| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Infektion durch Excel Tabelle mit SupTab etc...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.06.2014, 10:24
| #1 |
| |  Infektion durch Excel Tabelle mit SupTab etc... Hallo miteinander, ich habe leider eine verseuchte Excel Tabelle runtergeladen und leider ausgeführt... Jetz hab ich den Salat. hier meine Feststellung unter Verwendung von MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 24.06.2014 Scan Time: 10:56:06 Logfile: MBAM Logfile 1.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.06.24.03 Rootkit Database: v2014.06.23.02 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Buchhaltung Scan Type: Threat Scan Result: Completed Objects Scanned: 274077 Time Elapsed: 6 min, 27 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 1 PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1960, , [9ba83448413ada5cb02a6cee99687090] Modules: 1 PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, , [cc77d8a478035fd7e707d4b5ac55857b], Registry Keys: 11 PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, , [9ba83448413ada5cb02a6cee99687090], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [e162bfbd1f5c62d4edd5955814efb14f], PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, , [7ec59ae2dba0fc3a3a7d86709a699f61], PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [083ba6d6f28968ce2f936b82659edb25], PUP.Optional.Qone8, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [af94a8d4304bbe789d24f5f8aa59ec14], Registry Values: 0 (No malicious items detected) Registry Data: 14 PUP.Optional.Skytech.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SupTab\SEARCH~2.DLL, Good: (), Bad: (C:\PROGRA~2\SupTab\SEARCH~2.DLL),,[2f14cfad5f1c85b1cf1f3a4f4bb6ef11] PUP.Optional.Skytech.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SupTab\SEARCH~1.DLL, Good: (), Bad: (C:\PROGRA~2\SupTab\SEARCH~1.DLL),,[d76c3f3dfb80d85e5c92ed9c907152ae] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[ce7598e43249ef47ac24caba1de706fa] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[f44fc5b797e440f6418e31531de722de] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[62e13e3e9cdf94a225ac61234eb68c74] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[261de4989edd4ceac6e73742a55f837d] PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[13303547a9d2b383e980b8cc4eb6f60a] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[da694e2ec7b4df57e8e8d9aba163d22e] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[70d3e7955229290de8e786fe49bb768a] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[291ab3c967142e08a031b2d213f1e21e] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[8fb49fdd9ae12f07dcd1fb7e1ee6ec14] PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[88bbb5c73348dd59db8ed7ad73916a96] PUP.Optional.SweetPage.A, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[46fd7efeeb90e3537854552f07fd01ff] PUP.Optional.SweetPage.A, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[f152a4d82556a5910fbc1c688e7627d9] Folders: 100 PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\de, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\en, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es_419, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-BE, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CA, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CH, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-LU, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it-CH, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ja, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pl, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_BR, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_PT, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ru, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\tr, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\vi, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_CN, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_TW, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_metadata, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, , [9ea50a72e5964de9e124386eee14f10f], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, , [9ea50a72e5964de9e124386eee14f10f], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger, , [93b0acd01566a6903f6d91159a68d32d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log, , [93b0acd01566a6903f6d91159a68d32d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update, , [93b0acd01566a6903f6d91159a68d32d], Files: 195 PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, , [9ba83448413ada5cb02a6cee99687090], PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, , [cc77d8a478035fd7e707d4b5ac55857b], PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, , [2f14cfad5f1c85b1cf1f3a4f4bb6ef11], PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, , [d76c3f3dfb80d85e5c92ed9c907152ae], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, , [88bb6814f3883afc0f08a2a6c0422cd4], PUP.Optional.GameAd.A, C:\Users\Buchhaltung\AppData\Local\Temp\loygame-pro.exe, , [e45fa8d4b2c987af57c278017e8654ac], PUP.Optional.GameAd.A, C:\Users\Buchhaltung\AppData\Local\Temp\updatepackasc.exe, , [1b280d6f5d1e0d297e9b8dec5aaa2ad6], PUP.Optional.SkyTech.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\alilog.dll, , [44ff89f385f66dc96fbb90a2c43c39c7], PUP.Optional.V9.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\qSE.exe, , [e162a7d5aad113238d22ed5b70904fb1], PUP.Optional.Skytech.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\UninstallManager.exe, , [b192314b304b5bdb5a94f89132cf44bc], PUP.Optional.IePluginService.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\tmp\SupTab_Setup302.exe, , [6ad93a42a0db57df3f9bfb5fc33e7d83], PUP.Optional.WPM.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\tmp\wpm_v20.0.0.401.exe, , [a89ba0dc710a3cfabedaf69730d1ab55], PUP.Optional.InstallCore, C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe, , [a1a24735e3987fb7813e07716a9ac23e], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterfacef32.dll, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\RSHP.exe, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv32.dll, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv64.dll, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WebDataJs, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\arrow.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo_hover.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_logo.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo2.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather\0.png, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ie8.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, , [f3502e4e1863cf67baf88444639f3dc3], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage, , [d073c6b691eaab8bac9df50c0bf98c74], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage-journal, , [ee55abd17605132399b0ab56e71d946c], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\background.html, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\index.html, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\jump.html, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\manifest.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\bookmarks.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\classification.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\del.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\main.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloud.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloudApp.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloudWebsite.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\createWebsite.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\buttonBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\categoryBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchLeft.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\tabsBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img\skin\headerBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\extensions.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\guide.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\lastVisited.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\notice.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\search.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img\search.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\setup.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin\dialBoxStyle.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oBookmarks.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oDownloads.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oExtensions.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oHistory.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oNewtab.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\cloudWallpaper.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\skins.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\categoryBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\delete.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\download.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\loading.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\weather.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\line.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\locationIcon.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\weather.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\css\all.css, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\game.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_128.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_16.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_48.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\shopping.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\weather.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\webstore.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\default.jpg, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\iconsprite.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\idialog_s.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\ios5_button.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\left.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\loading.gif, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\loading2.gif, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\qBoxBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_bg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_bg0.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_left.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_left0.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_right.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_right0.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\right.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\titleBg.png, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\all.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\background.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\ga.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\jq.mobi.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\jump.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\pop.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\redirect.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\xagainit.js, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\de\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\en\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es_419\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-BE\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CA\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CH\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-LU\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it-CH\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ja\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pl\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_BR\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_PT\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ru\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\tr\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\vi\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_CN\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_TW\messages.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_metadata\verified_contents.json, , [c57ef785ceadc472e78c2670fc06e21e], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, , [9ea50a72e5964de9e124386eee14f10f], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log\wprotectmanager_2014-06-18[11-08-42-097].log, , [93b0acd01566a6903f6d91159a68d32d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update\conf, , [93b0acd01566a6903f6d91159a68d32d], Physical Sectors: 0 (No malicious items detected) (end) oder lieber warten und auf Anweisungen warten? Würde mich sehr über eure Hilfe freuen!!!  Liebe Grüße, Melanie  |
|
24.06.2014, 10:31
| #2 |
| Ruhe in Frieden † 2019     |  Infektion durch Excel Tabelle mit SupTab etc... Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist. Posten in Code Tags Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke. Dazu:
Schritt 1 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
24.06.2014, 12:21
| #3 |
| | Infektion durch Excel Tabelle mit SupTab etc... Hallo Sandra!
__________________Erstmal danke für die schnelle Antwort und deine Hilfe!!! Hier das FRST Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2014
Ran by Buchhaltung at 2014-06-24 11:37:19
Running from C:\Users\Buchhaltung\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.00 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (x64) (HKLM\...\{5C804EBB-475F-4555-A225-1D6573F158BD}) (Version: 11.2.202.222 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2321 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.2.2321 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.2.3212 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4010 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 4.2.1.4010 - CyberLink Corp.) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Driver Installation Program (x32 Version: 10.0 - Atheros Communications, Inc.) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.3.1.1714 - Hewlett-Packard Company)
HP Client Security Manager (Version: 8.3.1.1714 - Hewlett-Packard Company) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Device Access Manager (HKLM\...\{AD7F97D3-AB72-4A10-B56A-95EC21F854DE}) (Version: 8.2.0.11 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{26EFA34E-7181-44CA-B1A6-8C1F708ED51D}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.3.65 - Hewlett-Packard Company)
HP Drive Encryption (Version: 8.6.3.65 - Hewlett-Packard Company) Hidden
HP File Sanitizer (HKLM-x32\...\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.13.1 - Hewlett-Packard Company)
HP My Display (HKLM-x32\...\{4DCC6015-444F-42A6-9D84-0B8D4B9EFC09}) (Version: 2.06.56.0 - Portrait Displays, Inc.)
HP PageLift (HKLM-x32\...\{ED6CAA18-FCFF-458B-8418-5217F6ABC646}) (Version: 1.0.10.1 - Hewlett-Packard Company)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{49524B48-4FE9-4A62-A9FD-1F2258DF5489}) (Version: 3.4.12.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{11BBD255-39EE-46CE-8BC0-8B820EE943A2}) (Version: 8.6.1.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Theft Recovery (HKLM-x32\...\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.3.0.2 - Hewlett-Packard Company)
HP Theft Recovery (x32 Version: 8.3.0.2 - Hewlett-Packard Company) Hidden
HP Trust Circles (HKLM-x32\...\HP Trust Circles) (Version: 8.3.6.16976 - Hewlett-Packard Company)
HP Trust Circles (Version: 8.3.6.16976 - CryptoMill Technologies Ltd.) Hidden
HP Wireless Keyboard and Mouse Applet (HKLM-x32\...\{C2A98780-3B82-4056-A1FB-7377B3C80AF7}) (Version: 1.0.0.1 - Hewlett-Packard)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Network Connections 18.1.59.0 (HKLM\...\PROSetDX) (Version: 18.1.59.0 - Intel)
Intel(R) Network Connections 18.1.59.0 (Version: 18.1.59.0 - Intel) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.2.9.10 - IObit)
Lexware buchhalter pro 2014 (HKLM-x32\...\{83ea8c4d-19e4-47eb-850c-a7456a411236}) (Version: 14.3.1.195 - Haufe-Lexware GmbH & Co.KG)
Lexware buchhalter pro 2014 (x32 Version: 14.04.01.0221 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware buchhalter pro 2014 Client (HKLM-x32\...\{924e5ec4-7fa5-447b-8d7f-7face98384da}) (Version: 14.3.1.195 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (x32 Version: 13.14.00.0008 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Info Service (x32 Version: 4.01.00.0077 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (x32 Version: 3.01.00.0011 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (HKLM-x32\...\{7F603892-89C9-4EC4-9236-7AD4A798EA41}) (Version: 21.00.00.0039 - Haufe-Lexware GmbH & Co.KG)
Lexware professional Datenbank 2014 (x32 Version: 14.25.00.0055 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Server Pro 2014 (x32 Version: 14.1.0.57 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Services (x32 Version: 2.00.00.0024 - Haufe-Lexware GmbH & Co.KG) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50325 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50330 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.50325 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50325 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.1.36 - PDF Complete, Inc)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.218 - Qualcomm Atheros Communications)
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.00.05 (10.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SDK (x32 Version: 2.39.004 - Portrait Displays, Inc.) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmarThru Office (HKLM-x32\...\{9BC1E722-AE07-46A3-B7A6-556DBE18E22A}) (Version: 2.10.000 - Samsung Electronics Co., Ltd.)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
==================== Restore Points =========================
30-05-2014 07:01:21 Windows Update
02-06-2014 07:10:01 Windows Update
05-06-2014 07:25:14 Windows Update
10-06-2014 07:15:34 Windows Update
12-06-2014 15:57:27 Windows Update
16-06-2014 07:03:00 Windows Update
19-06-2014 07:27:55 Windows Update
23-06-2014 07:09:25 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1108ADE8-08C3-4B6A-A64A-0911943F2034} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-10] (Google Inc.)
Task: {2E3A7F05-F7C4-438D-8A45-FA0BAE202D53} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {371F4CC2-2362-4AF8-952B-793163CEFC3B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {4C8550EB-AEE2-4D1B-944C-415C58F62335} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-06] (Hewlett-Packard Company)
Task: {662D8659-C1DA-4E6D-AF12-15EFBED759D4} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-05-14] (IObit)
Task: {68C85550-B30B-473F-A762-9964E7C40E69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-10] (Adobe Systems Incorporated)
Task: {8687CEB8-59B5-423C-9318-9173A00640BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-10] (Google Inc.)
Task: {AC09A5B4-40A0-4F46-ABBD-BDB955E06144} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-03-13 13:36 - 2011-04-11 07:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll
2014-04-24 14:28 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-08-14 23:06 - 2013-08-14 23:06 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2012-12-28 22:04 - 2012-12-28 22:04 - 00084480 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2014-01-10 09:40 - 2012-08-14 20:10 - 00802816 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe
2012-12-28 22:10 - 2012-12-28 22:10 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-12-28 22:04 - 2012-12-28 22:04 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2014-03-13 13:35 - 2013-10-04 06:53 - 00734720 _____ () C:\Windows\system32\SnMinDrv.dll
2014-03-13 13:35 - 2013-06-28 16:36 - 00091136 _____ () C:\Windows\system32\SSDEVM64.DLL
2014-03-13 13:36 - 2013-02-14 06:00 - 00295984 _____ () C:\windows\system32\spool\drivers\x64\3\spe__pi.exe
2013-09-17 21:32 - 2013-09-17 21:32 - 02654936 _____ () C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\ShredContextMenu.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-06-24 08:59 - 2014-06-24 08:59 - 00043008 _____ () c:\Users\Buchhaltung\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf3yasz.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-10 09:49 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 21:34 - 2012-06-08 21:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2013-09-26 13:20 - 2013-09-26 13:20 - 00176168 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Logging.Targets.Etw.dll
2013-09-26 13:20 - 2013-09-26 13:20 - 00043048 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Etw.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2012-01-18 02:21 - 2012-01-18 02:21 - 00068104 _____ () C:\Program Files (x86)\Hewlett-Packard\HP My Display\PEGAACPIDLL.dll
2014-01-10 09:38 - 2013-04-12 03:31 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/24/2014 10:20:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c4102
ID des fehlerhaften Prozesses: 0x1134
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (06/23/2014 11:56:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EXCEL.EXE, Version 15.0.4623.1000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1af0
Startzeit: 01cf8ec945b125ab
Endzeit: 0
Anwendungspfad: C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE
Berichts-ID: 8af276e6-fabc-11e3-b81a-485ab6895ac2
Error: (06/03/2014 05:35:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EXCEL.EXE, Version 15.0.4615.1000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1f18
Startzeit: 01cf7f41538c8084
Endzeit: 0
Anwendungspfad: C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE
Berichts-ID: a06a5838-eb34-11e3-b02d-485ab6895ac2
Error: (05/26/2014 05:51:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ContextMenuShim64.dll, Version: 11.0.0.379, Zeitstempel: 0x505fc498
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001ce0e
ID des fehlerhaften Prozesses: 0xc9c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (05/16/2014 11:54:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Framework.exe, Version: 14.4.0.7, Zeitstempel: 0x5316f9e0
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0150010
Fehleroffset: 0x0008482b
ID des fehlerhaften Prozesses: 0x17ec
Startzeit der fehlerhaften Anwendung: 0xFramework.exe0
Pfad der fehlerhaften Anwendung: Framework.exe1
Pfad des fehlerhaften Moduls: Framework.exe2
Berichtskennung: Framework.exe3
Error: (05/16/2014 11:54:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Framework.exe, Version: 14.4.0.7, Zeitstempel: 0x5316f9e0
Name des fehlerhaften Moduls: mfc100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2e0e4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00147cfd
ID des fehlerhaften Prozesses: 0x17ec
Startzeit der fehlerhaften Anwendung: 0xFramework.exe0
Pfad der fehlerhaften Anwendung: Framework.exe1
Pfad des fehlerhaften Moduls: Framework.exe2
Berichtskennung: Framework.exe3
Error: (05/16/2014 11:54:26 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Framework.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66F97CFD
Stack:
Error: (05/16/2014 08:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: outlookdav.exe, Version: 4.0.0.0, Zeitstempel: 0x5350d43d
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x14bc
Startzeit der fehlerhaften Anwendung: 0xoutlookdav.exe0
Pfad der fehlerhaften Anwendung: outlookdav.exe1
Pfad des fehlerhaften Moduls: outlookdav.exe2
Berichtskennung: outlookdav.exe3
Error: (05/16/2014 08:57:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: outlookdav.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException
Stack:
at System.Diagnostics.FileVersionInfo.GetVersionInfo(System.String)
at System.Windows.Forms.RichTextBox.get_CreateParams()
at System.Windows.Forms.Control..ctor(Boolean)
at System.Windows.Forms.TextBoxBase..ctor()
at System.Windows.Forms.RichTextBox..ctor()
at surdav.frmMain.InitializeComponent()
at surdav.frmMain..ctor()
at surdav.main.Main()
Error: (05/15/2014 09:14:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: outlookdav.exe, Version: 4.0.0.0, Zeitstempel: 0x5350d43d
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x1584
Startzeit der fehlerhaften Anwendung: 0xoutlookdav.exe0
Pfad der fehlerhaften Anwendung: outlookdav.exe1
Pfad des fehlerhaften Moduls: outlookdav.exe2
Berichtskennung: outlookdav.exe3
System errors:
=============
Error: (06/20/2014 02:01:07 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (06/16/2014 02:23:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet:
%%1115
Error: (06/12/2014 05:57:48 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (06/12/2014 05:28:15 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (06/04/2014 08:55:37 AM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.
Error: (06/03/2014 09:52:43 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (06/02/2014 02:36:32 PM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.
Error: (06/02/2014 02:13:59 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (05/26/2014 01:52:08 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (05/23/2014 05:55:47 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Microsoft Office Sessions:
=========================
Error: (06/24/2014 10:20:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c000037400000000000c4102113401cf8f79b7fbabffC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll57d0533c-fb78-11e3-a824-485ab6895ac2
Error: (06/23/2014 11:56:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: EXCEL.EXE15.0.4623.10001af001cf8ec945b125ab0C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE8af276e6-fabc-11e3-b81a-485ab6895ac2
Error: (06/03/2014 05:35:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: EXCEL.EXE15.0.4615.10001f1801cf7f41538c80840C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXEa06a5838-eb34-11e3-b02d-485ab6895ac2
Error: (05/26/2014 05:51:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ContextMenuShim64.dll11.0.0.379505fc498c0000005000000000001ce0ec9c01cf78af7267c34cC:\Windows\Explorer.EXEC:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat Elements\ContextMenuShim64.dll94e3b4b7-e4ed-11e3-a860-485ab6895ac2
Error: (05/16/2014 11:54:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Framework.exe14.4.0.75316f9e0ntdll.dll6.1.7601.18247521ea8e7c01500100008482b17ec01cf70dc63dfeb3aC:\Program Files (x86)\Lexware\professional\2014\Framework.exeC:\Windows\SysWOW64\ntdll.dll18cc9a25-dce0-11e3-843f-485ab6895ac2
Error: (05/16/2014 11:54:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Framework.exe14.4.0.75316f9e0mfc100.dll10.0.40219.3254df2e0e4c000000500147cfd17ec01cf70dc63dfeb3aC:\Program Files (x86)\Lexware\professional\2014\Framework.exeC:\Windows\system32\mfc100.dll10726b16-dce0-11e3-843f-485ab6895ac2
Error: (05/16/2014 11:54:26 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Framework.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66F97CFD
Stack:
Error: (05/16/2014 08:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: outlookdav.exe4.0.0.05350d43dKERNELBASE.dll6.1.7601.1840953159a86e04343520000c42d14bc01cf70d3fcf03213C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exeC:\Windows\syswow64\KERNELBASE.dll4c9f6255-dcc7-11e3-843f-485ab6895ac2
Error: (05/16/2014 08:57:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: outlookdav.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException
Stack:
at System.Diagnostics.FileVersionInfo.GetVersionInfo(System.String)
at System.Windows.Forms.RichTextBox.get_CreateParams()
at System.Windows.Forms.Control..ctor(Boolean)
at System.Windows.Forms.TextBoxBase..ctor()
at System.Windows.Forms.RichTextBox..ctor()
at surdav.frmMain.InitializeComponent()
at surdav.frmMain..ctor()
at surdav.main.Main()
Error: (05/15/2014 09:14:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: outlookdav.exe4.0.0.05350d43dKERNELBASE.dll6.1.7601.1822951fb1116e04343520000c41f158401cf700d30bbf909C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exeC:\Windows\syswow64\KERNELBASE.dll89f1361e-dc00-11e3-a7b1-485ab6895ac2
==================== Memory info ===========================
Percentage of memory in use: 60%
Total physical RAM: 4007.56 MB
Available physical RAM: 1602.62 MB
Total Pagefile: 8013.3 MB
Available Pagefile: 5295.56 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Windows ) (Fixed) (Total:453.08 GB) (Free:402.97 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:11.57 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 21345E49)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=453 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=100 MB) - (Type=27)
==================== End Of Log ============================
Pardon, das war die Adittion.txt hier die richtife Logdatei: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014 Ran by Buchhaltung (administrator) on BUCHHALTUNG-HP on 24-06-2014 11:36:42 Running from C:\Users\Buchhaltung\Desktop Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (CryptoMill Technologies Ltd.) C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe (Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (iAnywhere Solutions, Inc.) C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe (Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe (PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe () C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Dropbox, Inc.) C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CORESHREDDER.exe (Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SmarThru Office\x64\LegacyLauncher.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP My Display\DTune.exe (Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe (Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe (Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe (Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTHelper.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe () C:\Windows\System32\spool\drivers\x64\3\spe__pi.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7194840 2013-07-27] (Realtek Semiconductor) HKLM\...\Run: [HPKBDOSD] => C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe [802816 2012-08-14] () HKLM\...\Run: [] => [X] HKLM\...\Run: [CryptoMill Refresh] => C:\Program Files\Hewlett-Packard\HP Trust Circles\ceflauncher -m refresh HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-04-12] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111136 2012-11-21] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [493088 2012-11-21] (CyberLink Corp.) HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [683656 2013-04-07] (PDF Complete Inc) HKLM-x32\...\Run: [YouCam Mirage] => c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2013-04-10] (CyberLink) HKLM-x32\...\Run: [YouCam Tray] => c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [167488 2013-04-10] (CyberLink Corp.) HKLM-x32\...\Run: [HP File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\Coreshredder.exe [2213592 2013-09-17] (Hewlett-Packard) HKLM-x32\...\Run: [DT_HPO] => C:\Program Files (x86)\Hewlett-Packard\HP My Display\DTuneStartup.exe [142344 2013-08-20] (Hewlett-Packard) HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [208424 2013-10-17] (Haufe-Lexware GmbH & Co. KG) HKLM-x32\...\Run: [STO Backup Service] => C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe [199800 2012-09-27] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [STO Launcher Service] => C:\Program Files (x86)\SmarThru Office\x64\LegacyLauncher.exe [405624 2012-09-27] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [129664 2012-12-28] ( (Atheros Communications)) HKU\S-1-5-21-1907336366-2592699145-1523498337-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKU\S-1-5-21-1907336366-2592699145-1523498337-1001\...\Policies\Explorer: [DisallowRun] 1 AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-05-08] (Skytech Co., Ltd.) AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.) Lsa: [Notification Packages] DPPassFilter scecli Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) InternetURL: C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SurGATE Outlook DAV Client.url -> file:///C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exe ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: +1TBIcon -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers-x32: +1TBIcon -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.) ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms} BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit) BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: HP File Sanitizer - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard) BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin-x32: digitalpersona.com/ChromeDPAgent - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\components\npChromeDPAgent.dll (DigitalPersona, Inc.) FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome FF Extension: HP Client Security Manager - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome [2014-01-10] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-29] Chrome: ======= CHR HomePage: https://www.google.de/webhp?sourceid=chrome-instant&rlz=1C1CHFX_deDE579DE579&ion=1&espv=2&ie=UTF-8 CHR StartupUrls: "https://www.google.de/webhp?sourceid=chrome-instant&rlz=1C1CHFX_deDE579DE579&ion=1&espv=2&ie=UTF-8" CHR NewTab: "chrome-extension://pelmeidfhdlhlbjimpabfcbnnojbboma/index.html" CHR Extension: (Google Docs) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-10] CHR Extension: (Google Drive) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-10] CHR Extension: (YouTube) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-10] CHR Extension: (McAfee Security Scan+) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-03-26] CHR Extension: (Google-Suche) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-10] CHR Extension: (Adobe Acrobat – PDF-Datei erstellen) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-29] CHR Extension: (Amazon-Icon) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2014-06-18] CHR Extension: (HP Client Security Manager) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncffjdbbodifgldkcbhmiiljfcnbgjab [2014-03-10] CHR Extension: (Google Wallet) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-10] CHR Extension: (Quick start) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-06-18] CHR Extension: (Google Mail) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-10] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2012-09-23] CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Buchhaltung\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-06-18] CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome.crx [2013-10-03] ==================== Services (Whitelisted) ================= R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [226944 2012-12-28] (Qualcomm Atheros Commnucations) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation) R2 CreoService; C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [1390552 2013-10-03] (CryptoMill Technologies Ltd.) R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2013-08-14] () [File not signed] R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink) R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink) R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2013-10-03] (DigitalPersona, Inc.) R2 DTuneSrvc; C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe [120328 2013-07-17] (Portrait Displays, Inc.) S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [558392 2013-08-23] (Hewlett-Packard Company) R2 Haufe FabricHostService; C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe [14848 2013-10-10] (Haufe-Lexware GmbH & Co. KG) [File not signed] R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed] R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED) R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-12] (Intel Corporation) R2 Lexware_Professional_Datenbank; C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe [141176 2012-06-01] (iAnywhere Solutions, Inc.) R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [49664 2013-10-08] (Haufe-Lexware GmbH & Co. KG) [File not signed] S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2153792 2014-05-14] (IObit) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation) R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1138824 2013-04-07] (PDF Complete Inc) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor) R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-28] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2012-12-28] (Qualcomm Atheros) R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink) S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-06-13] (Hewlett-Packard Company) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-27] (Intel Corporation) R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28656 2013-05-30] (Intel Corporation) R3 IceKore; C:\Windows\System32\DRIVERS\IceKore.sys [401368 2013-09-30] (CryptoMill Technologies Inc.) S3 lehidmini; C:\Windows\system32\drivers\leath_hid.sys [39704 2012-12-28] (Atheros) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-24] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation) R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2013-08-22] (WinMagic Inc.) S3 qca_shb; C:\Windows\system32\drivers\qca_shb.sys [99328 2012-12-28] (Qualcomm Atheros Communications Inc.) R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [424664 2013-08-03] (Realsil Semiconductor Corporation) R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2013-08-22] (WinMagic Inc.) R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2013-08-22] (WinMagic Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-24 11:36 - 2014-06-24 11:37 - 00029400 _____ () C:\Users\Buchhaltung\Desktop\FRST.txt 2014-06-24 11:36 - 2014-06-24 11:36 - 00000000 ____D () C:\FRST 2014-06-24 11:36 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Desktop\FRST64.exe 2014-06-24 11:35 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Downloads\FRST64.exe 2014-06-24 11:10 - 2014-06-24 11:10 - 00000000 ____D () C:\Users\Buchhaltung\Desktop\Desinfektion 2014-06-24 10:55 - 2014-06-24 10:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-24 10:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-24 10:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-24 10:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-24 10:53 - 2014-06-24 10:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Buchhaltung\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-24 10:16 - 2014-06-24 10:16 - 00009281 _____ () C:\Users\Buchhaltung\Desktop\Mappe1.xlsx 2014-06-23 11:45 - 2014-06-23 11:45 - 00009260 _____ () C:\Users\Buchhaltung\Desktop\Friedels Fairsicher Büro.xlsx 2014-06-19 12:42 - 2014-06-23 17:19 - 00039201 _____ () C:\Users\Buchhaltung\Desktop\Journal Mai 14.xlsx 2014-06-19 09:18 - 2014-06-19 09:18 - 00000024 _____ () C:\Users\Buchhaltung\AppData\Roaming\temp.ini 2014-06-18 11:08 - 2014-06-19 09:50 - 00000000 ____D () C:\ProgramData\WindowsProtectManger 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\SupTab 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\IePluginServices 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Program Files (x86)\SupTab 2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\ChromeExtensions 2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Temp2938445d7de96fb9fbf2aa393d57f57d 2014-06-18 11:05 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-für-Excel-und-OpenOffice 2014-06-18 11:05 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Tempa4a6c201acf7d8ff2b637ea32bd5d7b4 2014-06-18 11:03 - 2014-06-18 11:03 - 01063312 _____ () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-fr-Excel-und-OpenOffice-lnstall.exe 2014-06-18 10:49 - 2014-06-18 10:49 - 00703136 _____ () C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe 2014-06-16 14:07 - 2014-06-16 14:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\OICE_15_974FA576_32C1D314_90F 2014-06-12 09:00 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-12 09:00 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-12 09:00 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-06-12 09:00 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-12 09:00 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-06-12 09:00 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-06-12 09:00 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-06-12 09:00 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-12 09:00 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-06-12 09:00 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-12 09:00 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-06-12 09:00 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-06-12 09:00 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-06-12 09:00 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-06-12 09:00 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-06-12 09:00 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-06-12 09:00 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-06-12 09:00 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-06-12 09:00 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-06-12 09:00 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-06-12 09:00 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-12 09:00 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-06-12 09:00 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-06-12 09:00 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-06-12 09:00 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-06-12 09:00 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-06-12 09:00 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-06-12 09:00 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-06-12 09:00 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-06-12 09:00 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-06-12 09:00 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-12 09:00 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-06-12 09:00 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-06-12 09:00 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-06-12 09:00 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-06-12 09:00 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-06-12 09:00 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-12 09:00 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-06-12 09:00 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-06-12 09:00 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-06-12 09:00 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-06-12 09:00 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-12 09:00 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-06-12 09:00 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-06-12 09:00 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-06-12 09:00 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-12 09:00 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-06-12 09:00 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-12 09:00 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-06-12 09:00 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-06-12 09:00 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-06-12 09:00 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-06-12 09:00 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-06-12 09:00 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2014-06-12 09:00 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-06-12 09:00 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-06-12 09:00 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-06-12 09:00 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-06-12 09:00 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2014-06-12 09:00 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-06-12 09:00 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2014-06-12 09:00 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-06-12 09:00 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2014-06-12 09:00 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-06-12 09:00 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-06-06 10:43 - 2014-06-06 10:43 - 00000932 _____ () C:\Users\Buchhaltung\Downloads\Herunterladen (3).csv 2014-06-05 12:14 - 2014-06-05 12:14 - 00028131 _____ () C:\Users\Buchhaltung\Desktop\Kopie von Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid.xlsx 2014-06-03 12:08 - 2014-06-17 18:01 - 00010539 _____ () C:\Users\Buchhaltung\Desktop\Passwort Datenbank.xlsx 2014-06-02 17:23 - 2014-06-02 17:23 - 00027386 _____ () C:\Users\Buchhaltung\Downloads\Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid (3) ohne Summen.xlsx 2014-05-30 14:17 - 2014-05-30 16:02 - 00000000 ____D () C:\Verträge Freelancer 2014-05-28 18:04 - 2014-05-28 18:04 - 00000000 ____D () C:\Kinetic Lights Mastervorlage Angebot 2014-05-28 18:01 - 2014-05-28 18:03 - 00000000 ____D () C:\Logo whitevoid 2014-05-28 18:01 - 2014-05-28 18:03 - 00000000 ____D () C:\Lieferkonditionen Mawa 2014-05-28 18:01 - 2014-05-28 18:02 - 00000000 ____D () C:\Privata Hausverwaltung ==================== One Month Modified Files and Folders ======= 2014-06-24 11:37 - 2014-06-24 11:36 - 00029400 _____ () C:\Users\Buchhaltung\Desktop\FRST.txt 2014-06-24 11:36 - 2014-06-24 11:36 - 00000000 ____D () C:\FRST 2014-06-24 11:35 - 2014-06-24 11:36 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Desktop\FRST64.exe 2014-06-24 11:35 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Downloads\FRST64.exe 2014-06-24 11:28 - 2014-03-10 14:12 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-24 11:10 - 2014-06-24 11:10 - 00000000 ____D () C:\Users\Buchhaltung\Desktop\Desinfektion 2014-06-24 10:55 - 2014-06-24 10:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-24 10:54 - 2014-06-24 10:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Buchhaltung\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-24 10:42 - 2014-03-01 18:33 - 00000000 ____D () C:\Datensicherung FiBu 2014-06-24 10:40 - 2014-01-10 09:48 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-06-24 10:40 - 2014-01-10 09:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-24 10:22 - 2014-02-19 15:44 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1E83FF4F-497D-487F-B446-4692BE77C59D} 2014-06-24 10:17 - 2014-01-10 09:06 - 00716700 _____ () C:\Windows\system32\perfh007.dat 2014-06-24 10:17 - 2014-01-10 09:06 - 00154260 _____ () C:\Windows\system32\perfc007.dat 2014-06-24 10:17 - 2009-07-14 07:13 - 01654312 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-24 10:16 - 2014-06-24 10:16 - 00009281 _____ () C:\Users\Buchhaltung\Desktop\Mappe1.xlsx 2014-06-24 10:13 - 2014-03-13 15:16 - 00000072 _____ () C:\Users\Public\LMDebug.log 2014-06-24 09:58 - 2014-01-10 09:50 - 00000000 ____D () C:\ProgramData\PDFC 2014-06-24 09:43 - 2014-05-19 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\E0CDCFA4-A899-4CD1-BF14-C7DAD2D0A520.aplzod 2014-06-24 09:05 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-24 09:05 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-24 09:02 - 2014-02-19 15:41 - 01731627 _____ () C:\Windows\WindowsUpdate.log 2014-06-24 08:59 - 2014-03-20 15:59 - 00000000 ___RD () C:\Users\Buchhaltung\Dropbox 2014-06-24 08:59 - 2014-03-20 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\DropboxMaster 2014-06-24 08:59 - 2014-03-20 15:57 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\Dropbox 2014-06-24 08:58 - 2014-03-10 14:12 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-24 08:58 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.log 2014-06-24 08:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-24 08:58 - 2009-07-14 06:51 - 00044965 _____ () C:\Windows\setupact.log 2014-06-23 17:19 - 2014-06-19 12:42 - 00039201 _____ () C:\Users\Buchhaltung\Desktop\Journal Mai 14.xlsx 2014-06-23 11:45 - 2014-06-23 11:45 - 00009260 _____ () C:\Users\Buchhaltung\Desktop\Friedels Fairsicher Büro.xlsx 2014-06-23 10:57 - 2014-04-09 17:25 - 00000000 ____D () C:\Vorlagen 2014-06-23 10:02 - 2014-02-22 16:03 - 00000000 ____D () C:\ProgramData\Lexware 2014-06-23 09:00 - 2014-05-14 10:49 - 00000000 ____D () C:\ProgramData\ProductData 2014-06-23 08:58 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.001 2014-06-23 08:58 - 2010-11-21 05:47 - 00168256 _____ () C:\Windows\PFRO.log 2014-06-20 09:40 - 2014-04-09 17:27 - 00000000 ____D () C:\Liquidität 2014-06-20 08:52 - 2014-02-19 19:52 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2014-06-20 08:52 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.002 2014-06-19 09:50 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\WindowsProtectManger 2014-06-19 09:18 - 2014-06-19 09:18 - 00000024 _____ () C:\Users\Buchhaltung\AppData\Roaming\temp.ini 2014-06-19 09:17 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.003 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\SupTab 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\IePluginServices 2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Program Files (x86)\SupTab 2014-06-18 11:08 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-für-Excel-und-OpenOffice 2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\ChromeExtensions 2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Temp2938445d7de96fb9fbf2aa393d57f57d 2014-06-18 11:07 - 2014-02-19 15:43 - 00000000 ____D () C:\Users\Buchhaltung 2014-06-18 11:05 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Tempa4a6c201acf7d8ff2b637ea32bd5d7b4 2014-06-18 11:03 - 2014-06-18 11:03 - 01063312 _____ () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-fr-Excel-und-OpenOffice-lnstall.exe 2014-06-18 10:49 - 2014-06-18 10:49 - 00703136 _____ () C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe 2014-06-18 08:55 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.004 2014-06-17 18:01 - 2014-06-03 12:08 - 00010539 _____ () C:\Users\Buchhaltung\Desktop\Passwort Datenbank.xlsx 2014-06-17 08:46 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.005 2014-06-16 14:07 - 2014-06-16 14:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\OICE_15_974FA576_32C1D314_90F 2014-06-13 14:30 - 2014-03-10 14:13 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-06-13 12:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-06-12 18:00 - 2014-02-22 16:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-06-12 17:59 - 2014-02-22 16:52 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-06-11 16:43 - 2014-03-25 17:43 - 00001939 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-06-11 16:43 - 2014-03-25 17:43 - 00000000 ____D () C:\ProgramData\McAfee Security Scan 2014-06-06 10:43 - 2014-06-06 10:43 - 00000932 _____ () C:\Users\Buchhaltung\Downloads\Herunterladen (3).csv 2014-06-05 12:14 - 2014-06-05 12:14 - 00028131 _____ () C:\Users\Buchhaltung\Desktop\Kopie von Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid.xlsx 2014-06-04 10:28 - 2014-04-09 17:27 - 00000000 ____D () C:\Geschäftsdaten 2014-06-02 17:23 - 2014-06-02 17:23 - 00027386 _____ () C:\Users\Buchhaltung\Downloads\Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid (3) ohne Summen.xlsx 2014-05-30 16:02 - 2014-05-30 14:17 - 00000000 ____D () C:\Verträge Freelancer 2014-05-30 12:21 - 2014-06-12 09:00 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-30 12:02 - 2014-06-12 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-30 12:02 - 2014-06-12 09:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-05-30 11:45 - 2014-06-12 09:00 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-30 11:39 - 2014-06-12 09:00 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-30 11:39 - 2014-06-12 09:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-05-30 11:38 - 2014-06-12 09:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-05-30 11:28 - 2014-06-12 09:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-30 11:27 - 2014-06-12 09:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-05-30 11:24 - 2014-06-12 09:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-30 11:21 - 2014-06-12 09:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-05-30 11:21 - 2014-06-12 09:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-05-30 11:20 - 2014-06-12 09:00 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-05-30 11:18 - 2014-06-12 09:00 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-30 11:11 - 2014-06-12 09:00 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-05-30 11:08 - 2014-06-12 09:00 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-05-30 11:06 - 2014-06-12 09:00 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-05-30 11:02 - 2014-06-12 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-30 10:55 - 2014-06-12 09:00 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 10:49 - 2014-06-12 09:00 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-05-30 10:46 - 2014-06-12 09:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-30 10:44 - 2014-06-12 09:00 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-05-30 10:44 - 2014-06-12 09:00 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-05-30 10:43 - 2014-06-12 09:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-05-30 10:42 - 2014-06-12 09:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-05-30 10:38 - 2014-06-12 09:00 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-05-30 10:35 - 2014-06-12 09:00 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-05-30 10:34 - 2014-06-12 09:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-05-30 10:33 - 2014-06-12 09:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-05-30 10:30 - 2014-06-12 09:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-05-30 10:29 - 2014-06-12 09:00 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-30 10:28 - 2014-06-12 09:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-05-30 10:27 - 2014-06-12 09:00 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-05-30 10:24 - 2014-06-12 09:00 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-05-30 10:23 - 2014-06-12 09:00 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-05-30 10:16 - 2014-06-12 09:00 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-05-30 10:10 - 2014-06-12 09:00 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-30 10:06 - 2014-06-12 09:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-05-30 10:04 - 2014-06-12 09:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-30 10:02 - 2014-06-12 09:00 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-05-30 09:56 - 2014-06-12 09:00 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-05-30 09:56 - 2014-06-12 09:00 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-30 09:54 - 2014-06-12 09:00 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-05-30 09:50 - 2014-06-12 09:00 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-05-30 09:49 - 2014-06-12 09:00 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-05-30 09:43 - 2014-06-12 09:00 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-30 09:40 - 2014-06-12 09:00 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-05-30 09:30 - 2014-06-12 09:00 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-30 09:21 - 2014-06-12 09:00 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-05-30 09:15 - 2014-06-12 09:00 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-05-30 09:13 - 2014-06-12 09:00 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-30 09:13 - 2014-06-12 09:00 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-05-28 18:04 - 2014-05-28 18:04 - 00000000 ____D () C:\Kinetic Lights Mastervorlage Angebot 2014-05-28 18:03 - 2014-05-28 18:01 - 00000000 ____D () C:\Logo whitevoid 2014-05-28 18:03 - 2014-05-28 18:01 - 00000000 ____D () C:\Lieferkonditionen Mawa 2014-05-28 18:02 - 2014-05-28 18:01 - 00000000 ____D () C:\Privata Hausverwaltung 2014-05-28 17:54 - 2014-03-20 15:59 - 00001005 _____ () C:\Users\Buchhaltung\Desktop\Dropbox.lnk 2014-05-28 17:54 - 2014-03-20 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-05-26 17:48 - 2010-11-21 09:16 - 00000000 ___RD () C:\Users\Public\Recorded TV Some content of TEMP: ==================== C:\Users\Buchhaltung\AppData\Local\Temp\amazonicon_v5.exe C:\Users\Buchhaltung\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Buchhaltung\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf3yasz.dll C:\Users\Buchhaltung\AppData\Local\Temp\loygame-pro.exe C:\Users\Buchhaltung\AppData\Local\Temp\OfficeSetup.exe C:\Users\Buchhaltung\AppData\Local\Temp\sdanircmdc.exe C:\Users\Buchhaltung\AppData\Local\Temp\sdapskill.exe C:\Users\Buchhaltung\AppData\Local\Temp\sdaspwn.exe C:\Users\Buchhaltung\AppData\Local\Temp\sweetpage294wld_n2.exe C:\Users\Buchhaltung\AppData\Local\Temp\updatepackasc.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-18 13:30 ==================== End Of Log ============================ --- --- --- --- --- --- Hallo Sandra, nochmal danke für deine Schnelle Reaktion, ich wollte Bescheid sagen dass ich den Rechner zu nem gewerblichem Virenjäger bringe. Besten Dank, Grüße, Melanie Hallo Sandra, nochmal danke für deine Schnelle Reaktion, ich wollte Bescheid sagen dass ich den Rechner zu nem gewerblichem Virenjäger bringe. Besten Dank, Grüße, Melanie |
|
Linear-Darstellung
