08-30] (REALiX(tm))
S3 IPMIDRV; C:\Windows\system32\drivers\IPMIDrv.sys [65536 2010-11-20] (Microsoft Corporation) [File not signed]
R3 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [28160 2010-11-20] (Microsoft Corporation) [File not signed]
S3 keycrypt; C:\Windows\System32\DRIVERS\KeyCrypt32.sys [127936 2015-11-05] (Zemana Ltd.)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49064 2017-02-08] (Visicom Media Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-10-18] (ZTE Incorporated) [File not signed]
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2017-09-10] (Malwarebytes)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv.sys [30488 2014-12-29] (Visicom Media Inc.)
S3 mirrorv3; C:\Windows\System32\DRIVERS\rminiv3.sys [3328 2012-12-18] (Famatech International Corp.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
R1 MpKsl98446bd0; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9D48FAFC-0194-4F05-A0E8-651C2A72AAA5}\MpKsl98446bd0.sys [39168 2017-09-20] (Microsoft Corporation)
R1 ndisrd; C:\Windows\System32\DRIVERS\ndisrd.sys [37408 2014-08-14] (NT Kernel Resources)
R3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13440 2011-11-25] (June Fabrics Technology Inc.)
S3 ptun0901; C:\Windows\System32\DRIVERS\ptun0901.sys [23040 2016-06-15] (The OpenVPN Project)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [23040 2014-11-05] (The OpenVPN Project)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [36944 2016-10-13] (Anchorfree Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-10-27] ()
R3 umbus; C:\Windows\system32\drivers\umbus.sys [39936 2010-11-20] (Microsoft Corporation) [File not signed]
S1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [112880 2016-10-18] (Oracle Corporation)
S3 vvftav303; C:\Windows\System32\drivers\vvftav303.sys [480128 2007-06-23] (Vimicro Corporation)
S3 ZSMC0303; C:\Windows\System32\Drivers\usbVM303.sys [391300 2006-02-23] (Vimicro Corporation)
S3 ZSMC303; C:\Windows\System32\Drivers\usbVM303.sys [391300 2006-02-23] (Vimicro Corporation)
R3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [134144 2012-05-11] (ZTE Corporation)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [X]
S1 aopxtwie; \??\C:\Windows\system32\drivers\aopxtwie.sys [X]
U0 aswVmm; no ImagePath
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S4 PxHelp20; [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
S3 ZTEusbvoice; system32\DRIVERS\ZTEusbvoice.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-21 16:16 - 2017-09-21 16:17 - 000015048 _____ C:\Users\Admin\Desktop\FRST.txt
2017-09-21 16:16 - 2017-09-21 16:16 - 000000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion
2017-09-21 13:38 - 2017-09-21 15:02 - 159240072 _____ (Genymobile ) C:\Users\Admin\Downloads\genymotion-2.10.0-vbox (1).exe
2017-09-21 13:34 - 2017-09-21 13:34 - 000000000 ____D C:\Users\Admin\AppData\Local\Bluestacks
2017-09-21 13:05 - 2017-09-21 13:05 - 000000000 ____D C:\Users\Admin\Downloads\MeinWetter
2017-09-21 12:31 - 2017-09-21 12:31 - 000000000 ____D C:\Users\Admin\Downloads\Config.xml_1
2017-09-17 16:37 - 2017-09-17 16:37 - 313346075 _____ C:\Windows\MEMORY.DMP
2017-09-17 16:37 - 2017-09-17 16:37 - 000145304 _____ C:\Windows\Minidump\091717-22261-01.dmp
2017-09-15 12:51 - 2017-09-16 07:22 - 000010853 _____ C:\Users\Admin\Documents\wetter.xlsx
2017-09-13 18:25 - 2017-09-13 18:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.7
2017-09-13 18:23 - 2017-09-13 18:25 - 000000000 ____D C:\Python27
2017-09-13 18:06 - 2017-09-13 18:06 - 000001552 _____ C:\Windows\system32\.crusader
2017-09-13 17:50 - 2017-09-13 18:08 - 000000000 ____D C:\ProgramData\HitmanPro
2017-09-13 17:44 - 2017-09-13 17:49 - 011007936 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro.exe
2017-09-13 11:49 - 2017-09-13 15:38 - 000000000 ____D C:\ProgramData\SecTaskMan
2017-09-13 11:47 - 2017-09-13 11:48 - 002984912 _____ C:\Users\Admin\Downloads\SecurityTaskManager_Setup.exe
2017-09-13 11:44 - 2017-09-13 11:44 - 000007627 _____ C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
2017-09-13 11:05 - 2017-09-13 11:05 - 000002291 _____ C:\Users\Public\Desktop\VA HausDesigner Professional 2.0.lnk
2017-09-13 11:05 - 2017-09-13 11:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VA HausDesigner Professional
2017-09-13 10:59 - 2017-09-13 11:05 - 000000000 ____D C:\Windows\planTEK
2017-09-13 10:59 - 2017-09-13 10:59 - 000000000 ____D C:\Program Files\VirtualArchitecture
2017-09-12 18:14 - 2017-09-13 18:20 - 000000000 ____D C:\Users\Admin\Desktop\Autos
2017-09-12 17:43 - 2017-09-12 17:43 - 000000000 ____D C:\Users\Admin\.idlerc
2017-09-12 17:28 - 2017-09-12 17:37 - 019161088 _____ C:\Users\Admin\Downloads\python-2.7.13.msi
2017-09-12 17:18 - 2017-09-12 17:18 - 000000000 ____D C:\Users\Admin\Downloads\Labellmg
2017-09-12 08:50 - 2017-09-19 12:57 - 000010429 _____ C:\Users\Admin\Documents\Futter.xlsx
2017-09-11 12:35 - 2017-09-11 12:35 - 000000000 ____D C:\Users\Admin\Downloads\SkyNetVPN_v6.3
2017-09-10 09:20 - 2017-09-21 16:16 - 000000000 ____D C:\FRST
2017-09-10 09:18 - 2017-09-21 16:16 - 001796096 _____ (Farbar) C:\Users\Admin\Desktop\FRST.exe
2017-09-09 07:19 - 2017-09-09 07:19 - 000000000 __SHD C:\found.003
2017-09-08 13:32 - 2017-09-08 13:32 - 000000000 ____D C:\Users\Admin\Downloads\SkyNetVPN_v6.2
2017-09-08 12:34 - 2017-09-10 09:26 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-09-08 09:39 - 2017-09-08 09:39 - 000000000 __SHD C:\found.002
2017-09-07 09:22 - 2017-09-07 09:22 - 000000000 ____D C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
2017-09-07 09:21 - 2017-09-07 09:21 - 000000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2017-09-07 08:53 - 2017-09-07 08:53 - 000000000 ____D C:\Users\Admin\AppData\Local\WinSweeper
2017-09-07 08:40 - 2017-09-08 12:34 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-08-29 12:56 - 2017-08-29 12:56 - 000000000 ____D C:\Users\Admin\AppData\Roaming\4 Friends Games
2017-08-29 04:42 - 2017-09-21 16:08 - 000000000 ____D C:\Users\Admin\Desktop\Google-Maps
2017-08-29 04:13 - 2017-08-29 04:13 - 000000000 ____D C:\Users\Admin\AppData\Local\Murder on the Titanic
2017-08-29 04:13 - 2017-08-29 04:13 - 000000000 ____D C:\ProgramData\Particles
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-21 16:14 - 2015-01-09 13:03 - 000000000 ____D C:\Users\Admin
2017-09-21 16:08 - 2016-08-19 18:50 - 000000000 ____D C:\Program Files\Glary Utilities 5
2017-09-21 16:03 - 2009-07-14 10:37 - 000000000 ____D C:\Windows\inf
2017-09-21 04:05 - 2009-07-14 12:34 - 000023408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-21 04:05 - 2009-07-14 12:34 - 000023408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-20 07:15 - 2009-07-14 12:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-20 02:07 - 2016-08-11 01:23 - 000065536 _____ C:\Windows\system32\spu_storage.bin
2017-09-17 16:37 - 2015-01-25 14:47 - 000000000 ____D C:\Windows\Minidump
2017-09-15 16:04 - 2009-07-14 12:53 - 000032612 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-09-13 10:43 - 2015-01-10 07:57 - 000700480 _____ C:\Windows\system32\perfh007.dat
2017-09-13 10:43 - 2015-01-10 07:57 - 000149948 _____ C:\Windows\system32\perfc007.dat
2017-09-13 10:43 - 2015-01-09 13:13 - 001628044 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-12 12:28 - 2016-11-23 20:00 - 000034910 _____ C:\Users\Admin\Documents\Guru-Abrechnung 2017.xlsx
2017-09-12 08:35 - 2016-12-19 15:10 - 000000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2017-09-10 12:25 - 2016-12-22 13:20 - 000000000 ____D C:\AdwCleaner
2017-09-10 09:25 - 2017-08-17 15:34 - 000094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-09-10 08:30 - 2017-08-17 15:35 - 000170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-09-10 07:11 - 2015-01-09 13:12 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-08 10:10 - 2017-08-15 09:44 - 000000000 ____D C:\ProgramData\Big Fish
2017-09-08 10:10 - 2017-08-15 09:38 - 000000000 ____D C:\BigFishCache
2017-09-08 10:09 - 2009-07-14 12:52 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-09-08 10:04 - 2017-05-14 10:13 - 000000000 ____D C:\Webcam Live!
2017-09-08 10:04 - 2016-08-29 16:19 - 000000000 ____D C:\Program Files\Z_Drivers
2017-09-08 10:04 - 2015-04-08 17:45 - 000000000 ____D C:\Program Files\IrfanView
2017-09-08 10:04 - 2015-01-30 06:27 - 000000000 ____D C:\Users\Guest.Admin-PC
2017-09-08 10:04 - 2015-01-10 06:27 - 000000000 ____D C:\Users\UpdatusUser
2017-09-08 10:04 - 2009-07-14 10:37 - 000000000 ____D C:\Windows\registration
2017-09-08 10:03 - 2015-04-05 08:49 - 000000000 ____D C:\Users\Admin\AppData\Local\Microsoft Games
2017-08-31 16:45 - 2015-04-05 08:46 - 000000000 ____D C:\ProgramData\TEMP
2017-08-28 09:47 - 2017-08-11 05:09 - 000010179 _____ C:\Users\Admin\Documents\Schweine 2.xlsx
==================== Files in the root of some directories =======
2016-10-10 09:13 - 2016-10-10 09:14 - 004194304 _____ () C:\Program Files\bm622firmware2010.bin
2016-07-05 07:56 - 2016-07-06 10:20 - 000000003 _____ () C:\Users\Admin\AppData\Roaming\ispnetkey.dll
2017-05-09 14:34 - 2017-05-09 14:34 - 000003584 _____ () C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-09-19 18:10 - 2017-04-18 11:29 - 000000600 _____ () C:\Users\Admin\AppData\Local\PUTTY.RND
2017-09-13 11:44 - 2017-09-13 11:44 - 000007627 _____ () C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
2017-08-17 10:31 - 2017-08-17 10:31 - 000003233 _____ () C:\Users\Admin\AppData\Local\temp\browmodule.exe
2017-09-13 06:43 - 2014-06-18 16:37 - 011274816 _____ (Foxit Corporation) C:\Users\Admin\AppData\Local\temp\Foxit Reader Updater.exe
2017-08-17 10:31 - 2017-08-17 10:31 - 000003233 _____ () C:\Users\Admin\AppData\Local\temp\setupos_4435.exe
2017-08-17 10:30 - 2017-08-17 10:30 - 000003233 _____ () C:\Users\Admin\AppData\Local\temp\setupQQ.exe
2017-08-17 10:30 - 2017-08-17 10:30 - 000003233 _____ () C:\Users\Admin\AppData\Local\temp\speedboostsetup.exe
2017-08-17 10:30 - 2017-08-17 10:30 - 000003233 _____ () C:\Users\Admin\AppData\Local\temp\Yeadesktop.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-09-20 00:42
==================== End of FRST.txt ============================
--- --- --- |
Lesestoff:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
SecurityCheck und: