| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virenfund vom 10.02.2017Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.02.2017, 05:43
| #1 |
 |  Virenfund vom 10.02.2017 Guten Morgen an alle die das lesen. Wie oben schon erwähnt habe ich gestern Viren auf dem Laptop gefunden. Ich habe die Viren schon länger drauf. Ich hatte bisher keine Zeit sie zu entfernen. Habe auch ältere Logs...haben jedesmal was gefunden. Am anfang waren es über Hundert. Ich denke mal ihr/du braucht/brauchst frische Logs. Unten sind drei Logfiles: 1. MBAM Scan vom 10.02.2017 2. FRST x64 Scan vom 10.02.2017 3. FRST x64 Addition vom 10.02.2017 Könnt ihr mal bei der Virenentfernung helfen, Trojaner-Board-Team? Wäre nett von euch, lasse demjenigen auch mindestens ein Lob da  ))Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 10.02.2017 Suchlaufzeit: 22:27 Protokolldatei: MBAM Scan Results 10.02.2017.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2017.02.10.06 Rootkit-Datenbank: v2016.11.20.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: thomas hochhalter Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 432202 Abgelaufene Zeit: 1 Std., 0 Min., 13 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 6 PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211D4A5-48D0-47F5-A7CD-81E861470F7F}, In Quarantäne, [d579b3ee9c0cbd79e0b4ebde05fd8a76], PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211D4A5-48D0-47F5-A7CD-81E861470F7F}, In Quarantäne, [e7676d341b8d9e989df7daefe0220cf4], PUP.Optional.InstallCore, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\csastats, In Quarantäne, [fc52346db8f0ec4a8c47912c9e656c94], PUP.Optional.WinYahoo, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211D4A5-48D0-47F5-A7CD-81E861470F7F}, In Quarantäne, [63eb307100a837ffa7ecb21703ff0df3], PUP.Optional.ProductSetup, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\PRODUCTSETUP, In Quarantäne, [d17d762b21870a2c4aa35528e61dc23e], PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{21DFC91F-715F-189F-C0DF-681F105FBB9F}, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], Registrierungswerte: 6 PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}|URL, https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f[d579b3ee9c0cbd79e0b4ebde05fd8a76]D4%26b[d579b3ee9c0cbd79e0b4ebde05fd8a76]DIE%26cc[d579b3ee9c0cbd79e0b4ebde05fd8a76]Dde%26pa[d579b3ee9c0cbd79e0b4ebde05fd8a76]Dwincy%26cd[d579b3ee9c0cbd79e0b4ebde05fd8a76]D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr[d579b3ee9c0cbd79e0b4ebde05fd8a76]D731922868%26a[d579b3ee9c0cbd79e0b4ebde05fd8a76]Dwbf_fsvideosft_17_06%26os_ver[d579b3ee9c0cbd79e0b4ebde05fd8a76]D10.0%26os[d579b3ee9c0cbd79e0b4ebde05fd8a76]DWindowsIn QuarantäneB10In QuarantäneBHome&p={searchTerms}, %4, %5 PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}|URL, https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f[e7676d341b8d9e989df7daefe0220cf4]D4%26b[e7676d341b8d9e989df7daefe0220cf4]DIE%26cc[e7676d341b8d9e989df7daefe0220cf4]Dde%26pa[e7676d341b8d9e989df7daefe0220cf4]Dwincy%26cd[e7676d341b8d9e989df7daefe0220cf4]D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr[e7676d341b8d9e989df7daefe0220cf4]D731922868%26a[e7676d341b8d9e989df7daefe0220cf4]Dwbf_fsvideosft_17_06%26os_ver[e7676d341b8d9e989df7daefe0220cf4]D10.0%26os[e7676d341b8d9e989df7daefe0220cf4]DWindowsIn QuarantäneB10In QuarantäneBHome&p={searchTerms}, %4, %5 PUP.Optional.WinYahoo, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f[ada1524fbdebf93d35e7cf4d58a843bd]D1%26b[ada1524fbdebf93d35e7cf4d58a843bd]DIE%26cc[ada1524fbdebf93d35e7cf4d58a843bd]Dde%26pa[ada1524fbdebf93d35e7cf4d58a843bd]Dwincy%26cd[ada1524fbdebf93d35e7cf4d58a843bd]D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr[ada1524fbdebf93d35e7cf4d58a843bd]D731922868%26a[ada1524fbdebf93d35e7cf4d58a843bd]Dwbf_fsvideosft_17_06%26os_ver[ada1524fbdebf93d35e7cf4d58a843bd]D10.0%26os[ada1524fbdebf93d35e7cf4d58a843bd]DWindowsIn QuarantäneB10In QuarantäneBHome, %4, %5 PUP.Optional.WinYahoo, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}|URL, https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f[63eb307100a837ffa7ecb21703ff0df3]D4%26b[63eb307100a837ffa7ecb21703ff0df3]DIE%26cc[63eb307100a837ffa7ecb21703ff0df3]Dde%26pa[63eb307100a837ffa7ecb21703ff0df3]Dwincy%26cd[63eb307100a837ffa7ecb21703ff0df3]D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr[63eb307100a837ffa7ecb21703ff0df3]D731922868%26a[63eb307100a837ffa7ecb21703ff0df3]Dwbf_fsvideosft_17_06%26os_ver[63eb307100a837ffa7ecb21703ff0df3]D10.0%26os[63eb307100a837ffa7ecb21703ff0df3]DWindowsIn QuarantäneB10In QuarantäneBHome&p={searchTerms}, %4, %5 PUP.Optional.NotChromeRun, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|GoogleChromeAutoLaunch_50371FB51B8F89FFAE4DCD6D1745FDD8, "C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe" --no-startup-window, In Quarantäne, [430b960b8028d264f1203f3cab588878] PUP.Optional.ProductSetup, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\PRODUCTSETUP|tb, 0G2O2W1R0C1R1H, In Quarantäne, [d17d762b21870a2c4aa35528e61dc23e] Registrierungsdaten: 1 PUP.Optional.WinYahoo, HKU\S-1-5-21-934394075-4118312357-3984632377-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=fSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]D1%26bSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]DIE%26ccSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]Dde%26paSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]Dwincy%26cdSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26crSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]D731922868%26aSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]Dwbf_fsvideosft_17_06%26os_verSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]D10.0%26osSchlecht: (https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome),Ersetzt,[430babf6ecbcd363d4c2d9348e764cb4]DWindowsGut: (www.google.com)B10Gut: (www.google.com)BHome, %4, %5 Ordner: 2 PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], Dateien: 29 PUP.Optional.FusionCore, C:\Users\thomas hochhalter\AppData\Local\Temp\is-0EINM.tmp\Fusion.dll, In Quarantäne, [0e400b96dbcde650986cedb98d73d927], PUP.Optional.WinYahoo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk, In Quarantäne, [4a046c35fcacaf871594e5c36c9744bc], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\HowToRemove.html, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\chromium-min.jpg, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\control panel-min-min.JPG, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\down.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\ff menu.JPG, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\ff search engine-min.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\hp-min ff.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\hp-min ie.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\search engine.gif, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\setup pages.gif, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\sp-min.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\start-min.jpg, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\HowToRemove\up.png, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\bapi_chmm.dat, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\bapi_ff.dat, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\bapi_ie.dat, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\coni, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\install.log, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\meto, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\neco, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\sili, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\Sqlite3.dll, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\uninst.dat, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\uninst.exe, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE}\uninstp.dat, In Quarantäne, [60eedac75c4c6cca98c2ae74b450f40c], PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\prefs.js, Gut: (user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Schlecht: (user_pref("browser.startup.homepage", "https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindowsErsetzt,[a2ace6bbeebadd5921cd3e8bed16d32d]B10Ersetzt,[a2ace6bbeebadd5921cd3e8bed16d32d]BHome");), %5 PUP.Optional.WinYahoo, C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\searchplugins\yahoo! powered.xml, In Quarantäne, [212df8a93d6b7cbaaabb6fb328dc1ae6], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 10-02-2017 durchgeführt von thomas hochhalter (Administrator) auf THOMAS (10-02-2017 22:37:32) Gestartet von C:\Users\thomas hochhalter\Downloads Geladene Profile: thomas hochhalter & (Verfügbare Profile: thomas hochhalter) Platform: Windows 10 Home Version 1607 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFenceService.exe (Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe (McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe (Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe () C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe () C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (© 2015 Microsoft Corporation) C:\Users\thomas hochhalter\AppData\Local\Microsoft\BingSvc\BingSvc.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe (ALPS) C:\Program Files\Apoint\Apvfb.exe (Spotify Ltd) C:\Users\thomas hochhalter\AppData\Roaming\Spotify\SpotifyWebHelper.exe (The Chromium Authors) C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe (The Chromium Authors) C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe (The Chromium Authors) C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe (The Chromium Authors) C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFence.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Digital Wave Ltd) C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe (Intel Security) C:\Program Files\Intel Security\True Key\application\truekey.exe (Intel Security) C:\Program Files\Intel Security\True Key\application\truekey.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\BatteryModule.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\BatteryModule.exe ==================== Registry (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10775584 2010-05-31] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2040352 2010-05-31] (Realtek Semiconductor) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [212480 2010-05-31] (Alps Electric Co., Ltd.) HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-16] (Microsoft Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [600928 2010-06-01] (Sony Corporation) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2650576 2016-12-14] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-934394075-4118312357-3984632377-1000\...\Run: [BingSvc] => C:\Users\thomas hochhalter\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-11] (© 2015 Microsoft Corporation) HKU\S-1-5-21-934394075-4118312357-3984632377-1000\...\Run: [Spotify Web Helper] => C:\Users\thomas hochhalter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-23] (Spotify Ltd) HKU\S-1-5-21-934394075-4118312357-3984632377-1000\...\Run: [Chromium] => c:\users\thomas hochhalter\appdata\local\chromium\application\chrome.exe [1068544 2016-03-18] (The Chromium Authors) HKU\S-1-5-21-934394075-4118312357-3984632377-1000\...\Run: [GoogleChromeAutoLaunch_50371FB51B8F89FFAE4DCD6D1745FDD8] => C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe [1068544 2016-03-18] (The Chromium Authors) HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [BingSvc] => C:\Users\thomas hochhalter\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-11] (© 2015 Microsoft Corporation) HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify Web Helper] => C:\Users\thomas hochhalter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-23] (Spotify Ltd) HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Chromium] => c:\users\thomas hochhalter\appdata\local\chromium\application\chrome.exe [1068544 2016-03-18] (The Chromium Authors) HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleChromeAutoLaunch_50371FB51B8F89FFAE4DCD6D1745FDD8] => C:\Users\thomas hochhalter\AppData\Local\chromium\Application\chrome.exe [1068544 2016-03-18] (The Chromium Authors) HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation) Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{bc863aaa-54e2-4f05-a57b-5b003d0368db}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{c3fa99c0-6d20-46d3-a571-87208c430cb4}: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{c765f76d-d772-48cd-a31c-377a2b7b8b64}: [DhcpNameServer] 192.168.42.129 ManualProxies: Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-934394075-4118312357-3984632377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> DefaultScope {33912D4F-60FD-493D-B39F-51282B3AFDE4} URL = SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms} SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> {75E9A305-CA85-46BD-AD1A-B3FC79057BBB} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> {CC7B8E83-9661-4617-9C47-06631049DD92} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms} SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000 -> {EA35FAC9-0E9F-4C52-A305-F85D8B14DD5E} URL = hxxp://de.shopping.com/?linkin_id=8056363 SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {33912D4F-60FD-493D-B39F-51282B3AFDE4} URL = SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms} SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {75E9A305-CA85-46BD-AD1A-B3FC79057BBB} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {CC7B8E83-9661-4617-9C47-06631049DD92} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms} SearchScopes: HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {EA35FAC9-0E9F-4C52-A305-F85D8B14DD5E} URL = hxxp://de.shopping.com/?linkin_id=8056363 BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => Keine Datei BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2015-07-13] (DVDVideoSoft Ltd.) BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-01-10] (Intel Security) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll => Keine Datei Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-01-10] (Intel Security) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-16] (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-16] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583 [2017-02-10] FF DefaultSearchEngine: Mozilla\Firefox\Profiles\1gskicur.default-1476352503583 -> Yahoo! Powered FF SelectedSearchEngine: Mozilla\Firefox\Profiles\1gskicur.default-1476352503583 -> Yahoo! Powered FF Homepage: Mozilla\Firefox\Profiles\1gskicur.default-1476352503583 -> hxxps://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fsvideosft_17_06¶m1=1¶m2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzz0D0DtDzz0B0C0C0C0B0F0C0B0EtDtN0D0Tzu0StCzzyCtAtN1L2XzutAtFtByBtFtCtFyDtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StB0D0A0BzyyEtA0CtGyDzyyEyBtGzyyB0B0CtGtBtB0AyEtGzz0Dzz0CyD0Azy0ByByB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtDtAtBtDtDtCyCtG0D0FtBzztGyEyDyCtAtG0A0E0F0CtGyByByDyC0C0FyB0D0CyE0E0E2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCzyyDtA%26cr%3D731922868%26a%3Dwbf_fsvideosft_17_06%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome FF Keyword.URL: Mozilla\Firefox\Profiles\1gskicur.default-1476352503583 -> user_pref("keyword.URL", true); FF Extension: (True Key Add-On) - C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\Extensions\@true-key [2017-02-10] FF Extension: (Deutsch (DE) Language Pack) - C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\Extensions\langpack-de@firefox.mozilla.org.xpi [2017-01-31] FF Extension: (1-Click YouTube Video Downloader) - C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2017-01-15] FF SearchPlugin: C:\Users\thomas hochhalter\AppData\Roaming\Mozilla\Firefox\Profiles\1gskicur.default-1476352503583\searchplugins\yahoo! powered.xml [2017-02-06] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2016-10-05] FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-10] () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-10] () FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-08-26] (Google, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation) FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin HKU\S-1-5-21-934394075-4118312357-3984632377-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin HKU\S-1-5-21-934394075-4118312357-3984632377-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-11-09] () FF Plugin HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.) FF Plugin HKU\S-1-5-21-934394075-4118312357-3984632377-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-11-09] () Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-05-25] Opera: ======= OPR Extension: (NoScript Suite Lite) - C:\Users\thomas hochhalter\AppData\Roaming\Opera Software\Opera Stable\Extensions\ipiopppcaojnchgoepoemlbdccogeije [2016-10-13] ==================== Dienste (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.) R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [146912 2017-01-18] (Byte Technologies LLC) R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-01-26] (Digital Wave Ltd.) R2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [413336 2015-08-26] () S2 FLAME II HSPA USB MODEM Service; C:\Program Files (x86)\My Connection\ApplicationController.exe [577704 2014-07-24] () [Datei ist nicht signiert] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [Datei ist nicht signiert] R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [155088 2016-12-14] (Malwarebytes Corporation) S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.) R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [51112 2016-09-26] (Microsoft) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2016-02-02] (Electronic Arts) R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [Datei ist nicht signiert] R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-12-04] () R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [304456 2017-02-06] () R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [995800 2017-01-05] (McAfee, Inc.) R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16248 2017-01-05] (McAfee, Inc.) S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2017-01-05] (McAfee, Inc.) R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.) S3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [413336 2015-08-26] () S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [851824 2010-06-17] (Sony Corporation) R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [836608 2010-06-08] (Sony Corporation) [Datei ist nicht signiert] R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1656600 2016-03-31] (Sony Corporation) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation) S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ====================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R3 ArcSoftKsUFilter; C:\WINDOWS\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) S2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [211456 2016-10-17] () [Datei ist nicht signiert] S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [77408 2016-12-14] () S3 IntcDAud; C:\WINDOWS\System32\DRIVERS\IntcDAud.sys [271872 2010-06-24] (Intel(R) Corporation) [Datei ist nicht signiert] S2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [35328 2016-10-17] () [Datei ist nicht signiert] S2 lirsgt; C:\Windows\SysWOW64\DRIVERS\lirsgt.sys [18048 2016-10-17] () [Datei ist nicht signiert] R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2017-02-10] (Malwarebytes) S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] () R3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [29352 2015-10-14] () S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2015-08-04] () S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation) R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation) R3 ykinw8; C:\WINDOWS\System32\drivers\ykinx64.sys [288768 2016-07-16] (Marvell) U3 aspnet_state; kein ImagePath ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-02-10 22:37 - 2017-02-10 22:37 - 00029577 _____ C:\Users\thomas hochhalter\Downloads\FRST.txt 2017-02-10 22:32 - 2017-02-10 22:35 - 02421248 _____ (Farbar) C:\Users\thomas hochhalter\Downloads\FRST64.exe 2017-02-06 16:17 - 2017-02-06 16:18 - 00105696 _____ C:\Users\thomas hochhalter\Desktop\Lebenslauf.pdf 2017-02-06 16:15 - 2017-02-06 16:15 - 00009616 _____ C:\Users\thomas hochhalter\Desktop\Lebenslauf.odt 2017-02-06 16:13 - 2017-02-06 16:13 - 00003560 _____ C:\WINDOWS\System32\Tasks\ByteFence Scan 2017-02-06 16:13 - 2017-02-06 16:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware 2017-02-06 15:58 - 2017-02-06 15:58 - 00000000 ____D C:\ProgramData\ByteFence 2017-02-06 15:10 - 2017-02-10 21:47 - 00000000 ____D C:\Program Files\ByteFence 2017-02-06 15:10 - 2017-02-06 15:14 - 00000000 ____D C:\Users\thomas hochhalter\AppData\Local\{954AA316-B1E2-CFAE-DC7A-EA46F81216DE} 2017-02-06 15:10 - 2017-02-06 15:10 - 00003466 _____ C:\WINDOWS\System32\Tasks\ByteFence 2017-02-06 15:10 - 2017-02-06 15:10 - 00001657 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk 2017-01-26 23:32 - 2016-12-21 08:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe 2017-01-26 23:32 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe 2017-01-26 22:49 - 2017-01-26 22:51 - 01496584 _____ C:\Users\thomas hochhalter\Downloads\WhatsApp2732Setup - CHIP-Installer.exe 2017-01-15 20:00 - 2017-02-06 14:11 - 00000000 ____D C:\ProgramData\DigitalWave.ApplicationUpdater_files 2017-01-15 19:59 - 2017-01-15 19:59 - 00001375 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk 2017-01-15 19:56 - 2017-01-15 19:58 - 33826608 _____ (Digital Wave Ltd ) C:\Users\thomas hochhalter\Downloads\FreeYouTubeDownload-4.1.32.1215.exe 2017-01-12 02:02 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll 2017-01-12 02:02 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll 2017-01-12 02:02 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2017-01-12 02:02 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2017-01-12 02:02 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll 2017-01-12 02:02 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll 2017-01-12 02:02 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2017-01-12 02:02 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll 2017-01-12 02:02 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll 2017-01-12 02:02 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2017-01-12 02:02 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2017-01-12 02:02 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll 2017-01-12 02:02 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2017-01-12 02:02 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll 2017-01-12 02:02 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll 2017-01-12 02:02 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2017-01-12 02:02 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2017-01-12 02:02 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll 2017-01-12 02:02 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2017-01-12 02:02 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll 2017-01-12 02:02 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll 2017-01-12 02:02 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2017-01-12 02:02 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll 2017-01-12 02:02 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll 2017-01-12 02:02 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll 2017-01-12 02:02 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe 2017-01-12 02:02 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe 2017-01-12 02:02 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll 2017-01-12 02:02 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll 2017-01-12 02:02 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2017-01-12 02:02 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll 2017-01-12 02:02 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll 2017-01-12 02:02 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2017-01-12 02:02 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2017-01-12 02:02 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2017-01-12 02:02 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll 2017-01-12 02:02 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll 2017-01-12 02:02 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2017-01-12 02:02 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll 2017-01-12 02:02 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll 2017-01-12 02:02 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll 2017-01-12 02:02 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll 2017-01-12 02:02 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll 2017-01-12 02:02 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll 2017-01-12 02:02 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2017-01-12 02:02 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll 2017-01-12 02:02 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll 2017-01-12 02:02 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll 2017-01-12 02:02 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2017-01-12 02:02 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll 2017-01-12 02:02 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll 2017-01-12 02:02 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2017-01-12 02:02 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2017-01-12 02:02 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll 2017-01-12 02:02 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2017-01-12 02:02 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll 2017-01-12 02:02 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2017-01-12 02:02 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2017-01-12 02:02 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2017-01-12 02:02 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2017-01-12 02:01 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll 2017-01-12 02:01 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2017-01-12 02:01 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2017-01-12 02:01 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe 2017-01-12 02:01 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2017-01-12 02:01 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2017-01-12 02:01 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll 2017-01-12 02:01 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe 2017-01-12 02:01 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2017-01-12 02:01 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2017-01-12 02:01 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2017-01-12 02:01 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll 2017-01-12 02:00 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2017-01-12 02:00 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll 2017-01-12 02:00 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2017-01-12 02:00 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll 2017-01-12 02:00 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe 2017-01-12 02:00 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2017-01-12 02:00 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe 2017-01-12 02:00 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll 2017-01-12 02:00 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll 2017-01-12 02:00 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll 2017-01-12 02:00 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll 2017-01-12 02:00 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll 2017-01-12 02:00 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll 2017-01-12 02:00 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll 2017-01-12 02:00 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe 2017-01-12 02:00 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll 2017-01-12 02:00 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll 2017-01-12 02:00 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe 2017-01-12 02:00 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2017-01-12 02:00 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll 2017-01-12 02:00 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll 2017-01-12 02:00 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll 2017-01-12 02:00 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2017-01-12 02:00 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll 2017-01-12 02:00 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2017-01-12 02:00 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll 2017-01-12 02:00 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll 2017-01-12 02:00 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll 2017-01-12 02:00 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2017-01-12 02:00 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2017-01-12 02:00 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2017-01-12 02:00 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2017-01-12 02:00 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2017-01-12 02:00 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2017-01-12 02:00 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll 2017-01-12 02:00 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe 2017-01-12 02:00 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll 2017-01-12 02:00 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll 2017-01-12 02:00 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll 2017-01-12 02:00 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll 2017-01-12 02:00 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2017-01-12 02:00 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll 2017-01-12 02:00 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2017-01-12 02:00 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2017-01-12 02:00 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2017-01-12 02:00 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll 2017-01-12 02:00 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2017-01-12 02:00 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2017-01-12 02:00 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll 2017-01-12 02:00 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe 2017-01-12 02:00 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2017-01-12 02:00 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2017-01-12 02:00 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys 2017-01-12 02:00 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll 2017-01-12 02:00 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2017-01-12 02:00 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll 2017-01-12 02:00 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2017-01-12 02:00 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2017-01-12 02:00 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll 2017-01-12 02:00 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll 2017-01-12 02:00 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2017-01-12 02:00 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys 2017-01-12 02:00 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll 2017-01-12 02:00 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll 2017-01-12 02:00 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2017-01-12 02:00 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2017-01-12 02:00 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll 2017-01-12 02:00 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll 2017-01-12 02:00 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll 2017-01-12 02:00 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll 2017-01-12 02:00 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll 2017-01-12 02:00 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll 2017-01-12 02:00 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll 2017-01-12 02:00 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll 2017-01-12 02:00 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2017-01-12 02:00 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2017-01-12 02:00 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll 2017-01-12 02:00 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll 2017-01-12 02:00 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2017-01-12 02:00 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2017-01-12 02:00 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll 2017-01-12 02:00 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll 2017-01-12 02:00 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2017-01-12 02:00 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2017-01-12 02:00 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2017-01-12 02:00 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2017-01-12 01:59 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll 2017-01-12 01:59 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll 2017-01-12 01:59 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-02-10 22:37 - 2016-10-28 20:12 - 00000000 ____D C:\FRST 2017-02-10 22:27 - 2015-05-26 14:17 - 00000000 ____D C:\Users\thomas hochhalter\AppData\Roaming\Skype 2017-02-10 22:26 - 2016-10-10 12:13 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2017-02-10 21:55 - 2016-11-18 20:04 - 00000000 ____D C:\Users\thomas hochhalter\AppData\LocalLow\Mozilla 2017-02-10 21:49 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness 2017-02-10 21:42 - 2016-10-13 11:16 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit 2017-02-10 21:41 - 2016-09-16 16:01 - 00000000 ____D C:\WINDOWS\system32\SleepStudy 2017-02-10 19:54 - 2015-07-14 21:17 - 00000000 ____D C:\Program Files (x86)\Opera 2017-02-10 16:14 - 2016-11-22 19:29 - 00000000 ____D C:\Program Files (x86)\McAfee 2017-02-10 16:12 - 2016-09-16 16:33 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2017-02-10 16:11 - 2016-11-22 19:14 - 00000000 ____D C:\Program Files\TrueKey 2017-02-10 14:46 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps 2017-02-10 14:26 - 2016-12-25 11:56 - 00000000 ____D C:\Users\thomas hochhalter\AppData\Local\tkdata 2017-02-09 18:03 - 2016-09-16 16:33 - 00003974 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1436905118 2017-02-09 18:03 - 2015-07-14 21:18 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-02-07 17:30 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF 2017-02-07 06:52 - 2016-11-22 19:31 - 00001239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True Key.lnk 2017-02-06 15:13 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF 2017-02-06 15:10 - 2016-09-04 15:42 - 00001471 _____ C:\Users\Public\Desktop\Free YouTube To MP3 Converter.lnk 2017-02-06 15:10 - 2016-09-04 15:42 - 00001408 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2017-02-06 15:10 - 2015-07-14 21:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2017-02-06 15:10 - 2015-07-14 21:14 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft 2017-02-06 14:10 - 2015-07-14 21:14 - 00000000 ____D C:\Users\thomas hochhalter\AppData\Roaming\DVDVideoSoft 2017-02-05 21:37 - 2014-06-20 21:47 - 00000000 ____D C:\ProgramData\Skype 2017-02-05 21:36 - 2016-09-16 16:09 - 00000000 ____D C:\Users\thomas hochhalter 2017-02-04 20:01 - 2014-07-09 22:02 - 00000000 ____D C:\Users\thomas hochhalter\AppData\Roaming\vlc 2017-02-02 23:21 - 2016-11-18 19:19 - 00000000 ____D C:\Program Files\Mozilla Firefox 2017-02-02 23:21 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI 2017-02-02 23:21 - 2014-06-22 22:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-02-01 18:49 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp 2017-01-16 00:33 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache 2017-01-15 17:00 - 2016-12-09 16:10 - 00003296 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2 2017-01-15 17:00 - 2016-03-12 02:57 - 00002455 _____ C:\Users\thomas hochhalter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-01-15 17:00 - 2016-03-12 02:57 - 00000000 ___RD C:\Users\thomas hochhalter\OneDrive 2017-01-15 16:55 - 2016-02-13 18:30 - 00000000 __RHD C:\Users\Public\AccountPictures 2017-01-15 16:32 - 2016-10-13 03:08 - 00000946 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job 2017-01-15 16:32 - 2016-10-12 19:12 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2017-01-15 16:32 - 2016-09-16 16:00 - 00374152 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2017-01-12 04:03 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2017-01-12 04:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2017-01-12 04:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe 2017-01-12 04:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences 2017-01-12 04:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning 2017-01-12 02:30 - 2015-12-22 11:32 - 00000000 ____D C:\WINDOWS\system32\MRT 2017-01-12 02:23 - 2015-12-22 11:32 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2017-01-11 01:20 - 2016-10-13 03:08 - 00004042 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-01-11 01:20 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed 2017-01-11 01:20 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-04-18 20:35 - 2015-04-18 20:35 - 0000000 _____ () C:\Users\thomas hochhalter\AppData\Local\{9331956F-E7D8-491B-A1BC-1C7A0AF5B332} 2016-11-13 21:41 - 2016-11-13 21:41 - 0000016 _____ () C:\ProgramData\mntemp 2016-11-13 21:41 - 2016-11-13 21:41 - 0004996 _____ () C:\ProgramData\mudtcpaz.vzs Einige Dateien in TEMP: ==================== 2016-10-20 18:26 - 2016-10-20 18:26 - 2458672 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\thomas hochhalter\AppData\Local\Temp\libeay32.dll 2016-10-20 18:26 - 2016-10-20 18:26 - 0970912 _____ (Microsoft Corporation) C:\Users\thomas hochhalter\AppData\Local\Temp\msvcr120.dll 2016-10-10 17:33 - 2016-10-10 17:33 - 0040448 ____N () C:\Users\thomas hochhalter\AppData\Local\Temp\proxy_vole5334183344008302495.dll 2016-10-20 18:26 - 2016-10-20 18:26 - 0772672 _____ () C:\Users\thomas hochhalter\AppData\Local\Temp\sqlite3.dll 2016-11-20 06:50 - 2016-11-20 06:52 - 30533688 _____ () C:\Users\thomas hochhalter\AppData\Local\Temp\vlc-2.2.4-win32.exe ==================== Bamital & volsnap ====================== (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2017-02-04 20:05 ==================== Ende von FRST.txt ============================ |
| Themen zu Virenfund vom 10.02.2017 |
| .dll, appdata, chromium, code, control, erkannt, explorer, firefox, fund, internet, internet explorer, laptop, logfiles, malwarebytes, mbam, microsoft, mozilla, roaming, scan, setup, software, temp, viren, websites, whatsapp, windows, windowsapps, yahoo |
Baum-Darstellung