Malwarebytes Anti-Rootkit hat funde

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 05-03-2017
durchgeführt von kraft (08-03-2017 19:25:36) Run:1
Gestartet von C:\Users\kraft\Desktop
Geladene Profile: kraft (Verfügbare Profile: kraft)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
Unlock: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS
ExportKey: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.exe
ExportKey: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MsMpEng.exe
ExportKey: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\svchost.exe
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************

"HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS" => Schlüssel wurde entsperrt
================== ExportKey: ===================

"HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.exe" => nicht gefunden

=== Ende von ExportKey ===
================== ExportKey: ===================

"HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MsMpEng.exe" => nicht gefunden

=== Ende von ExportKey ===
================== ExportKey: ===================

"HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\svchost.exe" => nicht gefunden

=== Ende von ExportKey ===

========= RemoveProxy: =========

HKU\S-1-5-21-158635237-284480845-3587394234-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-158635237-284480845-3587394234-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========


========= ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

========= Ende von CMD: =========


========= netsh winsock reset =========


Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlieáen.


========= Ende von CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 7806528 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 168181461 B
Java, Flash, Steam htmlcache => 343 B
Windows/system/drivers => 2522230 B
Edge => 16828710 B
Chrome => 0 B
Firefox => 411359162 B
Opera => 20517362 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 0 B
kraft => 609457197 B
DefaultAppPool => 0 B

RecycleBin => 0 B
EmptyTemp: => 1.2 GB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 19:27:03 ====
         

HitmanPro 3.7.15.281
www.hitmanpro.com

   Computer name . . . . : KRAFT-PC
   Windows . . . . . . . : 10.0.0.14393.X64/2
   User name . . . . . . : kraft-PC\kraft
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-03-08 19:54:14
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 7m 10s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 1

   Objects scanned . . . : 1.749.839
   Files scanned . . . . : 60.058
   Remnants scanned  . . : 619.917 files / 1.069.864 keys

Suspicious files ____________________________________________________________

   C:\Users\kraft\Desktop\FRST64.exe
      Size . . . . . . . : 2.423.808 bytes
      Age  . . . . . . . : 0.5 days (2017-03-08 08:49:57)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : D3F6B73F9517C1058A870B3411AF3A7DDA50A94B76ED0A29D0EF7E55601BCA04
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.