| |
| |||||||
Log-Analyse und Auswertung: Trojaner eBay&email Hack vom PC entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
11.12.2015, 12:32
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Trojaner eBay&email Hack vom PC entfernen Ja wäre besser. Aktuell ist Firefox 42. alles was zum jetzigen Zeitpunkt ne größere Versionsnummer hat, ist beta oder gar nightly.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.12.2015, 16:31
| #17 |
 | Trojaner eBay&email Hack vom PC entfernen Firefox sollte jetzt auf 42.0 sein.
__________________Nochmal ein obligatorisches FRST log Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:09-12-2015 durchgeführt von Lorenz (Administrator) auf LOLLOSURFACE (11-12-2015 16:27:34) Gestartet von C:\Users\Lorenz\Downloads Geladene Profile: Lorenz (Verfügbare Profile: Lorenz) Platform: Windows 10 Pro Version 1511 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Edge) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (1&1 Mail & Media GmbH) C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Akamai Technologies, Inc.) C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe (Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Dropbox, Inc.) C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe () C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkypeHost.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Spotify Ltd) C:\Users\Lorenz\AppData\Roaming\Spotify\spotify.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\winword.exe (Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReader.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6509.64001.0_x64__8wekyb3d8bbwe\HxTsr.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6509.64001.0_x64__8wekyb3d8bbwe\HxMail.exe (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe (Microsoft Corporation) C:\Windows\System32\WWAHost.exe (Microsoft Corporation) C:\Windows\System32\LockAppHost.exe (Drawboard) C:\Program Files\WindowsApps\Drawboard.DrawboardPDF_4.4.1.0_x64__gqbn7fs4pywxm\Drawboard.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avcenter.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM-x32\...\Run: [doubleTwist] => C:\Program Files (x86)\doubleTwist\doubleTwist.Light.exe HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-16] (Apple Inc.) HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-11-03] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [708496 2015-09-23] (Cisco Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [794112 2015-10-29] (1&1 Mail & Media GmbH) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Spotify Web Helper] => C:\Users\Lorenz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-02-08] (Spotify Ltd) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [61200 2015-10-21] (Apple Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Dropbox Update] => C:\Users\Lorenz\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-17] (Dropbox, Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Lorenz\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.) HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\RunOnce: [Uninstall C:\Users\Lorenz\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Lorenz\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\amd64" HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\MountPoints2: {0f81c5e2-0dbb-11e5-828e-6002927b1294} - "D:\HTC_Sync_Manager_PC.exe" HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\MountPoints2: {0f81c616-0dbb-11e5-828e-6002927b1294} - "D:\HTC_Sync_Manager_PC.exe" ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension64_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\WINDOWS\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.) ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers-x32: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files (x86)\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_3_20151009105810302.dll [2015-08-21] (1&1 Mail & Media GmbH) ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-10-20] ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6) Startup: C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-12-10] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation) Startup: C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-12] ShortcutTarget: Dropbox.lnk -> C:\Users\Lorenz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\..\Interfaces\{4af4bd94-f876-4a1e-aafd-4c94f42317df}: [NameServer] 10.156.33.53,129.187.5.1 Tcpip\..\Interfaces\{524448cb-31f1-4839-9c46-203aa2eaab44}: [DhcpNameServer] 192.168.2.1 Internet Explorer: ================== BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-13] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-11-13] (Oracle Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-13] (Oracle Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-13] (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default FF Homepage: hxxp://go.web.de/tb/mff_startpage FF Session Restore: -> ist aktiviert. FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-10] () FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-13] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-13] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] () FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-10-14] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.) FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\google-images.xml [2014-10-14] FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\google-maps.xml [2014-10-14] FF SearchPlugin: C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\searchplugins\youtube.xml [2015-10-28] FF Extension: WOT - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-12-10] FF Extension: Avira Browser Safety - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\abs@avira.com [2015-10-23] [ist nicht signiert] FF Extension: Cliqz - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\cliqz@cliqz.com.xpi [2015-12-10] FF Extension: YouTube to MP3 Free Converter - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\extension@321youtube.com.xpi [2015-05-29] FF Extension: MEGA - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\firefox@mega.co.nz.xpi [2015-11-10] [ist nicht signiert] FF Extension: WEB.DE MailCheck - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\mailcheck@web.de [2015-11-09] FF Extension: SoundCloud Downloader - Technowise - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-12-08] FF Extension: Adblock Plus - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-26] FF HKU\S-1-5-21-2261460588-3622448717-587553582-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Lorenz\AppData\Roaming\Mozilla\Firefox\Profiles\e2xmbe04.default\extensions\cliqz@cliqz.com => nicht gefunden StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe Chrome: ======= CHR Profile: C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-10] CHR Extension: (Google Docs) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-10] CHR Extension: (Google Drive) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24] CHR Extension: (YouTube) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-22] CHR Extension: (Google-Suche) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28] CHR Extension: (Google Tabellen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-10] CHR Extension: (Avira Browserschutz) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-10-22] CHR Extension: (Google Docs Offline) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25] CHR Extension: (Google Mail) - C:\Users\Lorenz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-16] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [948392 2015-12-01] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1418560 2015-12-01] (Avira Operations GmbH & Co. KG) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [250136 2015-11-03] (Avira Operations GmbH & Co. KG) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2797752 2015-10-13] (Microsoft Corporation) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3755976 2015-07-01] (devolo AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.) R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [Datei ist nicht signiert] S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH) S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [135880 2015-12-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [146696 2015-12-01] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [73032 2015-12-01] (Avira Operations GmbH & Co. KG) R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [165376 2015-10-30] (Microsoft Corporation) R3 BthHFAud; C:\Windows\system32\DRIVERS\BthHfAud.sys [36864 2015-10-30] (Microsoft Corporation) S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) S3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-07] (Intel Corporation) S3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-07] (Intel Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-11] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-09-30] (Intel Corporation) R3 mrvlpcie8897; C:\Windows\System32\drivers\mrvlpcie8897.sys [1037824 2015-10-30] (Marvell Semiconductors Inc.) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2015-07-01] (CACE Technologies) S3 SCL01164; C:\Windows\system32\DRIVERS\SCL01164.sys [72320 2010-05-07] (SCM Microsystems Inc.) R3 SurfaceAccessoryDevice; C:\Windows\System32\drivers\SurfaceAccessoryDevice.sys [51856 2014-05-30] (Microsoft Corporation) R3 SurfaceCapacitiveHomeButton; C:\Windows\System32\drivers\SurfaceCapacitiveHomeButton.sys [44152 2014-11-27] (Microsoft Corporation) R3 SurfaceDisplayCalibration; C:\Windows\System32\drivers\SurfaceDisplayCalibration.sys [41616 2014-05-02] (Microsoft Corporation) R3 SurfaceIntegrationDriver; C:\Windows\System32\drivers\SurfaceIntegrationDriver.sys [63000 2015-09-30] (Microsoft Corporation) R0 SurfacePciController; C:\Windows\System32\drivers\SurfacePciController.sys [35440 2014-10-08] (Microsoft Corporation) R3 SurfacePenDriver; C:\Windows\System32\drivers\SurfacePenDriver.sys [76424 2015-03-31] (Microsoft Corporation) S3 SurfaceTypeCover; C:\Windows\System32\drivers\SurfaceTypeCover.sys [67592 2015-10-27] (Microsoft Corporation) S3 SurfaceTypeCoverV3Integration; C:\Windows\System32\drivers\SurfaceTypeCoverV3Integration.sys [52760 2015-10-27] (Microsoft Corporation) R3 TrueColor; C:\Windows\system32\DRIVERS\TrueColor.sys [35952 2014-07-07] () R3 vpnva; C:\Windows\System32\drivers\vpnva64-6.sys [52592 2015-09-23] (Cisco Systems, Inc.) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-11 16:27 - 2015-12-11 16:27 - 00000000 ____D C:\Users\Lorenz\Downloads\FRST-OlderVersion 2015-12-11 16:25 - 2015-12-11 16:25 - 00001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-12-11 16:25 - 2015-12-11 16:25 - 00001000 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-12-11 16:25 - 2015-12-11 16:25 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-12-11 13:50 - 2015-12-11 16:23 - 44874656 _____ C:\Users\Lorenz\Downloads\Firefox_Setup_42.0.exe 2015-12-11 08:31 - 2015-12-11 08:31 - 00000000 ____D C:\Program Files (x86)\ESET 2015-12-09 23:17 - 2015-12-09 23:17 - 00224300 _____ C:\WINDOWS\Minidump\120915-8015-01.dmp 2015-12-09 06:39 - 2015-12-09 06:39 - 00000000 ___HD C:\OneDriveTemp 2015-12-08 23:36 - 2015-12-01 08:12 - 02152800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2015-12-08 23:36 - 2015-11-24 13:07 - 01817160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-12-08 23:36 - 2015-11-24 12:07 - 03671896 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-12-08 23:36 - 2015-11-24 12:06 - 01540768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-12-08 23:36 - 2015-11-24 11:26 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2015-12-08 23:36 - 2015-11-24 11:03 - 02918808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-12-08 23:36 - 2015-11-24 11:01 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb 2015-12-08 23:36 - 2015-11-24 10:54 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll 2015-12-08 23:36 - 2015-11-24 10:53 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-12-08 23:36 - 2015-11-24 10:45 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshrm.dll 2015-12-08 23:36 - 2015-11-24 10:37 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys 2015-12-08 23:36 - 2015-11-24 10:26 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2015-12-08 23:36 - 2015-11-24 10:19 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll 2015-12-08 23:36 - 2015-11-24 10:12 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll 2015-12-08 23:36 - 2015-11-24 09:58 - 00604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-12-08 23:36 - 2015-11-24 09:55 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-12-08 23:36 - 2015-11-24 09:54 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb 2015-12-08 23:36 - 2015-11-24 09:52 - 01717248 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2015-12-08 23:36 - 2015-11-24 09:49 - 01648640 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll 2015-12-08 23:36 - 2015-11-24 09:27 - 03593216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-12-08 23:36 - 2015-11-24 09:14 - 00415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll 2015-12-08 23:36 - 2015-11-24 09:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-12-08 23:36 - 2015-11-24 08:59 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2015-12-08 23:36 - 2015-11-24 08:57 - 01328128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll 2015-12-08 23:36 - 2015-11-24 08:35 - 22393856 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-12-08 23:36 - 2015-11-24 08:29 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-12-08 23:36 - 2015-11-24 08:25 - 24601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-12-08 23:36 - 2015-11-24 08:23 - 13381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-12-08 23:36 - 2015-11-24 08:11 - 18678272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-12-08 23:36 - 2015-11-24 08:09 - 19338240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-12-08 23:36 - 2015-11-24 08:08 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-12-08 23:36 - 2015-11-24 08:04 - 02155008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-12-08 21:29 - 2015-12-08 21:29 - 00281684 _____ C:\WINDOWS\Minidump\120815-8421-01.dmp 2015-12-08 21:18 - 2015-12-11 08:31 - 02870984 _____ (ESET) C:\Users\Lorenz\Downloads\esetsmartinstaller_deu.exe 2015-12-08 21:18 - 2015-12-09 15:17 - 00852720 _____ C:\Users\Lorenz\Downloads\SecurityCheck.exe 2015-12-06 22:04 - 2015-12-09 23:17 - 00000000 ____D C:\WINDOWS\Minidump 2015-12-06 22:04 - 2015-12-06 22:04 - 00284108 _____ C:\WINDOWS\Minidump\120615-8703-01.dmp 2015-12-06 10:00 - 2015-12-11 16:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-12-06 09:31 - 2015-12-06 09:47 - 00000547 _____ C:\Users\Lorenz\Desktop\JRT.txt 2015-12-06 09:27 - 2015-12-06 09:27 - 01599336 _____ (Malwarebytes) C:\Users\Lorenz\Downloads\JRT.exe 2015-12-06 08:53 - 2015-12-06 08:53 - 00000000 ____D C:\Users\Lorenz\AppData\Local\TempTaskUpdateDetection89B89E90-6C05-44F5-9DF9-4A713580C0C8 2015-12-06 08:41 - 2015-12-06 08:53 - 00000000 ____D C:\AdwCleaner 2015-12-05 23:50 - 2015-12-05 23:50 - 00001555 _____ C:\Users\Lorenz\Downloads\mbam.txt 2015-12-05 23:39 - 2015-12-06 08:39 - 01736704 _____ C:\Users\Lorenz\Downloads\AdwCleaner_5.023.exe 2015-12-05 23:39 - 2015-12-05 23:39 - 00001178 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-12-05 23:39 - 2015-12-05 23:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-12-05 23:39 - 2015-12-05 23:39 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-12-05 23:39 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-12-05 23:39 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2015-12-05 23:38 - 2015-12-05 23:39 - 22908888 _____ (Malwarebytes ) C:\Users\Lorenz\Downloads\mbam-setup-2.2.0.1024.exe 2015-12-04 17:54 - 2015-12-04 18:05 - 00108800 _____ C:\TDSSKiller.3.1.0.7_04.12.2015_17.54.28_log.txt 2015-12-04 17:34 - 2015-12-11 08:09 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-12-04 17:34 - 2015-12-05 23:39 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-12-04 17:34 - 2015-12-04 17:53 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-12-04 17:33 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-12-04 17:32 - 2015-12-04 17:53 - 00000000 ____D C:\Users\Lorenz\Desktop\mbar 2015-12-04 17:31 - 2015-12-04 17:54 - 04398264 _____ (Kaspersky Lab ZAO) C:\Users\Lorenz\Downloads\tdsskiller.exe 2015-12-04 17:31 - 2015-12-04 17:32 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Lorenz\Downloads\mbar-1.09.3.1001.exe 2015-12-03 17:02 - 2015-11-22 10:52 - 16984576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-12-03 17:02 - 2015-11-22 10:34 - 02843136 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll 2015-12-03 17:01 - 2015-11-22 11:47 - 07476576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-12-03 17:01 - 2015-11-22 11:47 - 02653816 _____ C:\WINDOWS\system32\CoreUIComponents.dll 2015-12-03 17:01 - 2015-11-22 11:41 - 01859448 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2015-12-03 17:01 - 2015-11-22 11:41 - 01284960 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-12-03 17:01 - 2015-11-22 11:41 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2015-12-03 17:01 - 2015-11-22 11:35 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll 2015-12-03 17:01 - 2015-11-22 11:34 - 00975200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-12-03 17:01 - 2015-11-22 11:34 - 00080600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwapi.dll 2015-12-03 17:01 - 2015-11-22 11:33 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys 2015-12-03 17:01 - 2015-11-22 11:33 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll 2015-12-03 17:01 - 2015-11-22 11:33 - 00051680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsUtilsV2.dll 2015-12-03 17:01 - 2015-11-22 11:30 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2015-12-03 17:01 - 2015-11-22 11:30 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys 2015-12-03 17:01 - 2015-11-22 11:26 - 00431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll 2015-12-03 17:01 - 2015-11-22 11:25 - 00063528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wwapi.dll 2015-12-03 17:01 - 2015-11-22 11:24 - 02772584 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll 2015-12-03 17:01 - 2015-11-22 11:20 - 00795840 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2015-12-03 17:01 - 2015-11-22 11:19 - 00440160 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe 2015-12-03 17:01 - 2015-11-22 11:14 - 02185840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll 2015-12-03 17:01 - 2015-11-22 10:55 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManagerProxy.dll 2015-12-03 17:01 - 2015-11-22 10:54 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ETWCoreUIComponentsResources.dll 2015-12-03 17:01 - 2015-11-22 10:54 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys 2015-12-03 17:01 - 2015-11-22 10:52 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll 2015-12-03 17:01 - 2015-11-22 10:51 - 00157184 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe 2015-12-03 17:01 - 2015-11-22 10:51 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll 2015-12-03 17:01 - 2015-11-22 10:50 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssign32.dll 2015-12-03 17:01 - 2015-11-22 10:49 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2015-12-03 17:01 - 2015-11-22 10:49 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll 2015-12-03 17:01 - 2015-11-22 10:45 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll 2015-12-03 17:01 - 2015-11-22 10:45 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll 2015-12-03 17:01 - 2015-11-22 10:45 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2015-12-03 17:01 - 2015-11-22 10:45 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll 2015-12-03 17:01 - 2015-11-22 10:44 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll 2015-12-03 17:01 - 2015-11-22 10:43 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll 2015-12-03 17:01 - 2015-11-22 10:43 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-12-03 17:01 - 2015-11-22 10:43 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll 2015-12-03 17:01 - 2015-11-22 10:43 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll 2015-12-03 17:01 - 2015-11-22 10:42 - 13017600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-12-03 17:01 - 2015-11-22 10:42 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll 2015-12-03 17:01 - 2015-11-22 10:42 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll 2015-12-03 17:01 - 2015-11-22 10:42 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll 2015-12-03 17:01 - 2015-11-22 10:42 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ETWCoreUIComponentsResources.dll 2015-12-03 17:01 - 2015-11-22 10:41 - 01814528 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll 2015-12-03 17:01 - 2015-11-22 10:41 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll 2015-12-03 17:01 - 2015-11-22 10:41 - 00607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll 2015-12-03 17:01 - 2015-11-22 10:40 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll 2015-12-03 17:01 - 2015-11-22 10:40 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 02126848 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-12-03 17:01 - 2015-11-22 10:39 - 01713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-12-03 17:01 - 2015-11-22 10:39 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll 2015-12-03 17:01 - 2015-11-22 10:38 - 01223168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-12-03 17:01 - 2015-11-22 10:38 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll 2015-12-03 17:01 - 2015-11-22 10:38 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll 2015-12-03 17:01 - 2015-11-22 10:38 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll 2015-12-03 17:01 - 2015-11-22 10:38 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssign32.dll 2015-12-03 17:01 - 2015-11-22 10:37 - 02624512 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll 2015-12-03 17:01 - 2015-11-22 10:37 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll 2015-12-03 17:01 - 2015-11-22 10:37 - 00515584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll 2015-12-03 17:01 - 2015-11-22 10:36 - 01042432 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll 2015-12-03 17:01 - 2015-11-22 10:34 - 00345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll 2015-12-03 17:01 - 2015-11-22 10:33 - 02587136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-12-03 17:01 - 2015-11-22 10:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll 2015-12-03 17:01 - 2015-11-22 10:32 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2015-12-03 17:01 - 2015-11-22 10:31 - 07199232 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2015-12-03 17:01 - 2015-11-22 10:31 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll 2015-12-03 17:01 - 2015-11-22 10:31 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll 2015-12-03 17:01 - 2015-11-22 10:30 - 02598400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll 2015-12-03 17:01 - 2015-11-22 10:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 01734656 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 01443328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRHInproc.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 00793600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll 2015-12-03 17:01 - 2015-11-22 10:28 - 00686592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-12-03 17:01 - 2015-11-22 10:27 - 03993600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2015-12-03 17:01 - 2015-11-22 10:27 - 02049024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-12-03 17:01 - 2015-11-22 10:27 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll 2015-12-03 17:01 - 2015-11-22 10:27 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll 2015-12-03 17:01 - 2015-11-22 10:27 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll 2015-12-03 17:01 - 2015-11-22 10:26 - 03355136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2015-12-03 17:01 - 2015-11-22 10:26 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll 2015-12-03 17:01 - 2015-11-22 10:26 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll 2015-12-03 17:01 - 2015-11-22 10:26 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll 2015-12-03 17:01 - 2015-11-22 10:25 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll 2015-12-03 17:01 - 2015-11-22 10:25 - 02280448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2015-12-03 17:01 - 2015-11-22 10:24 - 02647552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-12-03 17:01 - 2015-11-22 10:24 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll 2015-12-03 17:01 - 2015-11-22 10:24 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll 2015-12-03 17:01 - 2015-11-22 10:23 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2015-12-03 17:01 - 2015-11-22 10:20 - 01860096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll 2015-12-03 17:01 - 2015-11-22 10:19 - 02064384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-12-03 17:01 - 2015-11-22 10:18 - 01505280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-12-03 17:01 - 2015-11-22 10:18 - 00697856 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll 2015-12-03 17:01 - 2015-11-22 10:18 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll 2015-12-03 17:01 - 2015-11-22 10:17 - 02680320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2015-12-03 17:01 - 2015-11-22 10:17 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-12-03 17:01 - 2015-11-22 10:16 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll 2015-12-03 17:01 - 2015-11-22 10:11 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll 2015-12-03 17:00 - 2015-11-22 11:00 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll 2015-12-03 17:00 - 2015-11-22 11:00 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosResource.dll 2015-12-03 17:00 - 2015-11-22 10:57 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MapControls.dll 2015-12-03 17:00 - 2015-11-22 10:57 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCoreRes.dll 2015-12-03 17:00 - 2015-11-22 10:57 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosTrace.dll 2015-12-03 17:00 - 2015-11-22 10:57 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosHost.dll 2015-12-03 17:00 - 2015-11-22 10:56 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll 2015-12-03 17:00 - 2015-11-22 10:56 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll 2015-12-03 17:00 - 2015-11-22 10:56 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ihvrilproxy.dll 2015-12-03 17:00 - 2015-11-22 10:56 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\rilproxy.dll 2015-12-03 17:00 - 2015-11-22 10:55 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvcProxy.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsplib.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\nativemap.dll 2015-12-03 17:00 - 2015-11-22 10:54 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlStringsRes.dll 2015-12-03 17:00 - 2015-11-22 10:52 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll 2015-12-03 17:00 - 2015-11-22 10:52 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll 2015-12-03 17:00 - 2015-11-22 10:52 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll 2015-12-03 17:00 - 2015-11-22 10:51 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll 2015-12-03 17:00 - 2015-11-22 10:51 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll 2015-12-03 17:00 - 2015-11-22 10:51 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapstoasttask.dll 2015-12-03 17:00 - 2015-11-22 10:49 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll 2015-12-03 17:00 - 2015-11-22 10:49 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanpref.dll 2015-12-03 17:00 - 2015-11-22 10:48 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosResource.dll 2015-12-03 17:00 - 2015-11-22 10:47 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll 2015-12-03 17:00 - 2015-11-22 10:46 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll 2015-12-03 17:00 - 2015-11-22 10:46 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll 2015-12-03 17:00 - 2015-11-22 10:45 - 00264192 _____ (Nokia) C:\WINDOWS\system32\NmaDirect.dll 2015-12-03 17:00 - 2015-11-22 10:45 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MapControls.dll 2015-12-03 17:00 - 2015-11-22 10:45 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCoreRes.dll 2015-12-03 17:00 - 2015-11-22 10:45 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosTrace.dll 2015-12-03 17:00 - 2015-11-22 10:45 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosHost.dll 2015-12-03 17:00 - 2015-11-22 10:44 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll 2015-12-03 17:00 - 2015-11-22 10:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll 2015-12-03 17:00 - 2015-11-22 10:43 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll 2015-12-03 17:00 - 2015-11-22 10:42 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll 2015-12-03 17:00 - 2015-11-22 10:42 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlStringsRes.dll 2015-12-03 17:00 - 2015-11-22 10:40 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll 2015-12-03 17:00 - 2015-11-22 10:40 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll 2015-12-03 17:00 - 2015-11-22 10:40 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll 2015-12-03 17:00 - 2015-11-22 10:39 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll 2015-12-03 17:00 - 2015-11-22 10:39 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll 2015-12-03 17:00 - 2015-11-22 10:39 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll 2015-12-03 17:00 - 2015-11-22 10:39 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll 2015-12-03 17:00 - 2015-11-22 10:34 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll 2015-12-03 17:00 - 2015-11-22 10:34 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll 2015-12-03 17:00 - 2015-11-22 10:34 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll 2015-12-03 17:00 - 2015-11-22 10:34 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll 2015-12-03 17:00 - 2015-11-22 10:33 - 00205824 _____ (Nokia) C:\WINDOWS\SysWOW64\NmaDirect.dll 2015-12-03 17:00 - 2015-11-22 10:32 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll 2015-12-03 17:00 - 2015-11-22 10:28 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll 2015-12-03 17:00 - 2015-11-22 10:28 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll 2015-12-03 17:00 - 2015-11-22 10:27 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll 2015-12-03 17:00 - 2015-11-22 10:25 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll 2015-12-03 17:00 - 2015-11-22 10:24 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll 2015-12-03 17:00 - 2015-11-22 10:24 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll 2015-12-03 09:23 - 2015-12-03 09:24 - 00075288 _____ C:\Users\Lorenz\Downloads\Addition.txt 2015-12-03 09:22 - 2015-12-11 16:27 - 00028066 _____ C:\Users\Lorenz\Downloads\FRST.txt 2015-12-03 09:22 - 2015-12-11 16:27 - 00000000 ____D C:\FRST 2015-12-03 09:17 - 2015-12-11 16:27 - 02369024 _____ (Farbar) C:\Users\Lorenz\Downloads\FRST64.exe 2015-12-03 09:15 - 2015-12-03 09:15 - 00000000 _____ C:\Users\Lorenz\defogger_reenable 2015-12-03 09:14 - 2015-12-03 09:21 - 00380416 _____ C:\Users\Lorenz\Downloads\Gmer-19357.exe 2015-12-03 09:14 - 2015-12-03 09:15 - 00050477 _____ C:\Users\Lorenz\Downloads\Defogger.exe 2015-12-02 11:41 - 2015-12-02 11:41 - 00000000 ____D C:\Users\Lorenz\AppData\Local\ActiveSync 2015-12-02 11:33 - 2015-12-02 11:33 - 00000020 ___SH C:\Users\Lorenz\ntuser.ini 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Vorlagen 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Startmenü 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Eigene Dateien 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Druckumgebung 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Videos 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Videos 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf 2015-12-02 11:33 - 2015-12-02 11:33 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten 2015-12-02 11:30 - 2015-12-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-12-02 11:26 - 2015-12-02 11:26 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-12-02 11:21 - 2015-12-02 11:27 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate 2015-12-02 11:20 - 2015-12-10 22:41 - 00000000 ____D C:\Users\Lorenz 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Vorlagen 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Startmenü 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Netzwerkumgebung 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Lokale Einstellungen 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Eigene Dateien 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Druckumgebung 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Videos 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Musik 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Documents\Eigene Bilder 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Local\Verlauf 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\AppData\Local\Anwendungsdaten 2015-12-02 11:20 - 2015-12-02 11:20 - 00000000 _SHDL C:\Users\Lorenz\Anwendungsdaten 2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_SensorsHid_02_15_00.Wdf 2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TrueColor_01011.Wdf 2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SurfacePenDriver_01011.Wdf 2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____D C:\WINDOWS\SysWOW64\TrueColor5.2 2015-12-02 11:19 - 2015-12-02 11:19 - 00000000 ____D C:\WINDOWS\system32\TrueColor5.2 2015-12-02 11:19 - 2015-10-30 08:17 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll 2015-12-02 11:19 - 2015-09-06 12:12 - 00099856 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL 2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____H C:\ProgramData\DP45977C.lfl 2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____D C:\WINDOWS\Firmware 2015-12-02 11:18 - 2015-12-02 11:18 - 00000000 ____D C:\Program Files\Intel 2015-12-02 11:17 - 2015-12-11 15:24 - 00000000 ____D C:\WINDOWS\system32\SleepStudy 2015-12-02 11:17 - 2015-12-10 13:21 - 00442840 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-12-02 11:17 - 2015-12-02 12:00 - 00000000 ___DC C:\WINDOWS\Panther 2015-12-02 11:15 - 2015-12-02 11:15 - 22572632 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 21125408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 02544264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 02001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00969728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00911648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00809312 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00791552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00698208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00675064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00586208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00586080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00578912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2015-12-02 11:15 - 2015-12-02 11:15 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00540752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00523616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2015-12-02 11:15 - 2015-12-02 11:15 - 00516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00511320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00454056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00408128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00405048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2015-12-02 11:15 - 2015-12-02 11:15 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00366224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-AppModelExecEvents.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys 2015-12-02 11:15 - 2015-12-02 11:15 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00116728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00110032 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00088392 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.proxy.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00035680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys 2015-12-02 11:15 - 2015-12-02 11:15 - 00035656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00032040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.proxy.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe 2015-12-02 11:15 - 2015-12-02 11:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll 2015-12-02 11:15 - 2015-12-02 11:15 - 00000000 ____D C:\Windows.old 2015-12-02 11:13 - 2015-12-02 11:13 - 00008192 _____ C:\WINDOWS\system32\config\userdiff 2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer 2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files\Reference Assemblies 2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files\MSBuild 2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies 2015-12-02 11:11 - 2015-12-02 11:11 - 00000000 ____D C:\Program Files (x86)\MSBuild 2015-12-02 11:11 - 2015-10-23 17:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll 2015-12-02 11:11 - 2015-10-23 17:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-12-02 11:11 - 2015-10-23 17:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe 2015-12-02 11:11 - 2015-10-23 17:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll 2015-12-02 11:11 - 2015-10-23 17:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe 2015-12-02 11:11 - 2015-10-23 17:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2015-11-27 21:54 - 2015-11-27 21:54 - 05359935 _____ C:\Users\Lorenz\Downloads\kinox_app_1.0.5.apk 2015-11-23 17:35 - 2015-11-23 17:35 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Avira 2015-11-23 16:34 - 2015-12-01 14:13 - 00146696 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys 2015-11-23 16:34 - 2015-12-01 14:13 - 00135880 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys 2015-11-23 16:34 - 2015-12-01 14:13 - 00073032 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys 2015-11-23 16:34 - 2015-12-01 14:13 - 00035488 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys 2015-11-23 16:32 - 2015-11-23 16:32 - 04584344 _____ (Avira Operations GmbH & Co. KG) C:\Users\Lorenz\Downloads\avira_de_av_5655784164__ws.exe 2015-11-23 16:31 - 2015-07-05 11:08 - 00300704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2015-11-23 16:28 - 2015-11-23 16:29 - 00000000 ____D C:\escw_103_sa 2015-11-23 16:17 - 2015-11-23 16:18 - 152989672 _____ C:\Users\Lorenz\Downloads\escw_103_sa_sfx.exe 2015-11-20 08:13 - 2015-11-20 10:36 - 00000000 ____D C:\Users\Lorenz\AppData\Local\ABBF10EB-058A-4174-AE2A-78C7323AAD12.aplzod 2015-11-19 11:50 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-11-14 23:13 - 2015-11-28 18:39 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Foxit Reader 2015-11-13 13:19 - 2015-11-13 13:19 - 00000000 ____D C:\Users\Lorenz\.tooling 2015-11-13 13:12 - 2015-12-07 13:21 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Eclipse 2015-11-13 13:10 - 2015-11-13 13:10 - 00001126 _____ C:\Users\Lorenz\Desktop\Eclipse Java Mars.lnk 2015-11-13 13:10 - 2015-11-13 13:10 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eclipse 2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\eclipse 2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Sun 2015-11-13 13:03 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\AppData\LocalLow\Sun 2015-11-13 13:02 - 2015-12-07 13:21 - 00000000 ____D C:\Users\Lorenz\.p2 2015-11-13 13:02 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-11-13 13:02 - 2015-11-13 13:02 - 00110176 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll 2015-11-13 13:01 - 2015-11-13 13:04 - 00000000 ____D C:\ProgramData\Oracle 2015-11-13 13:01 - 2015-11-13 13:03 - 00000000 ____D C:\Users\Lorenz\.oracle_jre_usage 2015-11-13 13:01 - 2015-11-13 13:01 - 46355176 _____ C:\Users\Lorenz\Downloads\eclipse-inst-win64.exe 2015-11-13 12:58 - 2015-12-02 11:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2015-11-13 12:58 - 2015-11-13 13:01 - 00000000 ____D C:\Program Files\Java 2015-11-13 12:57 - 2015-11-13 12:57 - 00000000 ____D C:\Users\Lorenz\AppData\LocalLow\Oracle 2015-11-13 12:55 - 2015-11-13 12:57 - 195629144 _____ (Oracle Corporation) C:\Users\Lorenz\Downloads\jdk-8u65-windows-x64.exe 2015-11-12 16:17 - 2015-12-02 11:27 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-11 16:26 - 2014-11-19 20:28 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Spotify 2015-12-11 16:25 - 2015-01-22 15:44 - 00001144 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-12-11 16:25 - 2014-10-14 20:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-12-11 16:18 - 2015-07-06 08:40 - 00000000 ____D C:\Users\Lorenz\Documents\Outlook-Dateien 2015-12-11 16:10 - 2015-06-17 07:00 - 00001254 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001UA.job 2015-12-11 15:48 - 2014-10-16 15:30 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-12-11 15:34 - 2014-11-19 20:29 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Spotify 2015-12-11 15:10 - 2015-06-17 07:00 - 00001202 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001Core.job 2015-12-11 14:39 - 2014-10-14 19:24 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CA419BB4-6605-47F9-9529-DB8D2C018ECF} 2015-12-11 13:25 - 2015-01-22 15:44 - 00001140 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-12-11 10:31 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-12-11 08:13 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps 2015-12-11 08:10 - 2015-08-01 11:37 - 00000000 ___RD C:\Users\Lorenz\iCloudDrive 2015-12-11 08:10 - 2014-10-15 21:30 - 00000000 ___RD C:\Users\Lorenz\Dropbox 2015-12-11 08:10 - 2014-10-15 21:28 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Dropbox 2015-12-10 21:48 - 2014-10-16 15:30 - 00003870 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-12-10 21:33 - 2015-10-30 19:35 - 00776766 _____ C:\WINDOWS\system32\perfh007.dat 2015-12-10 21:33 - 2015-10-30 19:35 - 00155544 _____ C:\WINDOWS\system32\perfc007.dat 2015-12-10 21:33 - 2015-10-30 08:21 - 00000000 ____D C:\WINDOWS\INF 2015-12-10 21:33 - 2015-08-03 23:45 - 01799166 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-12-09 23:29 - 2015-01-22 15:44 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-12-09 23:24 - 2015-08-04 08:20 - 00002436 _____ C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-12-09 23:24 - 2014-10-14 19:20 - 00000000 __RDO C:\Users\Lorenz\OneDrive 2015-12-09 23:17 - 2015-10-30 07:28 - 00000000 ____D C:\Windows 2015-12-09 13:49 - 2015-08-04 09:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-12-09 12:00 - 2015-10-30 08:11 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-12-09 06:38 - 2015-10-30 07:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI 2015-12-09 06:38 - 2015-10-29 08:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2015-12-09 06:38 - 2015-10-29 08:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2015-12-09 06:22 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\oobe 2015-12-08 23:39 - 2015-10-29 08:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-12-08 21:44 - 2014-10-14 19:17 - 00000000 ____D C:\Users\Lorenz\AppData\Local\VirtualStore 2015-12-08 21:32 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports 2015-12-05 20:19 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\rescache 2015-12-03 22:51 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-12-03 20:27 - 2015-07-16 10:33 - 00000000 ____D C:\Users\Lorenz\.eclipse 2015-12-03 08:42 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\appcompat 2015-12-02 13:20 - 2015-01-22 15:44 - 00004202 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2015-12-02 13:20 - 2015-01-22 15:44 - 00003970 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2015-12-02 11:46 - 2014-10-14 19:17 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Packages 2015-12-02 11:40 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow 2015-12-02 11:34 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\PrintDialog 2015-12-02 11:34 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\MiracastView 2015-12-02 11:33 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2015-12-02 11:33 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files\Windows NT 2015-12-02 11:33 - 2014-08-06 14:02 - 00000000 __RHD C:\Users\Public\AccountPictures 2015-12-02 11:32 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\Registration 2015-12-02 11:32 - 2015-08-01 23:13 - 00020958 _____ C:\WINDOWS\diagwrn.xml 2015-12-02 11:32 - 2015-08-01 23:13 - 00020958 _____ C:\WINDOWS\diagerr.xml 2015-12-02 11:31 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase 2015-12-02 11:30 - 2015-10-30 08:24 - 00000000 __RSD C:\WINDOWS\Media 2015-12-02 11:30 - 2015-10-30 08:24 - 00000000 __RHD C:\Users\Public\Libraries 2015-12-02 11:30 - 2015-08-03 23:43 - 00023056 _____ C:\WINDOWS\system32\emptyregdb.dat 2015-12-02 11:30 - 2015-07-22 13:00 - 00002954 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-12-02 11:30 - 2015-06-17 07:00 - 00003868 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001UA 2015-12-02 11:30 - 2015-06-17 07:00 - 00003596 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2261460588-3622448717-587553582-1001Core 2015-12-02 11:30 - 2014-10-14 19:24 - 00002878 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2261460588-3622448717-587553582-1001 2015-12-02 11:27 - 2015-10-30 08:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2015-12-02 11:27 - 2015-10-30 07:28 - 00008192 ___SH C:\WINDOWS\system32\config\ELAM 2015-12-02 11:27 - 2015-10-25 12:15 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autodesk 2015-12-02 11:27 - 2015-10-25 12:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk Inventor 2014 2015-12-02 11:27 - 2015-10-25 12:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DWG TrueView 2014 2015-12-02 11:27 - 2015-10-25 12:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk 2015-12-02 11:27 - 2015-10-20 09:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6 2015-12-02 11:27 - 2015-07-10 10:05 - 00000000 ____D C:\Users\Default.migrated 2015-12-02 11:27 - 2015-07-08 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2015-12-02 11:27 - 2015-07-04 08:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\devolo 2015-12-02 11:27 - 2015-04-14 20:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RStudio 2015-12-02 11:27 - 2015-04-14 17:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R 2015-12-02 11:27 - 2015-03-24 17:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2015-12-02 11:27 - 2015-01-22 15:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-12-02 11:27 - 2014-11-20 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator 2015-12-02 11:27 - 2014-11-20 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2 2015-12-02 11:27 - 2014-11-15 21:19 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2015-12-02 11:27 - 2014-11-15 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2015-12-02 11:27 - 2014-11-13 19:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP630 series 2015-12-02 11:27 - 2014-11-06 20:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2015-12-02 11:27 - 2014-10-22 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape 2015-12-02 11:27 - 2014-10-16 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MatheGrafix 2015-12-02 11:27 - 2014-10-15 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ___SD C:\WINDOWS\Downloaded Program Files 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\spool 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\NDF 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\InputMethod 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\InputMethod 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\ProgramData\USOPrivate 2015-12-02 11:23 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2015-12-02 11:23 - 2015-10-22 19:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco 2015-12-02 11:23 - 2015-05-26 14:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Texmaker 2015-12-02 11:23 - 2014-11-15 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC 2015-12-02 11:23 - 2014-11-13 19:56 - 00000000 ___HD C:\WINDOWS\system32\CanonIJ Uninstaller Information 2015-12-02 11:23 - 2014-10-30 21:22 - 00000000 ____D C:\WINDOWS\system32\appmgmt 2015-12-02 11:23 - 2014-10-30 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SCM Microsystems 2015-12-02 11:23 - 2014-10-20 17:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities 2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared 2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared 2015-12-02 11:23 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\ADFS 2015-12-02 11:20 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep 2015-12-02 11:17 - 2015-10-30 19:58 - 00000000 ____D C:\WINDOWS\ServiceProfiles 2015-12-02 11:17 - 2015-10-30 08:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template 2015-12-02 11:15 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-12-02 11:15 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\Provisioning 2015-12-02 11:15 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism 2015-12-02 11:15 - 2015-10-30 07:28 - 00000000 ____D C:\WINDOWS\system32\Dism 2015-12-02 11:11 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI 2015-12-02 11:11 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\MUI 2015-12-02 10:57 - 2015-10-30 20:28 - 00000000 ___HD C:\$WINDOWS.~BT 2015-12-01 01:33 - 2015-10-30 08:26 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-12-01 01:33 - 2015-10-30 08:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-11-27 16:13 - 2015-11-02 15:55 - 00000000 ____D C:\Users\Lorenz\AppData\Roaming\Foxit Software 2015-11-26 10:27 - 2015-10-22 21:57 - 00000000 ____D C:\Users\Lorenz\Documents\inventor 2015-11-26 08:05 - 2014-10-14 23:54 - 00000000 ____D C:\Program Files\Microsoft Office 15 2015-11-26 08:02 - 2015-07-22 13:00 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2015-11-23 16:34 - 2014-10-15 21:19 - 00000000 ____D C:\ProgramData\Avira 2015-11-23 16:34 - 2014-10-15 21:19 - 00000000 ____D C:\Program Files (x86)\Avira 2015-11-23 16:32 - 2014-05-08 23:25 - 00000000 ____D C:\ProgramData\Package Cache 2015-11-22 10:18 - 2014-10-17 08:38 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-11-22 10:15 - 2014-10-17 08:38 - 145617392 ____N (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-11-19 11:50 - 2015-04-14 12:15 - 00000000 ____D C:\Users\Lorenz\AppData\Local\Apple Inc 2015-11-19 11:49 - 2014-10-25 18:09 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-11-13 18:30 - 2015-10-23 08:54 - 00000000 ____D C:\ProgramData\boost_interprocess 2015-11-11 08:08 - 2014-12-03 19:22 - 00000000 ____D C:\Users\Lorenz\AppData\Local\WEB.DE Application {sync-000021} ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-10-09 18:04 - 2015-10-09 18:04 - 0000833 _____ () C:\Users\Lorenz\AppData\Local\recently-used.xbel 2015-12-02 11:18 - 2015-12-02 11:18 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Einige Dateien in TEMP: ==================== C:\Users\Lorenz\AppData\Local\Temp\avgnt.exe C:\Users\Lorenz\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpc7sxo2.dll C:\Users\Lorenz\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-12-02 11:17 ==================== Ende von FRST.txt ============================ |
|
11.12.2015, 22:59
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner eBay&email Hack vom PC entfernen Sieht soweit ok aus
__________________ Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ |
|
12.12.2015, 09:20
| #19 |
| | Trojaner eBay&email Hack vom PC entfernen Wirklich erkennbare Probleme hatte ich nie. Das was mich stuzig gemacht hat ist die Meldung vom lrz Netzwerk, dass die Datenmenge exzessiv überschritten wurde und sich u.U. ein Virus auf dem Gerät befindet. Die kam zuletzt am Mittwoch. |
|
13.12.2015, 01:43
| #20 | ||||||||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner eBay&email Hack vom PC entfernen Dann wären wir durch! Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.  Abschließend müssen wir noch ein paar Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.  Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:
Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. NoScript kann gerade bei technisch nicht allzu versierten Nutzern beim Surfen zum Nervfaktor werden; ob das Tool geeignet ist, muss jeder selbst mal ausprobieren und dann für sich entscheiden. Alternativen zu NoScript (wenn um das das Verhindern von Usertracking und Werbung auf Webseiten) geht wären da Ghostery oder uBlock. Ghostery ist eine sehr bekannte Erweiterung, die aber auch in Kritik geraten ist, vgl. dazu bitte diesen Thread => Ghostery schleift Werbung durch Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden. Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.12.2015, 19:35
| #21 |
| | Trojaner eBay&email Hack vom PC entfernen Super vielen Dank! Habe die letzten Anweisungen noch befolgt. Ich verwende momentan Avira als Virenschutz. Genügt hier die Sicherheit oder soll ich auf eins von den von dir empfohlenen Programmen zurück greifen? |
|
13.12.2015, 20:36
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner eBay&email Hack vom PC entfernen Avira wird hier schon lange nicht mehr empfohlen. Ich rate immer zu MSE oder Emsisoft.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.12.2015, 21:17
| #23 |
| | Trojaner eBay&email Hack vom PC entfernen Okay danke dir! |
|
| Themen zu Trojaner eBay&email Hack vom PC entfernen |
| akamai, antivirus, avira, bonjour, canon, converter, desktop, dnsapi.dll, downloader, e-mail, ebay, email, entfernen, festplatte, firefox, flash player, google, helper, homepage, hängt, mp3, onedrive, scan, software, starten, svchost.exe, trojaner, windows, windows 10 pro, windowsapps |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
