| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFoxWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
27.05.2016, 18:05
| #1 |
| |  Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox problem siehe Titel: Auf dem Windows 8 Rechner scheint ein Malwareproblem zu herrschen, in den Browserfenstern ist zunehmend Werbung zu sehen die Titelseite von Firefox ist übersät mit Spieleicons. IE meldet ein Addon Problem, die von MS vorgeshclagenen Problemlösungen scheitern. Lösungssuche ist durch ständiges Abstürzen von Websites ("Website xy reagiert nicht und muss beendet werden") und blockierten Eingabefenstern erschwert.Ein Posten hier im Forum war bis dahin unmöglich, daher: Scan mittes Malwareerkennung und Virenscanner. - Malware wurde mit Malwarebytes und Spybot erkannt und entfernt. - (Logdateien untenstehend). Deshalb danach überhaupt erst FRST Scan möglich, voila, untenstehend inc Addition txt. Nun ist alles zwar besser, d.h. Internet wieder einigermassen benutzbar, aber nicht behoben, denn der Rechner bleibt auch in anderen Programmen verlangsamt, im Taskmanager zeigen sich weiterhin weder Arbeitsspeicher noch die CPU überlastet. Herzlichen Dank im voraus, gut dass Ihr da seid.  Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-05-2016
durchgeführt von Rhea (2016-05-24 00:11:22)
Gestartet von C:\Users\Rhea\Downloads
Windows 8.1 (Update) (X64) (2014-05-23 00:02:59)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3879709871-1962586687-2025067079-500 - Administrator - Disabled)
Gast (S-1-5-21-3879709871-1962586687-2025067079-501 - Limited - Disabled)
Rhea (S-1-5-21-3879709871-1962586687-2025067079-1001 - Administrator - Enabled) => C:\Users\Rhea
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.35 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0935-000001000000}) (Version: 9.35.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.7.0 - Conexant)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.33 - Lenovo)
Energy Manager (x32 Version: 1.0.0.33 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.50 - FileZilla Project)
Garmin BaseCamp (HKLM-x32\...\{B0BED0BB-E1C4-49AA-840F-7CA052ADF5EB}) (Version: 4.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GMX MailCheck (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.6.1 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 4.0.1.0 - 1&1 Mail & Media GmbH)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{E7E2BEA6-ECCE-4306-9486-A08781BE0AD0}) (Version: 2.0.0.1104 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.0.1104 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.0.13.12271 - Lenovo)
Lenovo Yoga PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.1.9.5 - Lenovo)
Lenovo Yoga PhoneCompanion (x32 Version: 1.1.9.5 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 45.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 de)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
Mozilla Thunderbird 38.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.6.0 (x86 de)) (Version: 38.6.0 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PHOTOfunSTUDIO 9.6 PE (HKLM-x32\...\{7113ACE0-A2FA-463B-969A-E3FD7BF42573}) (Version: 9.06.710.1031 - Panasonic Corporation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.310 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.1.16 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.60 (17.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.79.00(26.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM-x32\...\Easy Wireless Setup) (Version: 3.70.18.0 - Samsung Electronics Co., Ltd.)
Samsung M2070 Series (HKLM-x32\...\Samsung M2070 Series) (Version: 1.19 (03.12.2014) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series XPS (Windows 8) (HKLM-x32\...\Samsung M2070 Series XPS (Windows 8)) (Version: 3.03.08.00:05 - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.11.28 (10.03.2015) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.01.12 (15.10.2014) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Assistant (HKLM-x32\...\Samsung Scan Assistant) (Version: 1.05.07 (20.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.25 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.06.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SILKYPIX Developer Studio 4.2 SE (HKLM-x32\...\InstallShield_{8B9D37A0-F77B-41DD-932A-CE01DEC1ADAA}) (Version: 4 - Ichikawa Soft Laboratory)
SILKYPIX Developer Studio 4.2 SE (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.6 - Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
Yoga Picks (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.013.1202 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {48F86BC9-1A37-4268-8DC9-4B902CAEC945} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {4D1C6EFB-FADF-4188-9DAE-072F214E05B7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-22] (Adobe Systems Incorporated)
Task: {721CA287-0ACF-41C2-A15A-35A9A2785A33} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {7520915A-6376-4F3A-9F78-6895858C2E24} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {80EFEDA3-E3E4-451A-81B7-A19891B23FDA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {CFE11131-73E0-419A-BE2D-C3A87FC84D8F} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-10-08] (1&1 Mail & Media GmbH)
Task: {D8C74952-C759-495C-BAED-612B80646889} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {E150FFDF-A864-4558-96E3-20BABF992B86} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\WINDOWS\system32\MRT.exe [2016-05-23] (Microsoft Corporation)
Task: {F69EE45E-80DB-40F7-B912-B46E9C2F1791} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11517530520.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd10c1016 -pinnedTimeHigh 0x01d0d295 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/ende/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11689991990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd3990412 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000056 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/82/bebalanced-k%C3%B6rper
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12072113890.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0327686a -pinnedTimeHigh 0x01d0f4b0 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000017 hxxp://www.clipfish.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12425247930.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xf60c1a3b -pinnedTimeHigh 0x01cfbe56 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/frde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13304856320.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0de30816 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://www.unwetterzentrale.de/uwz/temperatur.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13506273490.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x245d8140 -pinnedTimeHigh 0x01d0fb60 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001e hxxp://woerterbuchnetz.de/DWB/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-14704389310.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x709605fc -pinnedTimeHigh 0x01d07bb4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000029 hxxp://localhost/joomla341/administrator/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-15829586810.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x8dac8991 -pinnedTimeHigh 0x01d0f876 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000015 hxxp://www.amazon.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-16228374220.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xdd5a7938 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000050 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/83/bebalanced-geist
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-17714738290.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa06bf05f -pinnedTimeHigh 0x01cfbdf1 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000001e hxxp://www.gpsies.com/login.do
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-18349738120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x012fa14d -pinnedTimeHigh 0x01d06bbc -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000042 hxxp://www.niederschlagsradar.de/niederschlagsprognose.aspx?type=1
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1856752590.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x9e55eab1 -pinnedTimeHigh 0x01d06bcf -securityFlags 0x00000000 -tileType 0x00000002 -url 0x0000001a hxxp://www.codecheck.info/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1930419650.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x16618286 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000011 hxxp://fritz.box/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20172485120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x1a75fa60 -pinnedTimeHigh 0x01cfbc92 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://www.bahn.de/p/view/index.shtml
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20504568990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xebcbbc70 -pinnedTimeHigh 0x01cfbc91 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000003b hxxp://www.boeser-wolf.schule.de/concours/2014/accueil.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-5511536870.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa5d41f09 -pinnedTimeHigh 0x01d138b2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/esde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-6764561640.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xc0dd7b7c -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000051 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/80/bebalanced-basics
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\13362524720.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfdbd1b9c -pinnedTimeHigh 0x01cfc2d2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://wetterstationen.meteomedia.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\14722268070.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0374d018 -pinnedTimeHigh 0x01d138f7 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000026 hxxp://www.duden.de/schwierige-woerter
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16003941200.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x029e0744 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000017 hxxp://www.sat24.com/eu
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16371692260.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x6ede0d80 -pinnedTimeHigh 0x01d12204 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000013 hxxp://www.faz.net/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19320121740.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x4f006974 -pinnedTimeHigh 0x01d0d42f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000028 hxxps://www.aerzte-finanz.de/praxispilot
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19571323130.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x08753f27 -pinnedTimeHigh 0x01d0b0b6 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000002d hxxp://online.rote-liste.de/suche/ferro-sanol
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19858872700.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe480d8c3 -pinnedTimeHigh 0x01d06bc9 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003c hxxp://www.hautschutzengel.de/bedenkliche-inhaltsstoffe.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\21415739090.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe924f5b3 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000059 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/84/bebalanced-sch%C3%B6nheit
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\330252100.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x40fe2528 -pinnedTimeHigh 0x01d07ba4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://localhost/joomla341/administrator/index.php
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4300483340.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xcc6d0835 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000053 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/81/bebalanced-workouts
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4699799270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x2a286297 -pinnedTimeHigh 0x01cfe086 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000041 hxxp://fahrplanauskunft.vrn.de/vrn/XSLT_TRIP_REQUEST2?language=de
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4736959030.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x693ce4b5 -pinnedTimeHigh 0x01d06bc1 -securityFlags 0x00000000 -tileType 0x00000003 -url 0x000000a5 hxxp://scholar.google.com/scholar?hl=en&q=%22101-86-0%22+OR+%22hexyl+cinnamaldehyde%22+OR+%2
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\6473758050.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xff1fdcd2 -pinnedTimeHigh 0x01cfe091 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000044 hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8167997760.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfb848207 -pinnedTimeHigh 0x01d0fea8 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001c hxxp://www.dirksbiokiste.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8302254560.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfce9884c -pinnedTimeHigh 0x01d0fb5f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001b hxxp://dwb.uni-trier.de/de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8511463020.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe44b0b80 -pinnedTimeHigh 0x01d12ea3 -securityFlags 0x00000000 -tileType 0x00000002 -url 0x00000041 hxxps://www.efiliale.de/efiliale/internetmarke/productDetails.jsp
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2014-12-02 13:52 - 2014-12-02 13:52 - 00029184 _____ () C:\WINDOWS\System32\ssm4mlm.dll
2015-05-22 19:34 - 2014-04-16 10:22 - 00029184 _____ () C:\WINDOWS\System32\usp02l.dll
2014-03-07 00:05 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2015-05-22 19:34 - 2014-11-26 13:07 - 00118576 _____ () C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00062224 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-03-07 00:00 - 2013-11-18 17:40 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
2013-11-15 04:01 - 2013-11-15 04:01 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-11-15 03:58 - 2013-11-15 03:58 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-11-15 04:04 - 2013-11-15 04:04 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00294672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-09-08 13:39 - 2014-09-08 13:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2014-09-08 13:38 - 2014-09-08 13:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-03-07 00:00 - 2013-12-02 19:09 - 00044560 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Util.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00020480 _____ () C:\WINDOWS\system32\WinMetadata\Windows.System.winmd
2015-12-23 12:13 - 2015-12-23 12:13 - 00347136 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Gloaae92e31#\1b6c35238563de0cb93d3ed0826a69a3\Windows.Globalization.ni.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00112640 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Networking.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00030208 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Foundation.winmd
2014-03-07 00:06 - 2014-03-07 00:06 - 00815104 _____ () C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00108304 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2015-05-22 19:34 - 2013-10-04 06:53 - 00734720 _____ () C:\WINDOWS\system32\SnMinDrv.dll
2015-05-22 18:05 - 2014-09-19 00:08 - 00087552 ____N () C:\WINDOWS\system32\SSDEVM64.DLL
2015-10-28 10:32 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-28 10:32 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-28 10:32 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00102672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2014-03-07 00:06 - 2014-03-07 00:06 - 00101648 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2014-09-08 13:32 - 2014-09-08 13:32 - 00050688 _____ () C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-12-03 14:35 - 2014-06-04 11:21 - 00571904 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2014-12-03 14:35 - 2014-05-19 18:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00034768 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-05-22 16:37 - 2016-04-19 21:47 - 00093640 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00018376 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-05-22 16:37 - 2016-05-07 00:35 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00692688 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00121296 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021840 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00114640 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021832 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00117056 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134608 _____ () C:\Program Files (x86)\Dropbox\Client\_elementtree.pyd
2016-05-22 16:37 - 2016-04-19 21:47 - 00134088 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00240584 _____ () C:\Program Files (x86)\Dropbox\Client\jpegtran.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00021824 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32._winffi_kernel32.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-05-22 16:37 - 2016-04-19 21:50 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-05-22 16:37 - 2016-05-07 00:34 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-05-22 16:37 - 2016-05-07 00:34 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-05-22 16:37 - 2016-04-19 21:48 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 01971504 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00132912 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00223544 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-05-22 16:37 - 2016-05-07 00:34 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-05-22 16:37 - 2016-04-19 21:49 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2016-05-22 16:37 - 2016-05-07 00:35 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-03-22 19:06 - 00450771 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rhea\Documents\privat\baby\Hypnobirthing\rosa\Rose 11.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A1565219-9C4A-477E-B087-633B3F01E71E}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{27C039CA-A127-4E1D-B1D3-CFEB670B44C4}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{52CA7F06-4BB9-4795-8066-9B58632D957C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{A68DF61A-3CEB-457C-A455-E979D0DFD9D9}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{3BA7C7BB-201C-4578-8032-226B84A5187E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{D77998D3-8628-4C19-B4A4-AF6FD6322E17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{53831517-DB8D-477E-A9BA-0C3A6D4F67AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1061C061-F384-43B0-A0D9-6DDF4EE6503F}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{7D299E78-91AB-4FFE-A9D0-96D0355417B2}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{1AF7B847-EFE8-41FB-8695-62F373AFC563}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{68C4E61F-D08F-4ECF-BDF9-34E20341F5B6}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{B954C488-1AA4-4941-8C2B-67D5286A963E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{E1072E6A-6360-495F-926E-F632C4A9689B}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{2F8C4FC1-9C82-4726-8649-49E2C93B9D8E}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{AF6153E9-14EE-4199-BED9-3D14AB492CF1}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{D4FA5DEE-C506-4A04-935D-390F5C6079FB}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{F1A3B9EF-D5FB-4574-9BEB-96ECBB0D684B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{D921552C-CE68-403D-9DBE-CAC966A95EE2}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon64.exe
FirewallRules: [{4EA57459-AD30-41FA-9486-39ECF62DD501}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon.exe
FirewallRules: [{CA400C7C-FCAD-4924-A278-73C732755889}] => (Allow) C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxMon64.exe
FirewallRules: [{0DB4AB93-0BF1-452D-B832-A710ACAE9614}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{0A36E50D-B3B9-4F9E-89E2-F7D348BB11A2}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{92202204-EA1B-4534-9299-601CA49D30CE}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{0DC69213-20AD-406C-9DB4-D19FB35403CB}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{15E878E5-17D9-450B-8885-D2F99A877B4C}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{734C61A7-FE33-43F5-B970-B3128ED0BA66}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{A3E00CDA-21C0-4CB5-A0CB-EA9660A81F86}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{A7D4F664-91A4-45EF-8290-231FF96AF0AA}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{76B16069-4BCF-41A5-8FD8-C7D5BC69D901}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{80397F1C-99AE-4B60-889A-1A3D5E3B664F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{5A4CBF62-620D-4DE8-8BEC-D96A19665375}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{B01021EE-1A36-4775-B364-BBFD21F779CC}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [{6AE25776-262D-4156-A3AD-06CEFDE05C0E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{E1687298-987D-4B20-9A26-B60751527F08}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{ED9943F9-DE46-46E9-925F-100E5091517E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{8A2BA25A-496F-4DCC-A5C7-C19393A3D961}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{62296BC3-29A2-4E43-A5B9-FC5F4AFF9F77}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
25-03-2016 22:43:12 Windows Update
22-05-2016 23:47:21 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/23/2016 11:48:13 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:48:12 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:45:11 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:45:10 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 11:04:06 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:54 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:53 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:40:53 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfGetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/23/2016 10:38:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: aa4
Startzeit: 01d1b5322dd6c3a1
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\system32\wwahost.exe
Berichts-ID: 221e8e6f-2126-11e6-82f4-d681fdd3c146
Vollständiger Name des fehlerhaften Pakets: GJDigitalGmbH.BRIGITTE.deApp_1.1.0.29_neutral__kekzhddbb11ja
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (05/23/2016 10:37:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d98
Startzeit: 01d1b5322de511e4
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\syswow64\backgroundTaskHost.exe
Berichts-ID: 21d24245-2126-11e6-82f4-d681fdd3c146
Vollständiger Name des fehlerhaften Pakets: E046963F.LenovoSupport_1.2.5.0_x86__k1h2ywk1493x8
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Systemfehler:
=============
Error: (05/23/2016 11:46:55 PM) (Source: DCOM) (EventID: 10000) (User: NT-AUTORITÄT)
Description: C:\WINDOWS\system32\PrintIsolationHost.exe -Embedding19{A677570A-2BA2-4E9A-B2E2-8A02CD8B4FD3}
Error: (05/23/2016 11:46:52 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {A677570A-2BA2-4E9A-B2E2-8A02CD8B4FD3}
Error: (05/23/2016 11:46:29 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (05/23/2016 11:44:02 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:02 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:00 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:44:00 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/23/2016 11:18:53 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/23/2016 11:18:38 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/23/2016 10:39:11 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Modules Installer konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Prozentuale Nutzung des RAM: 45%
Installierter physikalischer RAM: 3979.22 MB
Verfügbarer physikalischer RAM: 2184.76 MB
Summe virtueller Speicher: 4683.22 MB
Verfügbarer virtueller Speicher: 2827.06 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.74 GB) (Free:344.75 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.99 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 9E01DD02)
Partition: GPT.
==================== Ende von Addition.txt ============================
FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-05-2016
durchgeführt von Rhea (Administrator) auf MNEMOSYNE (24-05-2016 00:09:06)
Gestartet von C:\Users\Rhea\Downloads
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
() C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(© 2015 Microsoft Corporation) C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
() C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780400 2013-10-28] (Synaptics Incorporated)
HKLM\...\Run: [Yoga PhoneCompanion] => C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe [844304 2014-03-07] (Lenovo)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-03-07] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM-x32\...\Run: [Yoga Picks] => C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe [119824 2013-12-02] (Lenovo)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2457560 2015-03-19] (FileZilla Project)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [2171456 2015-12-17] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23745808 2016-05-07] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-11-15] (Atheros Communications)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [BingSvc] => C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-01-02] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [589312 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 9.6 PE.lnk [2016-05-23]
ShortcutTarget: PHOTOfunSTUDIO 9.6 PE.lnk -> C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2016-05-23]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{47953B4F-4698-4BE4-8629-D04F23915DC9}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{927CA755-A3D5-411C-BDE0-BDE30D80941F}: [DhcpNameServer] 150.201.1.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.shopssl.de;www1.wdr.de
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.msn.com/de-de/?pc=SL5M&ocid=SL5MDHP&osmkt=de-de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> DefaultScope {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {4E2A6A0E-B18C-469F-BC62-EAFB366818A5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {79EE8967-C73E-45F3-9A1A-E79B6BA5E802} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {C6966AB3-7BDE-4182-86B6-DD1910E1B58A} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-25] (Oracle Corporation)
BHO-x32: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-25] (Oracle Corporation)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser//?type=hp&ts=1429294429&from=corna&uid=WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774
about:preferences
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\bing-.xml [2016-01-01]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-images.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-maps.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\heise-netze-spam-listen-abfrage.xml [2016-02-19]
FF Extension: Bing Search - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-01-01]
FF Extension: Adblock Plus - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-03] [ist nicht signiert]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [318592 2013-11-15] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [779736 2015-03-19] (FileZilla Project)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-03-07] (Lenovo)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2013-11-04] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe [285712 2014-03-07] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionVap.exe [304144 2014-03-07] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Samsung Network Fax Server; C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxServer64.exe [801472 2015-03-10] (Samsung Electronics Co., Ltd.)
R2 SamsungUPDUtilSvc; C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe [118576 2014-11-26] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-03-07] (Lenovo)
R2 YogaPicks.AppService; C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe [19440 2013-11-18] ()
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-11-15] (Atheros) [Datei ist nicht signiert]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-11-15] (Qualcomm Atheros)
R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-28] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 rtsuvc; \SystemRoot\system32\DRIVERS\rtsuvc.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-24 00:09 - 2016-05-24 00:10 - 00024409 _____ C:\Users\Rhea\Downloads\FRST.txt
2016-05-23 23:42 - 2016-05-23 23:42 - 00001210 _____ C:\Users\Rhea\Desktop\malwarebytes230516.txt
2016-05-23 23:17 - 2016-05-23 23:17 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-23 23:16 - 2016-05-23 23:45 - 00001123 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-23 23:15 - 2016-05-23 23:15 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64 (1).exe
2016-05-23 23:14 - 2016-05-23 23:14 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64.exe
2016-05-23 23:11 - 2016-05-23 23:15 - 22851472 _____ (Malwarebytes ) C:\Users\Rhea\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-23 00:47 - 2016-03-16 03:58 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-05-23 00:47 - 2016-03-14 18:50 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-05-23 00:47 - 2016-03-12 02:49 - 02466136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-05-23 00:47 - 2016-03-12 02:47 - 00160160 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-12 02:47 - 00121912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-10 18:55 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-05-23 00:47 - 2016-03-10 18:52 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00413696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-05-23 00:47 - 2016-03-05 19:44 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-23 00:47 - 2016-03-05 19:04 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-23 00:47 - 2016-02-27 20:28 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-05-23 00:47 - 2016-02-27 19:57 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 19:19 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 18:32 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-05-23 00:47 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-05-23 00:47 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-05-23 00:47 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-05-23 00:47 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-05-23 00:47 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-05-23 00:47 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-05-23 00:47 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-05-22 23:17 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-22 23:17 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-22 23:17 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-22 23:17 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-22 23:17 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-22 23:17 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-22 23:17 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-05-22 23:17 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-22 23:17 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-05-22 23:16 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-22 23:16 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-22 23:16 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-05-22 23:16 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-22 23:16 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-05-22 23:16 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-05-22 23:16 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-22 23:16 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-05-22 23:16 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-05-22 23:15 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-05-22 23:15 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-05-22 23:15 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-05-22 23:15 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-05-22 23:15 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-22 23:15 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-05-22 23:15 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-22 23:15 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-22 23:15 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-22 23:15 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-05-22 23:15 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-05-22 23:14 - 2016-04-11 08:21 - 00074584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2016-05-22 23:14 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-22 23:14 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-22 23:14 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-05-22 23:14 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-22 23:14 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-22 23:14 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-22 23:14 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-22 23:14 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-22 23:14 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-05-22 23:14 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-05-22 23:14 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-05-22 23:14 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-05-22 23:14 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-22 23:14 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-05-22 16:37 - 2016-05-22 16:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-24 00:09 - 2014-12-17 19:53 - 00000000 ____D C:\FRST
2016-05-23 23:53 - 2014-05-23 02:08 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3879709871-1962586687-2025067079-1001
2016-05-23 23:49 - 2016-03-22 17:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-23 23:49 - 2016-02-17 12:12 - 00000000 ___RD C:\Users\Rhea\Dropbox
2016-05-23 23:47 - 2016-02-17 12:08 - 00001226 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-05-23 23:47 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-23 23:46 - 2013-08-22 15:25 - 01835008 ___SH C:\WINDOWS\system32\config\BBI
2016-05-23 23:45 - 2016-03-08 21:27 - 00001159 _____ C:\Users\Rhea\Desktop\GM5 Bedienungsanleitung.lnk
2016-05-23 23:45 - 2016-02-24 15:44 - 00001376 _____ C:\Users\Rhea\Desktop\todo - Verknüpfung.lnk
2016-05-23 23:45 - 2016-02-16 12:03 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-23 23:45 - 2016-02-14 20:21 - 00001695 _____ C:\Users\Rhea\Desktop\Lärmprotokoll 2 2016 - Verknüpfung.lnk
2016-05-23 23:45 - 2015-10-28 10:32 - 00001418 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-23 23:45 - 2015-09-05 13:14 - 00000982 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-05-23 23:45 - 2014-11-04 22:37 - 00001186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-23 23:45 - 2014-10-07 14:25 - 00001744 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eigene Musik.lnk
2016-05-23 23:45 - 2014-10-05 15:46 - 00000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-05-23 23:45 - 2014-10-05 11:53 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2016-05-23 23:45 - 2014-10-03 14:46 - 00000752 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bilder.lnk
2016-05-23 23:45 - 2014-08-22 22:43 - 00000763 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2016-05-23 23:45 - 2014-07-30 23:35 - 00001364 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RouteConverterWindows.lnk
2016-05-23 23:45 - 2014-06-26 11:49 - 00002125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-23 23:45 - 2014-05-23 02:03 - 00001465 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-23 23:45 - 2014-03-07 00:06 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartVoiceToast.lnk
2016-05-23 23:45 - 2014-03-06 23:55 - 00002007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-05-23 23:44 - 2013-08-22 17:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2016-05-23 23:13 - 2016-02-17 12:08 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-05-23 23:10 - 2014-03-07 07:41 - 00767130 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-23 23:10 - 2014-03-07 07:41 - 00160216 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-23 23:10 - 2013-10-07 20:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-23 23:10 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-05-23 15:20 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-23 14:01 - 2013-08-22 16:44 - 00371640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-23 13:53 - 2013-08-22 21:12 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-23 09:42 - 2014-06-13 00:55 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-23 09:42 - 2014-06-13 00:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-23 09:28 - 2014-05-23 02:03 - 00000000 ____D C:\Users\Rhea
2016-05-23 00:18 - 2016-02-16 12:04 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-23 00:03 - 2014-12-16 18:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-22 22:53 - 2016-01-13 00:57 - 00177488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-05-22 16:48 - 2016-03-23 19:48 - 19942080 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-05-22 16:48 - 2016-03-22 17:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-22 16:37 - 2016-02-17 12:08 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-05-22 16:32 - 2016-02-17 12:08 - 00000000 ____D C:\Users\Rhea\AppData\Local\Dropbox
2016-05-11 22:08 - 2015-03-11 23:30 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 22:08 - 2015-03-11 23:30 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-11-27 00:53 - 2005-11-27 00:53 - 0049152 _____ ( ) C:\Program Files\Interop.WIA.dll
2013-08-25 18:57 - 2013-08-25 18:57 - 0001968 _____ () C:\Program Files\License.txt
2014-07-22 15:14 - 2014-07-22 15:14 - 0828992 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Base.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 3087872 _____ () C:\Program Files\PaintDotNet.Base.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0562752 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Core.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1826304 _____ () C:\Program Files\PaintDotNet.Core.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0090688 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Data.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0265728 _____ () C:\Program Files\PaintDotNet.Data.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0195648 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Effects.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0495104 _____ () C:\Program Files\PaintDotNet.Effects.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 1766976 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.exe
2014-06-27 14:41 - 2014-06-27 14:41 - 0000429 _____ () C:\Program Files\PaintDotNet.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0337472 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Framework.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1019392 _____ () C:\Program Files\PaintDotNet.Framework.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 4711936 _____ () C:\Program Files\PaintDotNet.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0416832 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Resources.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0050688 _____ () C:\Program Files\PaintDotNet.Resources.pdb
2014-06-23 11:10 - 2014-06-23 11:10 - 0145066 ____R () C:\Program Files\PaintDotNet.Strings.3.cs.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0141037 ____R () C:\Program Files\PaintDotNet.Strings.3.da.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0147174 ____R () C:\Program Files\PaintDotNet.Strings.3.DE.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0146230 ____R () C:\Program Files\PaintDotNet.Strings.3.ES.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0158177 ____R () C:\Program Files\PaintDotNet.Strings.3.fa.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0140166 ____R () C:\Program Files\PaintDotNet.Strings.3.fi.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148878 ____R () C:\Program Files\PaintDotNet.Strings.3.FR.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0188674 ____R () C:\Program Files\PaintDotNet.Strings.3.hi.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0145645 ____R () C:\Program Files\PaintDotNet.Strings.3.hu.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0144519 ____R () C:\Program Files\PaintDotNet.Strings.3.it.resources
2014-06-20 16:13 - 2014-06-20 16:13 - 0155356 ____R () C:\Program Files\PaintDotNet.Strings.3.JA.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148596 ____R () C:\Program Files\PaintDotNet.Strings.3.KO.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0147437 ____R () C:\Program Files\PaintDotNet.Strings.3.lt.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0142834 ____R () C:\Program Files\PaintDotNet.Strings.3.nl.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0143720 ____R () C:\Program Files\PaintDotNet.Strings.3.pl.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0145666 ____R () C:\Program Files\PaintDotNet.Strings.3.PT-BR.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0145325 ____R () C:\Program Files\PaintDotNet.Strings.3.pt-PT.resources
2014-06-03 13:56 - 2014-06-03 13:56 - 0138840 ____R () C:\Program Files\PaintDotNet.Strings.3.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0171796 ____R () C:\Program Files\PaintDotNet.Strings.3.RU.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0135198 ____R () C:\Program Files\PaintDotNet.Strings.3.ZH-CN.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0137582 ____R () C:\Program Files\PaintDotNet.Strings.3.zh-TW.resources
2014-07-22 15:14 - 2014-07-22 15:14 - 0563264 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.SystemLayer.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1058368 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0968256 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0767488 _____ () C:\Program Files\PaintDotNet.SystemLayer.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0014400 _____ (dotPDN LLC) C:\Program Files\PdnRepair.exe
2014-06-27 15:37 - 2014-06-27 15:37 - 0000235 _____ () C:\Program Files\PdnRepair.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\PdnRepair.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0030784 _____ (dotPDN LLC) C:\Program Files\SetupNgen.exe
2010-04-21 00:57 - 2010-04-21 00:57 - 0000254 _____ () C:\Program Files\SetupNgen.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0030208 _____ () C:\Program Files\SetupNgen.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0026688 _____ () C:\Program Files\ShellExtension_x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0023616 _____ () C:\Program Files\ShellExtension_x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0015936 _____ (dotPDN LLC) C:\Program Files\UpdateMonitor.exe
2014-06-28 10:29 - 2014-06-28 10:29 - 0000235 _____ () C:\Program Files\UpdateMonitor.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\UpdateMonitor.pdb
2015-01-28 15:00 - 2015-01-28 15:00 - 0003893 _____ () C:\Users\Rhea\AppData\Local\recently-used.xbel
2014-03-06 23:26 - 2014-03-06 23:26 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-23 01:31
==================== Ende von FRST.txt ============================
Code:
ATTFilter [i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Management Console
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Media Player
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Paint
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product MS Wordpad
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows.OpenWith
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Windows Explorer
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:08 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:08 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[i] 16-05-23 09:15:08
[i] 16-05-23 09:15:08 Product Cookie
[+] 16-05-23 09:15:08 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:08 Moving into quarantine Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:08 Moving into quarantine Thunderbird (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:09 Successfully cleaned Thunderbird (PE_C_PUBLIC (default))Cookies
[i] 16-05-23 09:15:09
[i] 16-05-23 09:15:09 Product Cache
[+] 16-05-23 09:15:09 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cache
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cache
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Management Console
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Microsoft Management Console\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Media Player
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Paint
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product MS Wordpad
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows.OpenWith
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Windows Explorer
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:13 Moving into quarantine HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
[+] 16-05-23 09:15:13 Successfully cleaned HKEY_USERS\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Cookie
[+] 16-05-23 09:15:13 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:13 Moving into quarantine Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Moving into quarantine Thunderbird (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Firefox (PE_C_PUBLIC (default))Cookies
[+] 16-05-23 09:15:13 Successfully cleaned Thunderbird (PE_C_PUBLIC (default))Cookies
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Product Cache
[+] 16-05-23 09:15:13 Moving into quarantine Internet Explorer (Benutzer) (Rhea)Cache
[+] 16-05-23 09:15:13 Successfully cleaned Internet Explorer (Benutzer) (Rhea)Cache
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Summary
[i] 16-05-23 09:15:13 Errors while cleaning 0
[i] 16-05-23 09:15:13 Files moved into quarantine 13
[i] 16-05-23 09:15:13 Files successfully cleaned 13
[i] 16-05-23 09:15:13
[i] 16-05-23 09:15:13 Summary
[i] 16-05-23 09:15:13 Errors while cleaning 0
[i] 16-05-23 09:15:13 Files moved into quarantine 13
[i] 16-05-23 09:15:13 Files successfully cleaned 13
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 23.05.2016 Suchlaufzeit: 23:18 Protokolldatei: malwarebytes230516.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2016.05.23.06 Rootkit-Datenbank: v2016.05.20.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Rhea Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 294149 Abgelaufene Zeit: 21 Min., 41 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Geändert von mamaimapril (27.05.2016 um 18:15 Uhr) |
| Themen zu Windows 8 Webbroser (Firef/IE) hängen (Website reagiert nicht), Malwareicons im FireFox |
| abstürzen, cpu, desktop, device driver, dnsapi.dll, error, firefox, flash player, helper, home, homepage, hängen, iexplore.exe, installation, internet, internet explorer, problem, proxy, prozesse, registry, server, svchost.exe, taskmanager, usb, werbung, windows, wlan |
Baum-Darstellung