| |
| |||||||
Log-Analyse und Auswertung: VBS/Autorun. AG - scheinbar missglückte EntfernungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.02.2017, 15:35
| #2 |
 |  VBS/Autorun. AG - scheinbar missglückte Entfernung hijackthis.log
__________________[CODE] HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.5 Scan saved at 19:40:20, on 07.02.2017 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v11.0 (11.00.9600.18538) FIREFOX: 51.0.1 (x86 de) Boot mode: Normal Running processes: C:\Program Files\Lenovo\Nsd\startupSupport.exe C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe C:\Program Files (x86)\Cyberlink\Shared files\brs.exe C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avpui.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files (x86)\PDF24\pdf24.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe C:\Windows\SysWOW64\NOTEPAD.EXE C:\Program Files (x86)\Mozilla Firefox\firefox.exe G:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: ScriptInjectionPluginBrowserHelperObject - {2E38825B-8815-42CF-9126-C58BC28D4591} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_112\bin\ssv.dll O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL O2 - BHO: Microsoft OneDrive for Business Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_112\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" O4 - HKLM\..\Run: [LockKey] C:\Program Files (x86)\LockKey\LockKey.exe O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe O4 - HKLM\..\Run: [Intel AppUp(SM) center] "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 O4 - HKLM\..\Run: [Lenovo Registration] C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot O4 - HKLM\..\Run: [Intelligent Touchpad] C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe O4 - HKLM\..\Run: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe" O4 - HKLM\..\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0" O4 - HKLM\..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe O4 - HKLM\..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery" O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe O4 - HKLM\..\Run: [Adobe Creative Cloud] "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true O4 - HKLM\..\Run: [PDFPrint] "C:\Program Files (x86)\PDF24\pdf24.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe O4 - HKLM\..\Run: [ADSK DLMSession] C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe O4 - HKCU\..\Run: [Amazon Music] "C:\Users\Dane\AppData\Local\Amazon Music\Amazon Music Helper.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Dane\AppData\Local\Akamai\netsession_win.exe" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000 O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105 O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Intel\AE Centrino\AE Wireless Bluetooth\AE 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe O23 - Service: Kaspersky Anti-Virus Service 17.0.0 (AVP17.0.0) - AO Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe O23 - Service: chip 1-click download service (chip1click) - Chip Digital GmbH - C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe O23 - Service: CyberLink Product - 2012/09/21 09:40:18 (CLKMSVC10_3A60B698) - CyberLink - C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe O23 - Service: DokanMounter - Unknown owner - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\Windows\system32\EasyAntiCheat.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FlexNet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing) O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\Windows\system32\igfxCUIService.exe (file missing) O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: klvssbrigde64 - AO Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\vssbridge64.exe O23 - Service: Kaspersky Secure Connection Service 1.0.0 (KSDE1.0.0) - AO Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe O23 - Service: Logitech Gaming Registry Service (LogiRegistryService) - Logitech Inc. - C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Fast boot service of lenovo (NSDSvc) - Unknown owner - C:\Windows\System32\NSDSvc.exe (file missing) O23 - Service: NVIDIA LocalSystem Container (NvContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe O23 - Service: NVIDIA NetworkService Container (NvContainerNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe O23 - Service: NVIDIA Wireless Controller Service - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: Wondershare Application Framework Service (WsAppService) - Wondershare - C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel\AE Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe -- End of file - 19383 bytes FRST FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 05-02-2017 durchgeführt von Dane (Administrator) auf DANE-PC (07-02-2017 20:18:43) Gestartet von C:\Users\Dane\Downloads Geladene Profile: Dane & (Verfügbare Profile: Dane & Gast) Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe () C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Lenovo) C:\Windows\System32\NSDSvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Lenovo) C:\Program Files\Lenovo\Nsd\startupSupport.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe ( ) C:\Program Files (x86)\LockKey\LockKey.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe () C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe (Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avpui.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avpui.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-16] (Synaptics Incorporated) HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [410896 2011-12-16] (Synaptics) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2011-12-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor) HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789856 2012-09-21] (Lenovo) HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-09-21] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2012-09-21] (Lenovo(beijing) Limited) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-05-05] (Adobe Systems Incorporated) HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [15003256 2015-09-19] (Logitech Inc.) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation) HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( ) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [152896 2012-06-25] (Intel Corporation) HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot HKLM-x32\...\Run: [Intelligent Touchpad] => C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe [291272 2011-12-08] () HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink) HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.) HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-09-21] (Lenovo) HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink) HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.) HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-09-24] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-09-24] (Adobe Systems Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-07-27] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2313408 2016-04-07] (Adobe Systems Incorporated) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation) HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1627032 2015-01-28] (Autodesk, Inc.) Winlogon\Notify\igfxcui: igfxdev.dll [X] HKU\S-1-5-21-1657567744-246073522-3636546880-1001\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-1657567744-246073522-3636546880-1001\...\Run: [Amazon Music] => C:\Users\Dane\AppData\Local\Amazon Music\Amazon Music Helper.exe [3694056 2017-02-01] (Amazon Services LLC) HKU\S-1-5-21-1657567744-246073522-3636546880-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-1657567744-246073522-3636546880-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Dane\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.) HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Music] => C:\Users\Dane\AppData\Local\Amazon Music\Amazon Music Helper.exe [3694056 2017-02-01] (Amazon Services LLC) HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Akamai NetSession Interface] => C:\Users\Dane\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [170688 2016-11-11] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2016-11-11] (NVIDIA Corporation) Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Keine Datei ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-02-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-02-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-02-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-02-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll [2012-09-21] () Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lenovo Produktregistrierung.lnk [2014-11-02] ShortcutTarget: Lenovo Produktregistrierung.lnk -> C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe (Lenovo, Inc.) GroupPolicy: Beschränkung <======= ACHTUNG ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{8E4A2849-5CC5-4DB1-8B0D-E03661B0C16E}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== HKU\S-1-5-21-1657567744-246073522-3636546880-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com HKU\S-1-5-21-1657567744-246073522-3636546880-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.google.com/ig/redirectdomain?brand=KMOH&bmod=KMOH SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7KMOH_deDE558 SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7KMOH_deDE558 SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7KMOH SearchScopes: HKU\S-1-5-21-1657567744-246073522-3636546880-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7KMOH BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2016-12-07] (AO Kaspersky Lab) BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2017-01-21] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-01-16] (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL [2017-01-21] (Microsoft Corporation) BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-01-21] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-01-16] (Oracle Corporation) BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2016-12-07] (AO Kaspersky Lab) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2017-01-21] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_112\bin\ssv.dll [2016-11-17] (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL [2017-01-21] (Microsoft Corporation) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2017-01-21] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_112\bin\jp2ssv.dll [2016-11-17] (Oracle Corporation) BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated) Toolbar: HKLM - Kein Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Keine Datei Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Keine Datei Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2016-12-07] (AO Kaspersky Lab) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2016-12-07] (AO Kaspersky Lab) Toolbar: HKU\S-1-5-21-1657567744-246073522-3636546880-1001 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Keine Datei Toolbar: HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Keine Datei Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2017-01-21] (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-09-23] (Skype Technologies) FireFox: ======== FF ProfilePath: C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default [2017-02-07] FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\slt5kmfp.default -> Bing FF SelectedSearchEngine: Mozilla\Firefox\Profiles\slt5kmfp.default -> Bing FF Homepage: Mozilla\Firefox\Profiles\slt5kmfp.default -> zeit.de FF Session Restore: Mozilla\Firefox\Profiles\slt5kmfp.default -> ist aktiviert. FF Keyword.URL: Mozilla\Firefox\Profiles\slt5kmfp.default -> hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q= FF Extension: (1 unglaubliche Extension) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\1-unglaubliche-extension@developmint.de.xpi [2016-10-24] FF Extension: (Offers Olymp) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\@offersolymp.xpi [2016-07-20] FF Extension: (Bing Search Engine) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\bingsearch.full@microsoft.com [2015-03-26] [ist nicht signiert] FF Extension: (Blur) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\donottrackplus@abine.com.xpi [2017-01-06] FF Extension: (Ghostery) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\firefox@ghostery.com.xpi [2016-11-30] FF Extension: (Print pages to PDF) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\printPages2Pdf@reinhold.ripper [2015-05-29] FF Extension: (SQLite Manager) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2016-07-20] FF Extension: (Adblock Plus) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24] FF Extension: (DownThemAll!) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-09-30] FF Extension: (Places to CSV) - C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\Extensions\{f08a2443-ec7c-4b46-983e-21f2d8ead164}.xpi [2016-07-20] FF SearchPlugin: C:\Users\Dane\AppData\Roaming\Mozilla\Firefox\Profiles\slt5kmfp.default\searchplugins\startpage-https---deutsch.xml [2016-03-19] FF HKLM\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2016-12-07] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: (Adobe Acrobat - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2015-10-27] [ist nicht signiert] FF HKLM-x32\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-10] () FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-01-16] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-01-16] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-01-21] (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-04-07] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-10] () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.112.2 -> C:\Program Files (x86)\Java\jre1.8.0_112\bin\dtplugin\npDeployJava1.dll [2016-11-17] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.112.2 -> C:\Program Files (x86)\Java\jre1.8.0_112\bin\plugin2\npjp2.dll [2016-11-17] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-01-21] (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2017-01-21] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-09-24] (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-04-07] (Adobe Systems) FF Plugin HKU\S-1-5-21-1657567744-246073522-3636546880-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-12-27] () FF Plugin HKU\S-1-5-21-1657567744-246073522-3636546880-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-12-27] () FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) Chrome: ======= CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib ==================== Dienste (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab) R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.) R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert] R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3697352 2017-01-21] (Microsoft Corporation) S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink) R2 DokanMounter; C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe [11776 2012-05-19] () [Datei ist nicht signiert] S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [392976 2017-01-26] (EasyAntiCheat Ltd) U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2016-12-09] (Hi-Rez Studios) [Datei ist nicht signiert] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [Datei ist nicht signiert] R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation) S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\vssbridge64.exe [77328 2016-06-28] (AO Kaspersky Lab) R2 KSDE1.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [241544 2016-06-28] (AO Kaspersky Lab) R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [192120 2015-09-19] (Logitech Inc.) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] () R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert] R2 NSDSvc; C:\Windows\System32\NSDSvc.exe [120160 2011-12-23] (Lenovo) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2016-11-17] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2016-11-17] (NVIDIA Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-11-10] (NVIDIA Corporation) R2 NVIDIA Wireless Controller Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe [1163712 2016-11-17] (NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2016-02-23] (Electronic Arts) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Datei ist nicht signiert] R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-10-13] () R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.) S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe [417792 2016-07-12] (Wondershare) [Datei ist nicht signiert] S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ====================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R3 AVer7231_x64; C:\Windows\System32\DRIVERS\AVer7231_x64.sys [1800448 2011-03-31] (AVerMedia TECHNOLOGIES, Inc.) S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.) R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab) R2 Dokan; C:\Windows\system32\drivers\dokan.sys [106888 2012-05-19] (Windows (R) Win 7 DDK provider) S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4amd64.sys [22488 2009-08-28] () R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-01] (Disc Soft Ltd) R3 hswpan; C:\Windows\System32\DRIVERS\hswpan.sys [109056 2012-01-27] (Ozmo Inc) R1 hybridcfile; C:\Windows\System32\DRIVERS\HybridCFileX64.sys [13920 2010-03-02] (Lenovo.) R0 HybridDisk; C:\Windows\System32\DRIVERS\HybridDiskX64.sys [38496 2010-03-02] (Lenovo.) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab) R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-07] (AO Kaspersky Lab) R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [78216 2016-05-31] (AO Kaspersky Lab) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [189264 2016-06-26] (AO Kaspersky Lab) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [305496 2016-11-16] (AO Kaspersky Lab) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [1036512 2016-12-07] (AO Kaspersky Lab) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [57936 2016-12-07] (AO Kaspersky Lab) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [52144 2016-05-19] (AO Kaspersky Lab) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab) R3 kltap; C:\Windows\System32\DRIVERS\kltap.sys [52152 2016-06-07] (The OpenVPN Project) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [75696 2016-05-17] (AO Kaspersky Lab) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [134880 2016-12-07] (AO Kaspersky Lab) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [194480 2016-06-14] (AO Kaspersky Lab) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104048 2012-03-02] (Qualcomm Atheros Co., Ltd.) R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech) R3 LGJoyXlCore; C:\Windows\System32\drivers\LGJoyXlCore.sys [68384 2015-06-11] (Logitech Inc.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-02-07] (Malwarebytes) R0 NSD; C:\Windows\System32\drivers\nsd.sys [24160 2011-12-23] (Lenovo Corporation") R1 Nsdfltr; C:\Windows\System32\drivers\Nsdfltr.sys [59488 2011-12-21] (Lenovo Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2016-11-17] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [46016 2016-11-17] (NVIDIA Corporation) R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8208488 2011-09-06] (Realtek Semiconductor Corp.) R1 VBoxUSBMon; C:\Windows\System32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-16] (BigNox Corporation) S3 whfltr2k; C:\Windows\System32\DRIVERS\whfltr2k.sys [10368 2009-09-16] () S3 whfltr2k; C:\Windows\SysWOW64\DRIVERS\whfltr2k.sys [10368 2009-09-16] () U3 BcmSqlStartupSvc; kein ImagePath U2 CLKMSVC10_C3B3B687; kein ImagePath U2 DriverService; kein ImagePath U2 iATAgentService; kein ImagePath U2 idealife Update Service; kein ImagePath U3 IGRS; kein ImagePath U2 IviRegMgr; kein ImagePath U2 Oasis2Service; kein ImagePath U2 PCCarerService; kein ImagePath U2 ReadyComm.DirectRouter; kein ImagePath U2 RichVideo; kein ImagePath U2 RtLedService; kein ImagePath U2 SeaPort; kein ImagePath U2 SoftwareService; kein ImagePath U3 SQLWriter; kein ImagePath ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-02-07 20:18 - 2017-02-07 20:19 - 00041455 _____ C:\Users\Dane\Downloads\FRST.txt 2017-02-07 20:18 - 2017-02-07 20:18 - 00000000 ____D C:\FRST 2017-02-07 20:17 - 2017-02-07 20:17 - 02421248 _____ (Farbar) C:\Users\Dane\Downloads\FRST64.exe 2017-02-07 20:03 - 2017-02-07 20:04 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2017-02-07 20:03 - 2017-02-07 20:03 - 00001102 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2017-02-07 20:03 - 2017-02-07 20:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2017-02-07 20:03 - 2017-02-07 20:03 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-02-07 20:03 - 2017-02-07 20:03 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2017-02-07 20:03 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2017-02-07 20:03 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2017-02-07 20:03 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2017-02-07 20:02 - 2017-02-07 20:02 - 22851472 _____ (Malwarebytes ) C:\Users\Dane\Downloads\mbam-setup-2.2.1.1043.exe 2017-02-07 19:35 - 2017-02-07 19:35 - 00518970 _____ C:\Users\Dane\Documents\cc_20170207_193523.reg 2017-02-07 18:36 - 2017-02-07 18:36 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Leadertech 2017-02-06 14:53 - 2017-02-06 14:53 - 00000000 ____D C:\Users\Dane\AppData\Roaming\AVAST Software 2017-02-06 14:50 - 2017-02-06 14:50 - 00000000 ____D C:\Program Files\AVAST Software 2017-02-06 14:45 - 2017-02-07 03:06 - 00000000 ____D C:\ProgramData\{969053F3-1CD2-D935-9A14-47770056CCB9} 2017-02-06 14:45 - 2017-02-06 14:55 - 00000000 ____D C:\Users\Dane\AppData\Local\372D874F-9051-4E55-9576-7556869D1A14 2017-02-06 14:44 - 2017-02-06 14:44 - 00000000 ____D C:\Program Files (x86)\Offers Olymp 2017-02-06 14:43 - 2017-02-07 19:05 - 00000000 ____D C:\Users\Dane\Downloads\Install JDownloader 2017-02-05 18:42 - 2017-01-05 19:52 - 01460736 ____N (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 01212928 ____N (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00730624 ____N (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00345600 ____N (Microsoft Corporation) C:\Windows\system32\schannel.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00316928 ____N (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00312320 ____N (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00210432 ____N (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00135680 ____N (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00123904 ____N (Microsoft Corporation) C:\Windows\system32\bcrypt.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00086528 ____N (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00043520 ____N (Microsoft Corporation) C:\Windows\system32\cryptbase.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00028672 ____N (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00028160 ____N (Microsoft Corporation) C:\Windows\system32\secur32.dll 2017-02-05 18:42 - 2017-01-05 19:52 - 00022016 ____N (Microsoft Corporation) C:\Windows\system32\credssp.dll 2017-02-05 18:42 - 2017-01-05 18:43 - 00666112 ____N (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2017-02-05 18:42 - 2017-01-05 18:43 - 00096768 ____N (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2017-02-05 18:42 - 2017-01-05 18:24 - 00030720 ____N (Microsoft Corporation) C:\Windows\system32\lsass.exe 2017-02-05 18:42 - 2017-01-05 18:19 - 00036352 ____N (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2017-02-04 12:25 - 2017-02-04 12:25 - 00006195 _____ C:\Users\Dane\Desktop\Sequenz 02_1.xmp 2017-02-04 12:22 - 2017-02-04 12:22 - 09656737 _____ C:\Users\Dane\Desktop\Sequenz 02.mp4 2017-02-03 16:18 - 2017-02-03 16:18 - 00000846 _____ C:\Users\Gast\Desktop\MeshLab.lnk 2017-02-03 16:18 - 2017-02-03 16:18 - 00000846 _____ C:\Users\Dane\Desktop\MeshLab.lnk 2017-02-03 16:18 - 2017-02-03 16:18 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MeshLab 2017-02-03 16:18 - 2017-02-03 16:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MeshLab 2017-02-03 16:18 - 2017-02-03 16:18 - 00000000 ____D C:\Program Files\VCG 2017-02-03 16:17 - 2017-02-03 16:17 - 34401285 _____ C:\Users\Dane\Downloads\meshlab_v133_64bit.exe 2017-02-01 14:15 - 2017-02-02 13:08 - 00000000 ____D C:\Users\Dane\Desktop\Burda 2017-02-01 13:58 - 2017-02-01 13:58 - 00000000 ____D C:\Users\Dane\Desktop\Syncronizer V3 Plugin 2017-02-01 13:57 - 2017-02-01 13:57 - 00005153 _____ C:\Users\Dane\Desktop\Syncronizer V3 Plugin.zip 2017-01-27 17:37 - 2017-01-27 17:38 - 574324958 _____ C:\Users\Dane\Downloads\Archiv.zip 2017-01-27 17:10 - 2017-01-27 17:10 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Agisoft 2017-01-27 17:10 - 2017-01-27 17:10 - 00000000 ____D C:\Users\Dane\AppData\Local\Agisoft 2017-01-27 17:07 - 2017-01-27 17:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Agisoft 2017-01-27 17:07 - 2017-01-27 17:07 - 00000000 ____D C:\Program Files\Agisoft 2017-01-27 17:04 - 2017-01-27 17:05 - 49336320 _____ C:\Users\Dane\Downloads\photoscan-pro_1_2_6_x64.msi 2017-01-27 16:05 - 2017-02-03 19:48 - 00000000 ____D C:\Users\Dane\Desktop\3D shiz 2017-01-27 16:02 - 2017-01-27 16:02 - 00000000 ____D C:\ProgramData\FLEXnet 2017-01-27 15:59 - 2017-02-04 12:05 - 00000010 _____ C:\ProgramData\679973DG-1I2J-9KE8-U9K2-8634JUP6F43E.data 2017-01-27 15:51 - 2017-01-27 15:52 - 279157504 _____ (Autodesk, Inc.) C:\Users\Dane\Downloads\ReMake_1725016_Win64_dlm.sfx.exe 2017-01-27 15:51 - 2017-01-27 15:51 - 00000010 _____ C:\ProgramData\493193CF-8B0C-4EB4-B2B4-3955FEF6F87C.data 2017-01-26 16:29 - 2017-01-26 16:29 - 00414540 _____ C:\Users\Dane\Downloads\rechnung_4426.pdf 2017-01-26 14:44 - 2017-01-26 14:44 - 00000000 ____D C:\ProgramData\For Honor 2017-01-26 12:44 - 2017-01-26 12:44 - 00000234 _____ C:\Users\Dane\Desktop\For Honor.url 2017-01-26 02:06 - 2017-01-26 02:06 - 00000000 ____D C:\Program Files\Common Files\DESIGNER 2017-01-24 01:53 - 2017-01-29 14:50 - 00000000 ____D C:\Users\Dane\Desktop\Neuer Ordner 2017-01-24 00:54 - 2017-01-24 00:54 - 00001106 _____ C:\Users\Public\Desktop\Picasa 3.lnk 2017-01-24 00:54 - 2017-01-24 00:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 2017-01-23 18:28 - 2017-01-24 04:24 - 00000000 ____D C:\Users\Dane\Desktop\Fotoserien 2017-01-23 17:55 - 2017-01-23 17:55 - 00711309 _____ C:\Users\Dane\Documents\Reportd9ace3a5-7de5-453f-bb07-ed72477c25c4.pdf 2017-01-23 17:52 - 2017-01-23 17:52 - 00143811 _____ C:\Users\Dane\Downloads\persönliche_daten_a.pdf 2017-01-23 17:50 - 2017-01-23 17:50 - 00129038 _____ C:\Users\Dane\Downloads\persönliche_daten.pdf 2017-01-19 01:33 - 2017-01-19 01:33 - 00460705 _____ C:\Users\Dane\Downloads\anfahrt_offenburg_1_.pdf 2017-01-15 15:49 - 2017-01-27 15:56 - 00000000 ____D C:\Program Files\Autodesk 2017-01-15 15:49 - 2017-01-15 15:49 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2017-01-15 15:49 - 2017-01-15 15:49 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared 2017-01-15 15:44 - 2017-01-27 16:02 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Autodesk 2017-01-15 15:44 - 2017-01-27 16:02 - 00000000 ____D C:\ProgramData\Autodesk 2017-01-15 15:42 - 2017-01-27 15:55 - 00000000 ____D C:\Autodesk 2017-01-15 15:37 - 2017-01-27 16:02 - 00000000 ____D C:\Users\Dane\AppData\Local\Autodesk 2017-01-15 15:37 - 2017-01-27 15:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk 2017-01-15 15:36 - 2017-02-07 19:06 - 00000000 ____D C:\Users\Dane\AppData\Local\Akamai 2017-01-15 15:36 - 2017-01-15 15:36 - 10697112 _____ (Autodesk, Inc.) C:\Users\Dane\Downloads\AutodeskDownloadManagerSetup.exe 2017-01-15 15:36 - 2017-01-15 15:36 - 00000000 ____D C:\ProgramData\Applications 2017-01-12 15:52 - 2017-01-12 15:52 - 00206840 _____ C:\Users\Dane\Downloads\Pressemitteilung Aufruf zumVideo-Wettbewerb gegen Ablenkung am Steuer.pdf 2017-01-12 15:52 - 2017-01-12 15:52 - 00104068 _____ C:\Users\Dane\Downloads\Teilnahmebedingungen.pdf 2017-01-08 02:14 - 2017-01-26 13:10 - 00392976 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe 2017-01-08 02:14 - 2017-01-08 02:14 - 00000000 ____D C:\Users\Dane\AppData\Local\HirezLauncherUI 2017-01-08 02:11 - 2017-02-07 19:08 - 00000000 ____D C:\Program Files (x86)\Hi-Rez Studios 2017-01-08 02:11 - 2017-01-08 02:18 - 00000000 ____D C:\ProgramData\Hi-Rez Studios 2017-01-08 02:11 - 2017-01-08 02:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-02-07 20:17 - 2016-07-23 04:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2017-02-07 19:46 - 2014-02-24 21:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2017-02-07 19:22 - 2016-11-19 12:10 - 00000000 ____D C:\Users\Dane\AppData\LocalLow\Mozilla 2017-02-07 19:20 - 2013-10-10 13:16 - 00000000 ____D C:\Users\Dane\AppData\Local\Adobe 2017-02-07 19:14 - 2009-07-14 05:45 - 00031840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-02-07 19:14 - 2009-07-14 05:45 - 00031840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-02-07 19:13 - 2012-09-21 18:00 - 00698926 _____ C:\Windows\system32\perfh007.dat 2017-02-07 19:13 - 2012-09-21 18:00 - 00149034 _____ C:\Windows\system32\perfc007.dat 2017-02-07 19:13 - 2009-07-14 06:13 - 01618320 _____ C:\Windows\system32\PerfStringBackup.INI 2017-02-07 19:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2017-02-07 19:09 - 2015-12-30 17:55 - 00000000 ____D C:\Users\Dane\AppData\Local\CrashDumps 2017-02-07 19:08 - 2013-10-10 11:59 - 00125488 _____ C:\Users\Dane\AppData\Local\GDIPFONTCACHEV1.DAT 2017-02-07 19:08 - 2012-09-21 08:39 - 00000000 ____D C:\ProgramData\VeriFace 2017-02-07 19:08 - 2012-09-21 08:13 - 00000000 ____D C:\ProgramData\NVIDIA 2017-02-07 19:07 - 2013-10-10 11:59 - 00000000 ____D C:\Users\Dane 2017-02-07 19:07 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-02-07 19:06 - 2016-11-17 23:08 - 00000000 ____D C:\Program Files (x86)\OpenAL 2017-02-07 19:06 - 2016-08-17 13:16 - 00000000 ____D C:\Program Files (x86)\PDF24 2017-02-07 19:06 - 2016-07-20 10:10 - 00000000 ____D C:\Program Files\CCleaner 2017-02-07 19:06 - 2016-01-20 17:39 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Solvusoft 2017-02-07 19:06 - 2015-12-05 13:30 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software 2017-02-07 19:06 - 2015-06-13 01:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HFSExplorer 2017-02-07 19:06 - 2015-06-13 01:54 - 00000000 ____D C:\Program Files (x86)\HFSExplorer 2017-02-07 19:06 - 2014-07-26 13:50 - 00000000 ____D C:\Users\Dane\AppData\Roaming\dvdcss 2017-02-07 19:06 - 2014-07-07 17:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LAV Filters 2017-02-07 19:06 - 2014-07-07 17:44 - 00000000 ____D C:\Program Files (x86)\LAV Filters 2017-02-07 19:06 - 2014-07-07 17:44 - 00000000 ____D C:\Program Files (x86)\Dokan 2017-02-07 19:06 - 2014-04-02 08:17 - 00000000 ____D C:\Users\Gast 2017-02-07 19:06 - 2014-03-23 20:33 - 00000000 ____D C:\Users\Dane\Desktop\Internet 2017-02-07 19:06 - 2014-03-22 21:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Ripple Sound 2017-02-07 19:06 - 2014-03-22 21:32 - 00000000 ____D C:\Program Files (x86)\BRS 2017-02-07 19:06 - 2014-02-07 00:25 - 00000000 ____D C:\Windows\Minidump 2017-02-07 19:06 - 2013-12-23 11:28 - 00000000 ____D C:\Users\Dane\AppData\Roaming\WebApp 2017-02-07 19:06 - 2013-10-12 02:21 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader 2017-02-07 19:06 - 2013-10-12 02:20 - 00000000 ____D C:\Users\Dane\AppData\Local\JDownloader v2.0 2017-02-07 19:06 - 2013-10-10 11:59 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo 2017-02-07 19:06 - 2012-09-21 08:23 - 00000000 ___HD C:\Windows\system32\WLANProfiles 2017-02-07 19:06 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy 2017-02-07 19:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy 2017-02-07 19:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2017-02-07 19:05 - 2016-07-20 10:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2017-02-07 19:05 - 2013-10-13 00:58 - 00000000 ____D C:\NVIDIA 2017-02-07 19:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration 2017-02-07 18:59 - 2013-11-08 01:00 - 00000000 ____D C:\ProgramData\AVAST Software 2017-02-05 18:46 - 2013-10-10 13:04 - 00000000 ____D C:\Windows\system32\MRT 2017-02-05 17:33 - 2013-10-19 23:07 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CA9F75E6-52C7-4979-969B-8C5C9591E101} 2017-02-05 11:35 - 2013-10-10 12:43 - 00000000 ____D C:\Users\Dane\AppData\Local\ElevatedDiagnostics 2017-02-04 13:48 - 2013-12-14 21:36 - 00000000 ____D C:\Program Files (x86)\Steam 2017-02-03 16:19 - 2016-11-22 22:41 - 00000000 ____D C:\Users\Dane\AppData\Local\Amazon Music 2017-02-01 14:11 - 2015-05-26 19:57 - 00000132 _____ C:\Users\Dane\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen 2017-02-01 10:19 - 2016-08-18 10:41 - 00000000 __SHD C:\Users\Dane\IntelGraphicsProfiles 2017-01-31 01:58 - 2016-11-18 15:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-01-31 01:58 - 2013-10-10 12:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-01-30 17:02 - 2015-09-09 14:32 - 00000882 _____ C:\Users\Dane\Documents\noch offen.txt 2017-01-30 01:44 - 2013-10-13 00:26 - 00000000 ____D C:\Users\Dane\AppData\Local\Ubisoft Game Launcher 2017-01-27 16:53 - 2014-03-23 20:33 - 00000000 ____D C:\Users\Dane\Desktop\Progs 2017-01-27 15:51 - 2015-05-26 18:11 - 00000000 ____D C:\ProgramData\boost_interprocess 2017-01-26 14:44 - 2013-10-13 20:41 - 00000000 ____D C:\Users\Dane\Documents\My Games 2017-01-26 02:07 - 2016-12-01 14:30 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-01-26 02:06 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2017-01-26 02:05 - 2016-12-01 14:27 - 00000000 ____D C:\Program Files\Microsoft Office 2017-01-24 02:41 - 2014-11-03 13:29 - 00000000 ____D C:\Sicherung 2017-01-24 00:54 - 2013-10-10 12:22 - 00000000 ____D C:\Users\Dane\AppData\Local\Google 2017-01-24 00:53 - 2012-09-21 08:40 - 00000000 ____D C:\Program Files (x86)\Google 2017-01-23 18:25 - 2014-03-23 20:08 - 00000000 ____D C:\Users\Dane\Desktop\Uni 2017-01-21 15:40 - 2015-06-25 16:13 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2017-01-18 18:47 - 2013-10-13 18:33 - 00000000 ____D C:\Users\Dane\AppData\Roaming\Skype 2017-01-13 03:24 - 2016-12-25 01:57 - 00000000 ____D C:\Users\Dane\Desktop\moeg pra 2017-01-12 15:32 - 2016-05-10 00:12 - 00000000 ____D C:\Users\Dane\AppData\Local\UnrealEngine 2017-01-11 19:13 - 2013-12-12 23:59 - 00007600 _____ C:\Users\Dane\AppData\Local\Resmon.ResmonCfg 2017-01-11 16:57 - 2015-06-24 23:21 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2017-01-10 23:47 - 2014-02-24 21:42 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-01-10 23:47 - 2013-10-10 13:17 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-01-10 23:47 - 2013-10-10 13:17 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-01-10 23:47 - 2013-10-10 13:17 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-01-10 23:47 - 2013-10-10 13:17 - 00000000 ____D C:\Windows\system32\Macromed 2017-01-09 19:27 - 2016-05-10 00:04 - 00000000 ___RD C:\Program Files (x86)\Skype 2017-01-09 19:27 - 2013-10-13 18:33 - 00000000 ____D C:\ProgramData\Skype 2017-01-08 02:11 - 2012-09-21 08:10 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-10-23 12:40 - 2016-01-29 18:08 - 0000132 _____ () C:\Users\Dane\AppData\Roaming\Adobe CS6-BMP-Format - Voreinstellungen 2015-05-26 19:57 - 2017-02-01 14:11 - 0000132 _____ () C:\Users\Dane\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen 2015-04-27 13:02 - 2015-04-27 13:02 - 0003584 _____ () C:\Users\Dane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-12-12 23:59 - 2017-01-11 19:13 - 0007600 _____ () C:\Users\Dane\AppData\Local\Resmon.ResmonCfg 2015-09-15 18:22 - 2015-09-15 18:22 - 0266074 _____ () C:\Users\Dane\AppData\Local\Tempdivx010e 2015-11-04 14:14 - 2015-11-04 14:14 - 0046384 _____ () C:\Users\Dane\AppData\Local\Tempdivx0609 2015-09-23 12:01 - 2015-09-23 12:01 - 0047475 _____ () C:\Users\Dane\AppData\Local\Tempdivx1ad7 2015-10-23 01:09 - 2015-10-23 01:09 - 0047475 _____ () C:\Users\Dane\AppData\Local\Tempdivx5761 2015-09-15 18:22 - 2015-09-15 18:22 - 0266074 _____ () C:\Users\Dane\AppData\Local\Tempdivx5d12 2015-09-15 18:22 - 2015-09-15 18:22 - 0266074 _____ () C:\Users\Dane\AppData\Local\Tempdivx7113 2015-10-23 01:22 - 2015-10-23 01:23 - 0047475 _____ () C:\Users\Dane\AppData\Local\Tempdivxa04e 2015-09-15 18:22 - 2015-09-15 18:22 - 0266074 _____ () C:\Users\Dane\AppData\Local\Tempdivxb53d 2015-11-03 14:04 - 2015-11-03 14:04 - 0047475 _____ () C:\Users\Dane\AppData\Local\Tempdivxbed7 2015-09-15 19:22 - 2015-09-15 19:22 - 0266074 _____ () C:\Users\Dane\AppData\Local\Tempdivxd4f5 2015-09-27 12:07 - 2015-09-27 12:07 - 0047475 _____ () C:\Users\Dane\AppData\Local\Tempdivxfbe4 2017-01-27 15:51 - 2017-01-27 15:51 - 0000010 _____ () C:\ProgramData\493193CF-8B0C-4EB4-B2B4-3955FEF6F87C.data 2017-01-27 15:59 - 2017-02-04 12:05 - 0000010 _____ () C:\ProgramData\679973DG-1I2J-9KE8-U9K2-8634JUP6F43E.data 2014-05-19 19:04 - 2016-01-20 17:49 - 0010078 _____ () C:\ProgramData\hpzinstall.log Einige Dateien in TEMP: ==================== 2017-01-15 15:52 - 2016-01-26 11:40 - 0066496 _____ (Autodesk, Inc.) C:\Users\Dane\AppData\Local\Temp\AcDeltree.exe 2016-07-23 02:12 - 2016-06-14 12:27 - 0945688 _____ (BlueStack Systems, Inc.) C:\Users\Dane\AppData\Local\Temp\BluestacksUninstaller.exe 2015-04-03 15:59 - 2015-04-03 15:59 - 0477960 _____ (BitRaider, LLC) C:\Users\Dane\AppData\Local\Temp\BRSVC_10102125_hlp.exe 2013-12-23 11:28 - 2013-12-23 11:28 - 0460800 _____ (Realtek Semiconductor Corp.) C:\Users\Dane\AppData\Local\Temp\COMAP.EXE 2012-09-21 06:49 - 2011-05-19 22:57 - 0086016 _____ () C:\Users\Dane\AppData\Local\Temp\CPU-V.dll 2010-11-07 22:20 - 2005-02-05 14:34 - 0135168 _____ () C:\Users\Dane\AppData\Local\Temp\CRCCheck.exe 2015-03-26 23:35 - 2015-03-26 23:35 - 0362648 _____ (© 2015 Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\DefaultPackOffer.dll 2007-09-18 13:58 - 2007-09-18 13:58 - 0077160 _____ (Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\DSETUP.dll 2007-09-18 13:58 - 2007-09-18 13:58 - 1673576 _____ (Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\dsetup32.dll 2013-12-01 21:27 - 2013-12-01 21:28 - 13485616 _____ (Disc Soft Ltd) C:\Users\Dane\AppData\Local\Temp\DTLite4481-0347.exe 2007-09-18 13:58 - 2007-09-18 13:58 - 0503144 _____ (Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\DXSETUP.exe 2015-12-07 21:21 - 2015-12-07 21:21 - 0065536 _____ () C:\Users\Dane\AppData\Local\Temp\Execute2App.exe 2016-11-25 23:28 - 2016-11-25 23:28 - 0028160 _____ () C:\Users\Dane\AppData\Local\Temp\extension2523411317714980093.dll 2016-11-25 14:19 - 2016-11-25 14:19 - 0013824 _____ () C:\Users\Dane\AppData\Local\Temp\extension2673542612198714645.dll 2016-11-25 23:28 - 2016-11-25 23:28 - 0634368 _____ () C:\Users\Dane\AppData\Local\Temp\extension2868543640120131431.dll 2016-11-25 14:19 - 2016-11-25 14:19 - 0028160 _____ () C:\Users\Dane\AppData\Local\Temp\extension4144961857802840670.dll 2016-11-25 23:28 - 2016-11-25 23:28 - 0013824 _____ () C:\Users\Dane\AppData\Local\Temp\extension5288734388008099.dll 2016-11-25 23:28 - 2016-11-25 23:28 - 0016384 _____ () C:\Users\Dane\AppData\Local\Temp\extension5803520931181999986.dll 2016-11-25 14:19 - 2016-11-25 14:19 - 0634368 _____ () C:\Users\Dane\AppData\Local\Temp\extension616417631235462716.dll 2016-11-25 14:19 - 2016-11-25 14:19 - 0016384 _____ () C:\Users\Dane\AppData\Local\Temp\extension6720578406145344773.dll 2009-07-17 19:12 - 2009-07-17 19:12 - 1957206 _____ (Adobe Systems Incorporated) C:\Users\Dane\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe 2013-10-10 13:15 - 2013-10-10 13:15 - 17813896 _____ (Adobe Systems Incorporated) C:\Users\Dane\AppData\Local\Temp\fp_pl_pfs_installer.exe 2015-03-13 17:15 - 2015-03-13 17:24 - 20443868 _____ (DVDVideoSoft Ltd. ) C:\Users\Dane\AppData\Local\Temp\FreeDVDVideoConverter.exe 2016-07-23 02:12 - 2016-06-14 12:26 - 0187416 _____ (BlueStack Systems) C:\Users\Dane\AppData\Local\Temp\HD-LibraryHandler.dll 2016-07-23 02:12 - 2016-06-14 12:24 - 0246808 _____ (BlueStack Systems) C:\Users\Dane\AppData\Local\Temp\HD-Logger-Native.dll 2014-07-07 17:40 - 2014-07-07 17:40 - 1243648 _____ (JRiver, Inc.) C:\Users\Dane\AppData\Local\Temp\JRMediaUninstall.dll 2015-12-07 21:21 - 2015-12-07 21:21 - 0327680 _____ (TODO: <회사 이름>) C:\Users\Dane\AppData\Local\Temp\Kies2RemoveAll.exe 2014-07-07 17:44 - 2014-07-07 17:44 - 7798312 _____ (1f0.de ) C:\Users\Dane\AppData\Local\Temp\LAVFilters.exe 2015-12-07 21:21 - 2015-12-07 21:21 - 0568832 _____ (Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\msvcp90.dll 2015-12-07 21:21 - 2015-12-07 21:21 - 0655872 _____ (Microsoft Corporation) C:\Users\Dane\AppData\Local\Temp\msvcr90.dll 2013-11-26 21:49 - 2013-11-26 21:49 - 0001536 _____ () C:\Users\Dane\AppData\Local\Temp\NOSEventMessages.dll 2016-12-03 16:58 - 2016-12-03 16:58 - 0040448 _____ () C:\Users\Dane\AppData\Local\Temp\proxy_vole3221054233540370261.dll 2016-12-03 17:01 - 2016-12-03 17:01 - 0040448 _____ () C:\Users\Dane\AppData\Local\Temp\proxy_vole4321663382684975937.dll 2016-12-03 16:58 - 2016-12-03 16:58 - 0040448 _____ () C:\Users\Dane\AppData\Local\Temp\proxy_vole6619966571972716030.dll 2016-12-03 16:58 - 2016-12-03 16:58 - 0040448 _____ () C:\Users\Dane\AppData\Local\Temp\proxy_vole7204037558236786364.dll 2015-06-24 23:02 - 2015-06-24 23:03 - 1010672 _____ (DivX, LLC) C:\Users\Dane\AppData\Local\Temp\RSPUpgradeInstaller.exe 2013-10-12 02:29 - 2013-10-12 02:29 - 0042496 _____ (NirSoft) C:\Users\Dane\AppData\Local\Temp\sdanircmdc.exe 2014-11-11 15:49 - 2016-05-10 00:03 - 45196928 _____ (Skype Technologies S.A.) C:\Users\Dane\AppData\Local\Temp\SkypeSetup.exe 2015-06-05 17:26 - 2014-03-05 19:52 - 0087173 _____ () C:\Users\Dane\AppData\Local\Temp\Uninstall.exe 2014-08-29 10:56 - 2014-08-29 10:56 - 24743106 _____ () C:\Users\Dane\AppData\Local\Temp\vlc-2.1.5-win32.exe 2015-07-08 10:41 - 2015-07-08 10:42 - 28849904 _____ () C:\Users\Dane\AppData\Local\Temp\vlc-2.2.1-win32.exe ==================== Bamital & volsnap ====================== (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2017-02-02 23:49 ==================== Ende von FRST.txt ============================ |
| Themen zu VBS/Autorun. AG - scheinbar missglückte Entfernung |
| abgesicherten, administratorrechte, angeblich, benachrichtigung, ccsetup, dateien, entfernt, entfernung, fehlen, firefox, gen, hallo zusammen, hinweis, infizierte, kaspersky, lange, langsam, log, modus, namens, neustart, problem, rechner, sämtliche, taskmanager, vbs/autorun, wrapper, zusammen |
Baum-Darstellung