| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Nach Adware Angriff,Hijack.HostWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.04.2017, 08:52
| #16 |
 |  Nach Adware Angriff,Hijack.Host Frisches FRST Log: FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017 durchgeführt von Pascal (Administrator) auf DESKTOP-NBS516K (07-04-2017 09:49:46) Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir11112_917 Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal) Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe (Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe (Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe (Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe (Microsoft Corporation) C:\Windows\System32\InstallAgent.exe (Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Valve Corporation) E:\Neuer Ordner\Steam.exe (Valve Corporation) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\Spotify.exe (Valve Corporation) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe ==================== Registry (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16696840 2016-09-14] (Realtek Semiconductor) HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2013-12-17] (AVM Berlin) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [RoccatIskuFX] => C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe [540672 2014-10-19] (ROCCAT GmbH) HKLM-x32\...\Run: [RoccatKoneXTDOptical] => C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.EXE [552960 2014-04-14] (ROCCAT GmbH) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.) HKLM-x32\...\Run: [Kraken71ChromaHelper] => C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe [1600096 2017-02-14] (Razer Inc) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Discord] => C:\Users\Pascal\AppData\Local\Discord\app-0.0.297\Discord.exe [64290304 2017-01-04] (Hammer & Chisel, Inc.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Steam] => E:\Neuer Ordner\steam.exe [3019552 2017-03-23] (Valve Corporation) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Spotify Web Helper] => C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-01] (Spotify Ltd) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [1690248 2016-12-01] (BlueStack Systems, Inc.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Gaijin.Net Agent] => C:\Users\Pascal\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [1912840 2017-02-19] () HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3044816 2017-03-14] (Electronic Arts) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] () HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\Dxtory Software\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [f.lux] => C:\Users\Pascal\AppData\Local\FluxSoftware\Flux\flux.exe [1024240 2016-12-06] (Flux Software LLC) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [SuperF4] => C:\Users\Pascal\AppData\Roaming\SuperF4\SuperF4.exe [40960 2015-08-24] (Stefan Sundin) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Chromium] => c:\users\pascal\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [VHMHR88UKJGKO0T] => "C:\Program Files\SH8GW5V5VQ\SH8GW5V5V.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [6159] => "C:\Users\Pascal\AppData\Roaming\45786296\827204.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [ruOj4cTpe+.exe] => C:\Program Files\Microsoft Office\XCR5RZM7N2TK0\ruOj4cTpe+.exe -r1_5 -r2_1 HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [UMRTDY6K0MWO87K] => "C:\Program Files\LZAE7O812S\LZAE7O812.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [5LDEE8ZQ7YU0R81] => "C:\Program Files\R825KEPMNZ\R825KEPMN.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [OPKXB4WC5AAA46E] => "C:\Program Files\V389U12JRN\V389U12JR.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [W55ARE7PITE99EB] => "C:\Program Files\L9X4M63QIN\L9X4M63QI.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27545048 2017-03-14] (Skype Technologies S.A.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {0e0919c9-b364-11e6-a29d-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {bd04f186-b1b0-11e6-a29a-7085c209549d} - "G:\pushinst.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa05-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa2a-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa3f-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c75a8-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c7cb1-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe" ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Keine Datei Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk [2017-04-05] ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScpToolkit Tray Notifications.lnk [2017-04-05] ShortcutTarget: ScpToolkit Tray Notifications.lnk -> C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe (Scarlet.Crush Productions) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Winsock: Catalog5-x64 05 C:\Windows\system32\NSBlockA.dll => Keine Datei <===== ACHTUNG Winsock: Catalog5-x64 08 C:\Windows\system32\NSBlockB.dll => Keine Datei <===== ACHTUNG Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{da0d42d9-18de-4b46-bcb2-42561cb5aa05}: [DhcpNameServer] 192.168.2.1 ManualProxies: Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt SearchScopes: HKU\S-1-5-21-3959254474-2508283465-2998445632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605 [2017-04-07] FF Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-04-05] FF Extension: (Disable Prefetch) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\features\{54afb0fe-8646-4f03-a4d4-2020d0431a86}\disable-prefetch@mozilla.org.xpi [2017-04-05] FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-29] [ist nicht signiert] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-04-06] () FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-04-06] () FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-11-15] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-23] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-23] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin HKU\S-1-5-21-3959254474-2508283465-2998445632-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-09] (Unity Technologies ApS) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-11-15] (Microsoft Corporation) StartMenuInternet: FIREFOX.EXE - firefox.exe FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2017-04-05] Chrome: ======= CHR DefaultProfile: ChromeDefaultData2 CHR HomePage: ChromeDefaultData2 -> hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkOOmCCYjHgvUD8zQEC2onXZ0flEr-hZWd-RsmvP_SOpJeDvIzZP42wPMaHzmlcwF5M2qhrDaNB_0LXaMiqZuPt8E_yuCQj_6tziC2-4Yiln3v_mF3_BbWZUEu8CFqbQehiNhUZhTVLvtVv-RuFDbrzEm355f3f06ikvqBZITQ,, CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.youndoo.com/?z=6387f3cc1cb544525b2e38agdz9t8g1c5m0t0ebe5o&from=amz&uid=ST1000DM003-1SB102_Z9A3CK7CXXXXZ9A3CK7C&type=hp" CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-04-07] <==== ACHTUNG CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx StartMenuInternet: Google Chrome - Chrome.exe Opera: ======= OPR Extension: (VK+OK AdBlock) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\fgfffefkfpmbjmhofnofmiikiolcbhll [2017-04-05] OPR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-04-05] StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe ==================== Dienste (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] () S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [486936 2016-12-01] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [470552 2016-12-01] (BlueStack Systems, Inc.) S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [511512 2016-12-01] (BlueStack Systems, Inc.) R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert] R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-02-08] (Digital Wave Ltd.) R2 Ds3Service; C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe [389632 2016-01-10] (Scarlet.Crush Productions) [Datei ist nicht signiert] S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395024 2017-01-19] (EasyAntiCheat Ltd) R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-11-25] () S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-23] (NVIDIA Corporation) R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-02-23] (NVIDIA Corporation) R2 Online Manager Service; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe [3076096 2016-09-21] (Deutsche Telekom AG) [Datei ist nicht signiert] S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2123240 2017-03-14] (Electronic Arts) R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184688 2017-03-14] (Electronic Arts) S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD) S2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH) R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69768 2017-02-15] (Razer Inc.) R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] () S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation) S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation) S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s [X] S2 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ====================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2013-12-17] (AVM Berlin) S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-12-01] (BlueStack Systems) S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-11-08] (Bluestack System Inc. ) S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) S3 FairplayKD; C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [78856 2017-02-12] (Multi Theft Auto) R3 fwlanusb6; C:\Windows\system32\DRIVERS\fwlanusb6.sys [1327744 2014-03-27] (AVM GmbH) S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2017-02-02] (LogMeIn Inc.) U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-11-25] (Huawei Technologies Co., Ltd.) S3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-04-01] (hxxp://libusb-win32.sourceforge.net) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2017-04-07] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] () R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys [14569528 2017-02-24] (NVIDIA Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2017-02-23] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47672 2017-01-20] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [59448 2017-02-23] (NVIDIA Corporation) S0x01000000 papycpu2; C:\Windows\SysWOW64\DRIVERS\papycpu2.sys [1984 2003-01-17] () [Datei ist nicht signiert] S0x01000000 papyjoy; C:\Windows\SysWOW64\DRIVERS\papyjoy.sys [1856 2003-01-17] () [Datei ist nicht signiert] R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.) R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.) R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions) S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) S3 TelekomNM6; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 VBAudioVACMME; C:\Windows\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider) R3 VBAudioVMVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2017-02-10] (Windows (R) Win 7 DDK provider) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation) R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2016-10-20] (WinISO.com) S3 xhunter1; C:\Windows\xhunter1.sys [36832 2017-04-01] (Wellbia.com Co., Ltd.) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-04-07 08:47 - 2017-04-07 08:47 - 00000547 _____ C:\Users\Pascal\Desktop\JRT.txt 2017-04-06 12:23 - 2017-04-06 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2017-04-06 12:22 - 2017-04-06 12:22 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001 (1).exe 2017-04-06 12:10 - 2017-04-06 12:10 - 07097928 _____ (VS Revo Group ) C:\Users\Pascal\Downloads\revo202setup.exe 2017-04-06 12:10 - 2017-04-06 12:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller 2017-04-06 12:10 - 2017-04-06 12:10 - 00000000 ____D C:\Program Files\VS Revo Group 2017-04-06 11:55 - 2017-04-07 09:49 - 00000000 ____D C:\FRST 2017-04-06 11:54 - 2017-04-06 11:54 - 02424832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe 2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381248740.pdf 2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381243888.pdf 2017-04-06 11:16 - 2017-04-06 12:40 - 00000000 ____D C:\Users\Pascal\Desktop\Bilder 2017-04-06 09:47 - 2017-04-06 09:47 - 00004466 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype 2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2017-04-06 09:35 - 2017-04-06 12:14 - 00000000 ____D C:\Program Files\Common Files\AV 2017-04-06 09:34 - 2017-04-06 12:39 - 00000000 ____D C:\Users\Pascal\Desktop\Schutz 2017-04-06 09:34 - 2017-04-06 12:14 - 00000000 ____D C:\ProgramData\AVAST Software 2017-04-06 09:34 - 2017-04-06 09:34 - 06654960 _____ (AVAST Software) C:\Users\Pascal\Downloads\avast_free_antivirus_setup_online.exe 2017-04-06 08:15 - 2017-04-06 12:13 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WhatsApp 2017-04-06 08:15 - 2017-04-06 08:15 - 00002292 _____ C:\Users\Pascal\Desktop\WhatsApp.lnk 2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp 2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Local\WhatsApp 2017-04-06 08:13 - 2017-04-06 08:13 - 01496584 _____ C:\Users\Pascal\Downloads\WhatsApp3699Setup - CHIP-Installer.exe 2017-04-06 07:56 - 2017-04-06 07:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Eric_Zhang 2017-04-05 21:24 - 2017-04-07 08:46 - 01663904 _____ (Malwarebytes) C:\Users\Pascal\Downloads\JRT.exe 2017-04-05 21:21 - 2017-04-05 21:21 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001.exe 2017-04-05 13:39 - 2017-04-05 13:39 - 00001157 _____ C:\Users\Public\Desktop\PDF24.lnk 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Users\Pascal\AppData\Local\PDF24 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Program Files (x86)\PDF24 2017-04-05 13:38 - 2017-04-05 13:38 - 01496584 _____ C:\Users\Pascal\Downloads\PDF24 Creator - CHIP-Installer.exe 2017-04-05 13:36 - 2017-04-05 13:36 - 00038301 _____ C:\Users\Pascal\Downloads\images.pdf 2017-04-05 13:09 - 2017-04-05 13:09 - 00001154 _____ C:\Users\Pascal\Desktop\Opera.lnk 2017-04-05 12:45 - 2017-04-05 13:36 - 00000000 ____D C:\Users\Pascal\Desktop\Bewerbung 2017-04-05 12:22 - 2017-04-07 08:49 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2017-04-05 12:22 - 2017-04-06 16:15 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2017-04-05 12:22 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2017-04-05 12:22 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2017-04-05 12:18 - 2017-04-05 21:14 - 00000000 ____D C:\Users\Pascal\Documents\Anti 2017-04-05 12:18 - 2017-04-05 21:12 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\uTorrent 2017-04-05 11:55 - 2017-04-05 11:55 - 00003738 _____ C:\Windows\System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} 2017-04-05 11:46 - 2017-04-05 11:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\CrashDumps 2017-04-05 11:40 - 2017-04-05 11:40 - 00000000 ____D C:\Users\Pascal\AppData\Local\PeerDistRepub 2017-04-05 11:38 - 2017-04-05 11:39 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe 2017-04-05 11:33 - 2017-04-05 11:33 - 00001357 _____ C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk 2017-04-05 11:06 - 2017-04-07 08:44 - 00000000 ____D C:\AdwCleaner 2017-04-05 11:06 - 2017-04-05 21:23 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045.exe 2017-04-05 11:02 - 2017-04-05 11:08 - 00000000 ____D C:\Program Files\ZMWCF16IVP 2017-04-05 10:55 - 2017-04-06 12:14 - 00000000 ____D C:\Program Files (x86)\Avira 2017-04-05 10:55 - 2017-04-06 09:54 - 00000000 ____D C:\ProgramData\Avira 2017-04-05 10:52 - 2017-04-05 10:52 - 01496584 _____ C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe 2017-04-05 10:40 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\SUSG1LUFVL 2017-04-05 10:37 - 2017-04-05 21:25 - 00000008 __RSH C:\Users\Pascal\ntuser.pol 2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\ZOTH2H4HUY 2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\NYCW0JIKE4 2017-04-05 10:04 - 2017-04-05 13:19 - 00141312 ___SH C:\Users\Pascal\Downloads\Thumbs.db 2017-04-05 09:59 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\MTSV8KJOJA 2017-04-05 09:59 - 2017-04-05 09:59 - 00720033 _____ C:\Windows\unins000.exe 2017-04-05 09:59 - 2017-04-05 09:59 - 00042558 _____ C:\Windows\unins000.dat 2017-04-05 09:57 - 2017-04-05 11:07 - 00000000 ____D C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048 2017-04-05 09:57 - 2017-04-05 10:06 - 00000000 ____D C:\Windows\system32\SSL 2017-04-05 09:56 - 2017-04-05 09:56 - 00000000 ____D C:\Windows\system32\sstmp 2017-04-05 09:55 - 2017-04-05 12:32 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Dkulyjegerward 2017-04-05 09:55 - 2017-04-05 09:55 - 00006058 _____ C:\Windows\System32\Tasks\Cdusmezeent Engine 2017-04-04 19:21 - 2017-04-04 19:21 - 00000783 _____ C:\Users\Pascal\Downloads\Cyber Dragons (Jermaine Leach).ydk 2017-04-04 19:19 - 2017-04-04 19:19 - 00000798 _____ C:\Users\Pascal\Downloads\Barian Warrior Rank 4 (Sercan Tepeler).ydk 2017-04-04 19:17 - 2017-04-04 19:17 - 00000748 _____ C:\Users\Pascal\Downloads\Crystron (Berkay Gündar).ydk 2017-04-04 19:17 - 2017-04-04 19:17 - 00000745 _____ C:\Users\Pascal\Downloads\Blackwing Quasar (Samed Yazar).ydk 2017-04-04 19:16 - 2017-04-04 19:16 - 00000746 _____ C:\Users\Pascal\Downloads\D_D_D's (Emre Canyurt).ydk 2017-04-04 19:06 - 2017-04-04 19:06 - 00000762 _____ C:\Users\Pascal\Downloads\Darklords (Lucas Bartolomeu De Oliveira).ydk 2017-04-04 19:01 - 2017-04-04 19:01 - 00000750 _____ C:\Users\Pascal\Downloads\D_D Yang Zings (Giannis Feidakis).ydk 2017-04-04 19:01 - 2017-04-04 19:01 - 00000744 _____ C:\Users\Pascal\Downloads\PSY-Frames (Nick Dietz).ydk 2017-04-04 12:25 - 2017-04-04 12:34 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted Backups 2017-04-04 09:00 - 2017-04-04 09:11 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted 2017-04-04 08:58 - 2017-04-04 08:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed Most Wanted 2005 2017-04-04 07:50 - 2017-04-05 08:06 - 00000074 _____ C:\Users\Pascal\AppData\Roaming\WB.CFG 2017-04-03 20:24 - 2017-04-03 20:24 - 00013824 ___SH C:\Users\Pascal\Desktop\Thumbs.db 2017-04-03 20:22 - 2017-04-03 20:22 - 00000000 ____D C:\ProgramData\PopCap Games 2017-04-03 20:20 - 2017-04-05 12:50 - 00000577 _____ C:\Users\Public\Desktop\Plants vs. Zombies.lnk 2017-04-03 20:20 - 2017-04-03 20:20 - 00000000 ____D C:\Users\Pascal\Desktop\CUE In ISO 2017-04-03 20:19 - 2017-04-05 12:49 - 00002388 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk 2017-04-03 20:18 - 2017-04-05 12:30 - 00000000 ____D C:\Users\Pascal\AppData\Local\Lafesas 2017-04-03 20:18 - 2017-04-05 10:23 - 00000296 _____ C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job 2017-04-03 20:18 - 2017-04-03 20:18 - 00002836 _____ C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} 2017-04-03 20:17 - 2017-04-03 20:17 - 07898096 _____ (WinISO Computing Inc.) C:\Users\Pascal\Downloads\winiso.exe 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WinISO Computing 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Local\WinISO Computing 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Program Files (x86)\WinISO Computing 2017-04-03 20:17 - 2016-10-20 17:13 - 00204032 _____ (WinISO.com) C:\Windows\system32\Drivers\WinisoCDBus.sys 2017-04-02 20:21 - 2017-04-02 20:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\One Finger Death Punch 1.0 2017-04-02 19:35 - 2017-04-02 19:35 - 00000000 ____D C:\Users\Public\Documents\Team17 2017-04-02 19:33 - 2017-04-02 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Worms W.M.D. [GOG.com] 2017-04-02 19:20 - 2017-04-02 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One 2017-04-02 12:21 - 2017-04-02 12:21 - 00000000 ____D C:\ProgramData\Nefarius Software Solutions 2017-04-01 20:32 - 2017-04-01 20:33 - 00000000 ____D C:\Users\Pascal\Desktop\PS3 Controller 2017-04-01 20:27 - 2017-04-05 21:25 - 00000008 __RSH C:\ProgramData\ntuser.pol 2017-04-01 20:27 - 2017-04-01 20:27 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbK.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00083552 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusbK.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00047200 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusbK.sys 2017-04-01 20:26 - 2017-04-01 20:26 - 00003960 _____ C:\Windows\System32\Tasks\updater 2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScpToolkit 2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\Program Files\Nefarius Software Solutions 2017-04-01 20:25 - 2017-04-01 20:25 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Nefarius Software Solutions 2017-04-01 20:24 - 2017-04-01 20:25 - 23361996 _____ (Nefarius Software Solutions) C:\Users\Pascal\Downloads\ScpToolkit_Setup.exe 2017-04-01 20:18 - 2017-04-05 12:50 - 00000687 _____ C:\Users\Public\Desktop\The Saboteur.lnk 2017-04-01 20:18 - 2017-04-01 20:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Saboteur [GOG.com] 2017-04-01 20:17 - 2017-04-05 09:56 - 00000000 ____D C:\Program Files\MotioninJoy 2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\MotioninJoy 2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy 2017-04-01 20:17 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll 2017-04-01 20:16 - 2012-05-12 06:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Pascal\Downloads\MotioninJoy_071001_signed.exe 2017-04-01 20:12 - 2017-04-01 20:12 - 00000000 ____D C:\Users\Pascal\AppData\Local\BetterDS3 2017-04-01 20:11 - 2017-04-01 20:11 - 00759932 _____ C:\Users\Pascal\Downloads\BetterDS3_1.5.3.zip 2017-04-01 20:11 - 2017-04-01 20:11 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH 2017-04-01 20:11 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Pascal\Downloads\Better DS3.exe 2017-04-01 20:10 - 2017-04-01 20:10 - 01496584 _____ C:\Users\Pascal\Downloads\Better DS3 - CHIP-Installer.exe 2017-04-01 16:47 - 2017-04-01 16:47 - 00000947 _____ C:\Users\Pascal\Downloads\60-Card Infernoid Zoodiacs (Ryan Murakami).ydk 2017-03-29 21:58 - 2017-03-29 21:58 - 00000732 _____ C:\Users\Pascal\Downloads\Chain Burn (Jameson Mcgranahan).ydk 2017-03-29 21:57 - 2017-03-29 21:57 - 00000749 _____ C:\Users\Pascal\Downloads\Dark Synchro (Duelist Unknown).ydk 2017-03-29 21:56 - 2017-03-29 21:56 - 00000776 _____ C:\Users\Pascal\Downloads\Reckless Blue-Eyes (Carlos Adams).ydk 2017-03-28 21:18 - 2017-04-05 12:49 - 00000465 _____ C:\Users\Pascal\Desktop\Ygopro.lnk 2017-03-28 21:16 - 2017-03-28 21:17 - 40482992 _____ C:\Users\Pascal\Downloads\ygopro-1.033.D-Percy.exe 2017-03-28 15:03 - 2017-03-28 15:03 - 00000209 _____ C:\Users\Pascal\Desktop\Chivalry Medieval Warfare.url 2017-03-27 22:07 - 2017-04-05 12:50 - 00000943 _____ C:\Users\Public\Desktop\Yu-Gi-Oh! The Dawn of a New Era.lnk 2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\Users\Pascal\Documents\System Files 2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yu-Gi-Oh! The Dawn of a New Era 2017-03-27 22:03 - 2017-03-27 22:03 - 00000000 ____D C:\Yu-Gi-Oh! The Dawn of a New Era 2017-03-27 21:59 - 2017-03-27 22:03 - 780766672 _____ (Kaiba Corporation ) C:\Users\Pascal\Downloads\Yu-Gi-Oh! The Dawn of a New Era - Setup.exe 2017-03-25 16:45 - 2017-03-25 16:45 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Cruderocks 2017-03-25 13:18 - 2017-04-01 20:33 - 00036832 _____ (Wellbia.com Co., Ltd.) C:\Windows\xhunter1.sys 2017-03-21 20:27 - 2017-03-22 23:45 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\RenPy 2017-03-20 21:10 - 2017-03-20 21:10 - 00000209 _____ C:\Users\Pascal\Desktop\FreeStyle Football.url 2017-03-18 22:22 - 2017-03-27 21:22 - 00000000 ____D C:\Users\Pascal\BrawlhallaReplays 2017-03-18 22:14 - 2017-03-18 22:14 - 00000209 _____ C:\Users\Pascal\Desktop\Brawlhalla.url 2017-03-18 22:10 - 2017-03-18 22:10 - 01090920 _____ (Unity Technologies ApS) C:\Users\Pascal\Downloads\UnityWebPlayer(1).exe 2017-03-18 18:22 - 2017-03-18 18:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BioShock Infinite 2017-03-18 13:17 - 2017-03-18 13:18 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\HelloGames 2017-03-18 13:17 - 2017-03-18 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No Man's Sky [GOG.com] 2017-03-17 11:33 - 2017-03-17 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spec Ops The Line 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Public\Documents\Sports Interactive 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\Documents\Sports Interactive 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\AppData\Local\Sports Interactive 2017-03-15 16:48 - 2017-03-15 16:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sports Interactive 2017-03-15 16:45 - 2017-03-15 16:47 - 00000000 ____D C:\Program Files (x86)\Sports Interactive 2017-03-15 08:55 - 2017-03-15 08:55 - 00000000 ____D C:\ProgramData\360TSBackup 2017-03-14 23:06 - 2017-03-14 23:06 - 00000209 _____ C:\Users\Pascal\Desktop\RaceRoom Racing Experience.url 2017-03-14 22:27 - 2017-03-14 22:27 - 00423376 _____ C:\Windows\system32\FNTCACHE.DAT 2017-03-14 19:36 - 2017-04-05 12:50 - 00001273 _____ C:\Users\Public\Desktop\OBS Studio.lnk 2017-03-14 19:36 - 2017-04-04 16:11 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\obs-studio 2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio 2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\Program Files (x86)\obs-studio 2017-03-14 19:33 - 2017-03-14 19:35 - 113001480 _____ (obsproject.com) C:\Users\Pascal\Downloads\OBS-Studio-18.0.1-Full-Installer.exe 2017-03-14 13:07 - 2017-03-14 13:07 - 00000000 __SHD C:\$360Section 2017-03-14 13:02 - 2017-03-14 22:27 - 00000000 ____D C:\Windows\Tasks\360Disabled 2017-03-14 13:02 - 2017-03-14 13:07 - 00000000 ____D C:\ProgramData\360Quarant 2017-03-14 13:01 - 2017-03-15 19:45 - 00000000 ____D C:\Program Files (x86)\360 2017-03-14 13:01 - 2017-03-03 13:30 - 00095232 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys 2017-03-14 13:00 - 2017-03-14 13:00 - 50956720 _____ C:\Users\Pascal\Downloads\360TS_Setup.exe 2017-03-14 13:00 - 2017-03-14 13:00 - 01477032 _____ (QIHU 360 SOFTWARE CO. LIMITED) C:\Users\Pascal\Downloads\360TS_Setup_Mini.exe 2017-03-13 21:20 - 2017-04-05 12:49 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SuperF4.lnk 2017-03-13 21:20 - 2017-03-13 21:20 - 00111535 _____ C:\Users\Pascal\Downloads\SuperF4-1.3.exe 2017-03-13 21:20 - 2017-03-13 21:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\SuperF4 2017-03-13 21:16 - 2017-04-05 12:49 - 00002165 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\f.lux.lnk 2017-03-13 21:16 - 2017-03-13 21:16 - 00496896 _____ C:\Users\Pascal\Downloads\flux-setup.exe 2017-03-13 21:16 - 2017-03-13 21:16 - 00000000 ____D C:\Users\Pascal\AppData\Local\FluxSoftware 2017-03-11 20:05 - 2017-03-11 20:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light [GOG.com] 2017-03-10 16:59 - 2017-02-23 10:17 - 00136064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2017-03-10 16:59 - 2017-01-26 02:13 - 00103936 _____ C:\Windows\SysWOW64\vulkaninfo.exe 2017-03-10 16:59 - 2017-01-26 02:12 - 00326656 _____ C:\Windows\SysWOW64\vulkan-1.dll 2017-03-10 16:59 - 2017-01-26 02:09 - 00322560 _____ C:\Windows\system32\vulkan-1.dll 2017-03-10 16:59 - 2017-01-26 02:09 - 00118272 _____ C:\Windows\system32\vulkaninfo.exe 2017-03-10 16:57 - 2017-02-24 00:55 - 00047664 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 40192056 _____ C:\Windows\system32\nvcompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 35272760 _____ C:\Windows\SysWOW64\nvcompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 34992184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 19007528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 14674896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 11122728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 11019888 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 09306312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 08990256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 03168192 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 02717752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01985080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6437878.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01589696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6437878.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01052096 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00989632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00959424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00946456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFTH264.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00944224 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFThevc.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00910784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00721768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFTH264.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00719856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFThevc.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00687408 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00618416 _____ (NVIDIA Corporation) C:\Windows\system32\nvmcumd.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00609728 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00605120 _____ (NVIDIA Corporation) C:\Windows\system32\nvDecMFTMjpeg.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00576008 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00573632 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00499136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00483384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvDecMFTMjpeg.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00447984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\SysWOW64\nv-vk32.json 2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\system32\nv-vk64.json 2017-03-09 23:56 - 2017-03-09 23:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Just Cause 3 2017-03-09 21:47 - 2017-03-19 20:15 - 00000000 ____D C:\Program Files (x86)\McAfee ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-04-07 08:59 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Spotify 2017-04-07 08:59 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Spotify 2017-04-07 08:48 - 2016-11-23 21:12 - 00000000 ____D C:\Users\Pascal 2017-04-07 08:46 - 2017-03-02 18:19 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Mozilla 2017-04-07 08:46 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA 2017-04-07 08:42 - 2016-12-19 00:40 - 00004174 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BDE79071-9BD6-497A-92EE-45EFD20BC43B} 2017-04-07 08:41 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Overwolf 2017-04-06 21:26 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\TS3Client 2017-04-06 21:05 - 2016-11-23 21:11 - 00000000 ____D C:\Windows\system32\SleepStudy 2017-04-06 19:04 - 2016-11-23 21:16 - 07218858 _____ C:\Windows\system32\PerfStringBackup.INI 2017-04-06 19:04 - 2016-07-17 00:51 - 03587098 _____ C:\Windows\system32\perfh007.dat 2017-04-06 19:04 - 2016-07-17 00:51 - 00978570 _____ C:\Windows\system32\perfc007.dat 2017-04-06 13:11 - 2016-11-23 21:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-04-06 13:11 - 2016-07-16 08:04 - 00262144 _____ C:\Windows\system32\config\BBI 2017-04-06 10:06 - 2016-07-16 13:36 - 00000000 ____D C:\Windows\CbsTemp 2017-04-06 09:54 - 2016-11-23 21:23 - 00000000 ____D C:\ProgramData\Package Cache 2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\Macromed 2017-04-06 09:40 - 2017-01-02 22:34 - 00002642 _____ C:\Users\Public\Desktop\Skype.lnk 2017-04-06 09:40 - 2017-01-02 22:34 - 00000000 ____D C:\ProgramData\Skype 2017-04-06 09:06 - 2016-07-16 13:45 - 00000000 ____D C:\Windows\INF 2017-04-06 08:57 - 2016-07-16 13:47 - 00000000 ___HD C:\Windows\ELAMBKUP 2017-04-06 08:15 - 2016-11-23 21:54 - 00000000 ____D C:\Users\Pascal\AppData\Local\SquirrelTemp 2017-04-05 21:22 - 2016-11-23 21:49 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\uTorrent 2017-04-05 12:50 - 2017-03-03 11:06 - 00001360 _____ C:\Users\Public\Desktop\Online Manager.lnk 2017-04-05 12:50 - 2017-03-02 18:19 - 00001134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-04-05 12:50 - 2017-03-02 18:19 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-04-05 12:50 - 2017-03-02 18:15 - 00001154 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 43.lnk 2017-04-05 12:50 - 2017-02-12 19:27 - 00001030 _____ C:\Users\Public\Desktop\WinFF.lnk 2017-04-05 12:50 - 2017-02-12 13:28 - 00001156 _____ C:\Users\Public\Desktop\Adobe Photoshop CS6.lnk 2017-04-05 12:50 - 2017-02-09 11:02 - 00001089 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk 2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\Users\Public\Desktop\Audacity.lnk 2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk 2017-04-05 12:50 - 2017-02-08 13:30 - 00001483 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2017-04-05 12:50 - 2017-02-07 15:41 - 00001058 _____ C:\Users\Public\Desktop\HiSuite.lnk 2017-04-05 12:50 - 2017-01-30 18:56 - 00001148 _____ C:\Users\Public\Desktop\Overwolf.lnk 2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk 2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk 2017-04-05 12:50 - 2017-01-27 02:17 - 00001013 _____ C:\Users\Public\Desktop\Mass Effect 3.lnk 2017-04-05 12:50 - 2017-01-27 01:02 - 00000915 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk 2017-04-05 12:50 - 2017-01-26 23:23 - 00000902 _____ C:\Users\Public\Desktop\Mass Effect.lnk 2017-04-05 12:50 - 2017-01-26 21:21 - 00001060 _____ C:\Users\Public\Desktop\Origin.lnk 2017-04-05 12:50 - 2017-01-26 20:24 - 00000908 _____ C:\Users\Public\Desktop\Battle.net.lnk 2017-04-05 12:50 - 2017-01-13 01:06 - 00000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2017-04-05 12:50 - 2016-12-19 00:38 - 00000664 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontier Launchpad.lnk 2017-04-05 12:50 - 2016-11-27 13:37 - 00001371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-04-05 12:50 - 2016-11-27 13:37 - 00001353 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-04-05 12:50 - 2016-11-23 23:08 - 00000963 _____ C:\Users\Public\Desktop\MegaDownloader.lnk 2017-04-05 12:50 - 2016-11-23 22:55 - 00000842 _____ C:\Users\Public\Desktop\The Sims 3 Complete Collection.lnk 2017-04-05 12:50 - 2016-11-23 21:56 - 00000594 _____ C:\Users\Public\Desktop\Steam.lnk 2017-04-05 12:50 - 2016-11-23 21:47 - 00001755 _____ C:\Users\Public\Desktop\League of Legends.lnk 2017-04-05 12:50 - 2016-11-23 21:38 - 00001321 _____ C:\Users\Public\Desktop\Virtual CloneDrive.lnk 2017-04-05 12:50 - 2016-11-23 21:23 - 00001339 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-04-05 12:49 - 2017-03-03 11:06 - 00001662 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Online Manager.lnk 2017-04-05 12:49 - 2017-03-03 11:06 - 00001372 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Online Manager.lnk 2017-04-05 12:49 - 2017-02-04 17:21 - 00000670 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2.lnk 2017-04-05 12:49 - 2017-01-30 18:56 - 00001287 _____ C:\Users\Pascal\Desktop\TeamSpeak 3 Client.lnk 2017-04-05 12:49 - 2017-01-30 18:56 - 00001245 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk 2017-04-05 12:49 - 2017-01-28 21:47 - 00001158 _____ C:\Users\Pascal\Desktop\Cheat Engine.lnk 2017-04-05 12:49 - 2017-01-27 13:40 - 00000594 _____ C:\Users\Pascal\Desktop\Steam.lnk 2017-04-05 12:49 - 2017-01-26 20:19 - 00001278 _____ C:\Users\Pascal\Desktop\Uplay.lnk 2017-04-05 12:49 - 2017-01-07 15:48 - 00001080 _____ C:\Users\Pascal\Desktop\SpeedFan.lnk 2017-04-05 12:49 - 2017-01-02 12:36 - 00001904 _____ C:\Users\Pascal\Desktop\Roccat Kone XTD Optical.lnk 2017-04-05 12:49 - 2016-12-14 00:44 - 00001766 _____ C:\Users\Pascal\Desktop\Isku FX.lnk 2017-04-05 12:49 - 2016-12-14 00:17 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk 2017-04-05 12:49 - 2016-11-23 22:56 - 00001855 _____ C:\Users\Pascal\Desktop\Spotify.lnk 2017-04-05 12:49 - 2016-11-23 22:56 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2017-04-05 12:49 - 2016-11-23 21:54 - 00002242 _____ C:\Users\Pascal\Desktop\Discord.lnk 2017-04-05 12:49 - 2016-11-23 21:50 - 00002663 _____ C:\Users\Pascal\Desktop\µTorrent.lnk 2017-04-05 12:49 - 2016-11-23 21:14 - 00002390 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ___RD C:\Windows\PrintDialog 2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\AppReadiness 2017-04-05 11:42 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\ConnectedDevicesPlatform 2017-04-05 10:23 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\LiveKernelReports 2017-04-05 09:55 - 2016-12-18 20:53 - 00000000 ____D C:\Program Files\Microsoft Office 2017-04-04 13:53 - 2017-02-10 09:56 - 00004490 _____ C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml 2017-04-04 09:08 - 2016-12-22 00:31 - 00000000 ____D C:\Users\Pascal\Documents\My Games 2017-04-03 19:09 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\Packages 2017-04-03 16:30 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps 2017-04-03 10:15 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\spool 2017-04-02 20:22 - 2016-11-23 21:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\ElevatedDiagnostics 2017-04-02 00:28 - 2017-03-02 18:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-04-02 00:28 - 2016-12-19 23:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-03-28 20:11 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\VirtualStore 2017-03-28 14:00 - 2017-02-09 10:55 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Audacity 2017-03-26 23:21 - 2017-01-26 21:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Origin 2017-03-26 23:21 - 2017-01-26 21:19 - 00000000 ____D C:\ProgramData\Origin 2017-03-24 19:39 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client 2017-03-24 17:21 - 2017-01-30 18:56 - 00000000 ____D C:\Program Files (x86)\Overwolf 2017-03-20 20:00 - 2017-03-06 11:50 - 00000000 ____D C:\Program Files\Common Files\McAfee 2017-03-20 13:41 - 2017-03-06 11:41 - 00000000 ____D C:\ProgramData\McAfee 2017-03-20 11:35 - 2017-02-10 23:01 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\DVDVideoSoft 2017-03-19 14:06 - 2016-12-01 19:54 - 00000000 ____D C:\ProgramData\Steam 2017-03-18 22:11 - 2017-03-02 18:21 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Unity 2017-03-17 15:52 - 2017-01-26 20:19 - 00000000 ____D C:\Users\Pascal\AppData\Local\Ubisoft Game Launcher 2017-03-15 19:45 - 2016-11-23 21:12 - 00000000 ____D C:\Users\defaultuser0 2017-03-14 18:00 - 2017-02-09 11:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Sony 2017-03-14 13:08 - 2017-02-21 16:18 - 00000000 ____D C:\Users\Pascal\AppData\Local\LogMeIn Hamachi 2017-03-14 13:08 - 2017-01-23 17:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Notepad++ 2017-03-14 13:08 - 2017-01-07 15:48 - 00000000 ____D C:\Program Files (x86)\SpeedFan 2017-03-14 13:08 - 2016-11-23 22:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Skype 2017-03-14 13:08 - 2016-11-23 21:09 - 00000000 ____D C:\Windows\Panther 2017-03-14 13:04 - 2017-02-04 17:15 - 00003464 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-03-14 13:04 - 2017-01-30 18:56 - 00003304 _____ C:\Windows\System32\Tasks\Overwolf Updater Task 2017-03-14 13:02 - 2017-03-02 18:15 - 00003320 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488471357 2017-03-14 13:02 - 2017-02-08 13:29 - 00002956 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2017-02-08 13:29 - 00002838 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2017-02-08 13:29 - 00002786 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2016-12-09 22:48 - 00002772 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2 2017-03-14 13:02 - 2016-11-27 13:36 - 00003556 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-03-14 13:02 - 2016-11-27 13:36 - 00003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-03-14 11:03 - 2017-01-26 21:21 - 00000000 ____D C:\Program Files (x86)\Origin 2017-03-11 23:26 - 2017-01-26 20:24 - 00000000 ____D C:\Users\Pascal\AppData\Local\Battle.net 2017-03-11 23:26 - 2017-01-26 20:23 - 00000000 ____D C:\Program Files (x86)\Battle.net 2017-03-10 19:38 - 2016-11-23 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-03-10 07:17 - 2016-07-16 13:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-03-10 07:17 - 2016-07-16 13:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-03-09 14:22 - 2017-03-02 18:15 - 00000000 ____D C:\Program Files\Opera ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2017-02-10 09:56 - 2017-04-04 13:53 - 0004490 _____ () C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml 2017-04-04 07:50 - 2017-04-05 08:06 - 0000074 _____ () C:\Users\Pascal\AppData\Roaming\WB.CFG 2017-04-05 11:33 - 2017-04-05 11:33 - 0001357 _____ () C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk 2016-11-23 21:20 - 2016-11-23 21:20 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Dateien, die verschoben oder gelöscht werden sollten: ==================== C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job Einige Dateien in TEMP: ==================== 2017-04-05 11:10 - 2017-04-07 08:41 - 0619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll 2017-04-06 09:40 - 2017-04-06 09:40 - 14456872 _____ (Microsoft Corporation) C:\Users\Pascal\AppData\Local\Temp\vc_redist.x86.exe ==================== Bamital & volsnap ====================== (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2017-04-02 18:44 ==================== Ende von FRST.txt ============================ Frische Addition FRST Additions Logfile: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (07-04-2017 09:50:05)
Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir11112_917
Windows 10 Pro Version 1607 (X64) (2016-11-23 19:12:30)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3959254474-2508283465-2998445632-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3959254474-2508283465-2998445632-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3959254474-2508283465-2998445632-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-3959254474-2508283465-2998445632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3959254474-2508283465-2998445632-1003 - Limited - Enabled)
Pascal (S-1-5-21-3959254474-2508283465-2998445632-1001 - Administrator - Enabled) => C:\Users\Pascal
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
µTorrent (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\uTorrent) (Version: 3.4.9.43388 - BitTorrent Inc.)
3CXPhone (HKLM-x32\...\{0DF8FA4D-299C-4250-9F09-C14E47E12224}) (Version: 4.0.26523.0 - 3CX)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
AlienFX for IskuFX (HKLM-x32\...\InstallShield_{2C3FC2CC-0A8B-409E-B487-8CD54F4DC1D4}) (Version: 1.02 - Roccat GmbH)
AlienFX for IskuFX (Version: 1.02 - Roccat GmbH) Hidden
Ansel (Version: 378.78 - NVIDIA Corporation) Hidden
Aufstieg des Hexenkönigs™ (HKLM-x32\...\{B931FB80-537A-4600-00AD-AC5DEDB6C25B}) (Version: - )
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.78.7302 - BlueStack Systems, Inc.)
Brawlhalla (HKLM\...\Steam App 291550) (Version: - Blue Mammoth Games)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version: - Torn Banner Studios)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Discord (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
Epic Games Launcher (HKLM-x32\...\{4755FB10-B694-4B0F-BCDE-F390B957CD96}) (Version: 1.1.90.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
f.lux (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Flux) (Version: - )
F1 2016 (HKLM\...\Steam App 391040) (Version: - Codemasters)
FreeArc 0.666 (HKLM-x32\...\FreeArc) (Version: 0.666 - Bulat Ziganshin)
FreeStyle Football (HKLM\...\Steam App 568810) (Version: - Joycity)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
H1Z1: King of the Kill (HKLM\...\Steam App 433850) (Version: - Daybreak Game Company)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kinect for Windows Speech Recognition Language Pack (de-DE) (HKLM-x32\...\{898AA67F-99B8-4C7F-9611-B11F98EF6E78}) (Version: 11.0.7413.611 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32\...\{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32\...\{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32\...\{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32\...\{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.558 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.558 - LogMeIn, Inc.) Hidden
Mafia III (HKLM\...\Steam App 360430) (Version: - Hangar 13)
MAGIX Music Maker 2016 Premium Update (Version: 22.0.3.63 - MAGIX Software GmbH) Hidden
MAGIX Music Maker 2016 Premium Update (Version: 22.0.5.74 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Managed DirectX (0900) (x32 Version: 4.09.00.0900 - Microsoft) Hidden
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Mass Effect™ 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.2.1604.0 - Electronic Arts)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24516 (HKLM-x32\...\{c325004c-5538-45b3-a7ad-94473a4dcd3b}) (Version: 14.0.24516.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 52.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 52.0.2 (x86 de)) (Version: 52.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MTA:SA v1.5.3 (HKLM-x32\...\MTA:SA 1.5) (Version: v1.5.3 - Multi Theft Auto)
NASCAR® Racing 2003 Season (HKLM-x32\...\{ACC2E059-40E9-4464-B18D-C9BDD9A02CED}) (Version: - Sierra Entertainment)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.3.2 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 378.78 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.4.0.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.4.0.70 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.78 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.23 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.16.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 18.0.1 - OBS Project)
Online Manager (HKLM-x32\...\Online Manager) (Version: 2.02 - Deutsche Telekom AG)
Online Manager (Version: 2.02 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
Opera Stable 43.0.2442.1144 (HKLM-x32\...\Opera 43.0.2442.1144) (Version: 43.0.2442.1144 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.5.30491 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.103.44.0 - Overwolf Ltd.)
PDF24 Creator 8.1.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PES Professionals Patch 2017 V2 V2 (HKLM-x32\...\PES Professionals Patch 2017 V2 V2) (Version: V2 - PES Professionals)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DG0-PlanetSide 2) (Version: - Sony Online Entertainment)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DGC-PlanetSide 2) (Version: 1.0.3.192 - Daybreak Game Company)
Plants vs. Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
RaceRoom Racing Experience (HKLM\...\Steam App 211500) (Version: - Sector3 Studios)
Razer Chroma SDK Core Components (HKLM-x32\...\Razer Chroma SDK) (Version: 1.14.2 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.17.302 - Razer Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7936 - Realtek Semiconductor Corp.)
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
ROCCAT Isku FX Keyboard Driver (HKLM-x32\...\{DC69933C-E7B0-455D-8E54-FAC1EEF046FF}) (Version: - Roccat GmbH)
ROCCAT Kone XTD Optical Mouse Driver (HKLM-x32\...\{AD43B296-FE63-42C0-AA39-D8759B905420}) (Version: - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0015 - Roccat GmbH)
ScpToolkit (HKLM\...\{AC052048-9828-45E3-872B-04CE30A3B58B}) (Version: 1.6.238.16010 - Nefarius Software Solutions)
Scribus 1.4.6 (HKLM-x32\...\Scribus 1.4.6) (Version: 1.4.6 - The Scribus Team)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
Sid Meier's Civilization VI (HKLM\...\Steam App 289070) (Version: - Firaxis)
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Spotify (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Spotify) (Version: 1.0.52.725.g943b26a8 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SuperF4 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\SuperF4) (Version: 1.3 - Stefan Sundin)
Team Fortress 2 (HKLM\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\TeamSpeak 3 Client) (Version: 3.1.0 - TeamSpeak Systems GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
Unity Web Player (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\UnityWebPlayer) (Version: 5.3.8f1 - Unity Technologies ApS)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
VBCABLE, The Virtual Audio Cable (HKLM\...\VB:VBCABLE {87459874-1236-4469}) (Version: - VB-Audio Software)
Vegas Pro 13.0 (64-bit) (HKLM\...\{D264BD11-6A9B-11E4-A4F7-F04DA23A5C58}) (Version: 13.0.428 - Sony)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
Voicemeeter, The Virtual Mixing Console (HKLM-x32\...\VB:Voicemeeter {17359A74-1236-5467}) (Version: - VB-Audio Software)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
War Thunder (HKLM\...\Steam App 236390) (Version: - Gaijin Entertainment)
WhatsApp (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\WhatsApp) (Version: 0.2.3699 - WhatsApp)
WinISO (HKLM-x32\...\WinISO) (Version: 6.4.1.6137 - WinISO Computing Inc.)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0DDC38B9-2ABC-4047-A0EB-725D94EF2E32} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} => C:\Users\Pascal\AppData\Local\Lafesas\sync.exe
Task: {1329C2F6-C4BA-4D0B-ABCF-76C371F1440E} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-03-21] (Overwolf LTD)
Task: {2524814B-75BC-4B9E-905E-D1B4E6C034E0} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {2CB9E534-7179-4767-A507-15226E0FB1E0} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-02-23] (NVIDIA Corporation)
Task: {3E251701-C90A-4C21-905A-00FAD98BD76A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {46627DDA-595A-4E74-A24C-B72ECFA99E5E} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-02-23] (NVIDIA Corporation)
Task: {4B22C211-4B14-4CAB-A75A-C9798A378749} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {539F7043-4785-4A26-AB46-A96DF2BC3B3C} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-02-23] (NVIDIA Corporation)
Task: {5F906855-AC11-46CB-AE0F-457BE062401C} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {7F828514-1063-4857-B54D-6F287D51BEED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {8823F342-6FC1-4DB1-81FB-EE2171B3589C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {89AB2E6E-B3BF-4EA7-AF6C-08572CD29D63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {9B2F52A4-3F4F-4B00-B4E6-C770E1E72CC9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {AC1D292C-3B38-4F40-87EC-72770B25CF58} - System32\Tasks\Opera scheduled Autoupdate 1488471357 => C:\Program Files\Opera\launcher.exe [2017-02-27] (Opera Software)
Task: {B452DF3B-CC73-4F26-A9C9-9A5A4F15807F} - System32\Tasks\updater => C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpUpdater.exe [2016-01-10] (Nefarius Software Solutions)
Task: {B534A77D-568D-4D49-AE5F-C04943B3A13E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-06] (Adobe Systems Incorporated)
Task: {C2236E80-FF55-4AF3-8983-DA0EC61C4DB6} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-02-19] (Adobe Systems Incorporated)
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - System32\Tasks\Cdusmezeent Engine => C:\Program Files (x86)\Ghezeentghicay\zernly.exe
Task: {C936D059-AE7D-42A9-974D-A8BEA5AC2F63} - System32\Tasks\{BF57B4F5-D0F8-4F2C-A03D-C8454499F1F5} => pcalua.exe -a D:\eauninstall.exe -d D:\
Task: {F48C5C35-1CE4-4B3C-A780-ECDCC01B63CD} - System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} => pcalua.exe -a "C:\Program Files (x86)\Common Files\ZumFix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\ZumFix\uninstall.dat" -a uninstallme 107D25D2-8157-4685-A6F7-6B6BC6263AA7 DeviceId=3be95ac1-32fa-4efb-d976-f9ecc5042de7 BarcodeId=51557003 ChannelId=3 DistributerName=APSFWemonetize
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job =>
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2017-04-02 18:45 - 2017-04-02 18:45 - 00309760 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\ReactiveSockets\ced6a6793b1806f6dbe2e73d73a91244\ReactiveSockets.ni.dll
2014-05-02 11:52 - 2014-05-02 11:52 - 00599040 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\irrKlang.NET4.dll
2014-05-02 06:55 - 2014-05-02 06:55 - 00185344 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpflac.dll
2014-05-02 06:05 - 2014-05-02 06:05 - 00173056 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpmp3.dll
2016-11-25 08:16 - 2016-11-25 08:16 - 00192200 _____ () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
2016-09-25 01:20 - 2016-09-25 01:21 - 00189264 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-11-15 16:22 - 2016-11-15 16:22 - 08909504 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-22 11:19 - 2017-02-22 11:19 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 13:30 - 2017-02-06 13:30 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 04489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-11-23 21:41 - 2016-09-07 06:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 18:48 - 2016-12-21 09:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 53908056 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_browser.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 59948632 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_child.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 02559576 _____ () C:\Program Files\Opera\43.0.2442.1144\libglesv2.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 00100952 _____ () C:\Program Files\Opera\43.0.2442.1144\libegl.dll
2017-01-11 18:48 - 2016-12-21 08:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 18:48 - 2016-12-21 08:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-01-11 18:48 - 2016-12-21 08:47 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2017-01-26 21:21 - 2017-03-14 11:03 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 03774400 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00900032 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-11-15 16:23 - 2016-11-15 16:23 - 08909504 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-11-23 21:58 - 2017-03-10 02:13 - 00674592 _____ () E:\Neuer Ordner\SDL2.dll
2016-11-23 21:58 - 2016-09-01 03:02 - 04969248 _____ () E:\Neuer Ordner\v8.dll
2016-11-23 21:58 - 2017-03-23 02:52 - 02465056 _____ () E:\Neuer Ordner\video.dll
2016-11-23 21:58 - 2016-09-01 03:02 - 01563936 _____ () E:\Neuer Ordner\icui18n.dll
2016-11-23 21:58 - 2016-09-01 03:02 - 01195296 _____ () E:\Neuer Ordner\icuuc.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 02549760 _____ () E:\Neuer Ordner\libavcodec-56.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00491008 _____ () E:\Neuer Ordner\libavformat-56.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00332800 _____ () E:\Neuer Ordner\libavresample-2.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00442880 _____ () E:\Neuer Ordner\libavutil-54.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00485888 _____ () E:\Neuer Ordner\libswscale-3.dll
2016-11-23 21:58 - 2017-03-31 00:46 - 00848672 _____ () E:\Neuer Ordner\bin\chromehtml.DLL
2016-11-23 21:58 - 2016-07-05 00:17 - 00266560 _____ () E:\Neuer Ordner\openvr_api.dll
2016-12-14 23:21 - 2017-01-30 23:41 - 68875552 _____ () E:\Neuer Ordner\bin\cef\cef.win7\libcef.dll
2016-11-23 21:58 - 2017-03-23 02:52 - 00383776 _____ () E:\Neuer Ordner\steam.dll
2016-11-23 22:56 - 2017-04-01 14:38 - 67725936 _____ () C:\Users\Pascal\AppData\Roaming\Spotify\libcef.dll
2016-11-23 22:56 - 2017-04-01 14:38 - 00110192 _____ () C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWinRT.dll
2016-11-23 22:56 - 2017-04-01 14:38 - 01929840 _____ () C:\Users\Pascal\AppData\Roaming\Spotify\libglesv2.dll
2016-11-23 22:56 - 2017-04-01 14:38 - 00087152 _____ () C:\Users\Pascal\AppData\Roaming\Spotify\libegl.dll
2016-11-23 21:58 - 2015-09-25 01:52 - 00119208 _____ () E:\Neuer Ordner\winh264.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [432]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [432]
AlternateDataStreams: C:\Users\Pascal:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT2 [432]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 13:47 - 2017-04-07 08:59 - 00007213 ____A C:\Windows\system32\Drivers\etc\hosts
xl.c
92.53.119.169 aax.amazon-adsystem.com
92.53.119.169 ad.crwdcntrl.net
92.53.119.169 ad.mail.ru
92.53.119.169 ade.clmbtech.com
92.53.119.169 ads.adfox.ru
92.53.119.169 ads.pubmatic.com
92.53.119.169 apis.google.com
92.53.119.169 asset.pagefair.net
92.53.119.169 assets.adobedtm.com
92.53.119.169 assets.flocktory.com
92.53.119.169 autocontext.begun.ru
92.53.119.169 b.grvcdn.com
92.53.119.169 b.ns1p.net
92.53.119.169 b.scorecardresearch.com
92.53.119.169 b.wal.co
92.53.119.169 babator-stg-cdn.babator.com
92.53.119.169 beacon.krxd.net
92.53.119.169 beacon.walmart.com
92.53.119.169 c.amazon-adsystem.com
92.53.119.169 c.vepxl1.net
92.53.119.169 c2.taboola.com
92.53.119.169 cdn.3lift.com
92.53.119.169 cdn.admixer.net
92.53.119.169 cdn.brcdn.com
92.53.119.169 cdn.cxense.com
92.53.119.169 cdn.interactivemedia.ne
92.53.119.169 cdn.krxd.net
92.53.119.169 cdn.lenmit.com
92.53.119.169 cdn.livefyre.com
92.53.119.169 cdn.m-pathy.com
92.53.119.169 cdn.mathjax.org
92.53.119.169 cdn.mxpnl.com
92.53.119.169 cdn.onthe.io
92.53.119.169 cdn.optimizely.com
92.53.119.169 cdn.prom.st
92.53.119.169 cdn.pushwoosh.com
92.53.119.169 cdn.scarabresearch.com
92.53.119.169 cdn.taboola.com
92.53.119.169 cdn.taplytics.com
92.53.119.169 cdn.tt.omtrdc.net
92.53.119.169 cdn.unid.go.com
92.53.119.169 cdn1.graphiq.com
92.53.119.169 cdn3.optimizely.com
92.53.119.169 cdnjs.cloudflare.com
92.53.119.169 cdnssl.clicktale.net
92.53.119.169 comet.yahoo.com
92.53.119.169 consent.truste.com
92.53.119.169 content.adriver.ru
92.53.119.169 contextual.media.net
92.53.119.169 cstatic.weborama.fr
92.53.119.169 d134l0cdryxgwa.cloudfront.net
92.53.119.169 d2oh4tlt9mrke9.cloudfront.net
92.53.119.169 dpm.demdex.net
92.53.119.169 e.monetate.net
92.53.119.169 edge.quantserve.com
92.53.119.169 edx-uk.s3ae.com
92.53.119.169 eu-services.babator.com
92.53.119.169 fc.yahoo.com
92.53.119.169 gaua.hit.gemius.pl
92.53.119.169 gde-default.hit.gemius.pl
92.53.119.169 go.flx1.com
92.53.119.169 googleadservices.com
92.53.119.169 hpr.outbrain.com
92.53.119.169 i.cricketcb.com
92.53.119.169 i.tfag.de
92.53.119.169 ib.adnxs.com
92.53.119.169 imagesrv.adition.com
92.53.119.169 img.imgsmail.ru
92.53.119.169 img7.auto.ria.com
92.53.119.169 j.ophan.co.uk
92.53.119.169 js-agent.newrelic.com
92.53.119.169 js-sec.indexww.com
92.53.119.169 js.revsci.net
92.53.119.169 js.ui-portal.de
92.53.119.169 kamradamnaradost.ru
92.53.119.169 kpmediagaua.hit.gemius.pl
92.53.119.169 level1cdn.com
92.53.119.169 mc.yandex.ru
92.53.119.169 ml314.com
92.53.119.169 mtrx.go.sonobi.com
92.53.119.169 ninja.onap.io
92.53.119.169 o.aolcdn.com
92.53.119.169 odb.outbrain.com
92.53.119.169 ok-bar.love.mail.ru
92.53.119.169 ok-portal.mail.ru
92.53.119.169 optimize-stats.voxmedia.com
92.53.119.169 p.d.0fmm.com
92.53.119.169 p.t-online.de
92.53.119.169 pagead2.googlesyndication.com
92.53.119.169 peermapcontent.affino.com
92.53.119.169 pixel.vihub.ru
92.53.119.169 psma02.com
92.53.119.169 px.adhigh.net
92.53.119.169 qs.ioam.de
92.53.119.169 qsc.ec.quoracdn.net
92.53.119.169 rma-api.gravity.com
92.53.119.169 rtax.criteo.com
92.53.119.169 rum-static.pingdom.net
Da befinden sich 51 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pascal\Pictures\Cool_Desktop_Wallpapers_with_Nvidia_Logo_in_Black_and_Green-1360x768.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
HKLM\...\StartupApproved\Run32: => "avgnt"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Gaijin.Net Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "SuperF4"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "f.lux"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{6DC6B0E4-B86F-453F-AFA5-E4839E53DD7D}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{D4D10190-59E1-4A96-8D8E-793DDBB2D763}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{772F321C-16DF-4C1F-A0F6-63CAF831811D}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{BEA8259B-7D01-44A2-9FF6-25124EF224D2}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{FAACF73E-D625-44CD-853F-891509F551B2}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{D2B0BC15-D518-4585-AB3E-47A7700B4AA4}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{C50678ED-E3F3-4AA3-9A6C-3069F6CDB719}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{EFACD55C-979F-4E4B-9AF0-A7CC9B48F74B}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [{786F89FF-F2FB-4A85-84B2-4F898D864FE0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C1742883-8941-45F2-82B9-1B8B0F61BEDF}] => (Allow) E:\Neuer Ordner\steamapps\common\raceroom racing experience\Game\RRRE.exe
FirewallRules: [{3D0688FE-93E6-4EC5-A9B5-11A76ED78EE2}] => (Allow) E:\Neuer Ordner\steamapps\common\raceroom racing experience\Game\RRRE.exe
FirewallRules: [{6F9BFF74-4F15-4341-9A26-F539806A6533}] => (Allow) C:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{30C1139A-BA19-4896-BB0A-AC98B9382624}] => (Allow) C:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{A4EF5ED2-6304-465C-AED6-2A1FDB88FCD2}] => (Allow) C:\Steam\steamapps\common\H1Z1 King of the Kill\LaunchPad.exe
FirewallRules: [{5A4D8DCF-15F6-4093-9397-4B3265D602D2}] => (Allow) C:\Steam\steamapps\common\H1Z1 King of the Kill\LaunchPad.exe
==================== Wiederherstellungspunkte =========================
24-03-2017 20:48:55 Geplanter Prüfpunkt
01-04-2017 20:18:07 DirectX wurde installiert
03-04-2017 20:19:35 DirectX wurde installiert
05-04-2017 11:29:54 Nach dem Adware angriff
05-04-2017 21:27:17 JRT Pre-Junkware Removal
06-04-2017 12:10:51 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:12:08 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:12:28 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:33:01 Malwarebytes Anti-Rootkit Restore Point
06-04-2017 13:21:55 Malwarebytes Anti-Rootkit Restore Point
06-04-2017 16:26:21 Malwarebytes Anti-Rootkit Restore Point
07-04-2017 08:46:33 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: LogMeIn Hamachi Virtual Ethernet Adapter
Description: LogMeIn Hamachi Virtual Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn Inc.
Service: Hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (04/07/2017 08:46:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/07/2017 08:42:01 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
Error: (04/06/2017 11:06:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-NBS516K)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/06/2017 04:26:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 01:21:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:33:02 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:12:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:12:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:10:52 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:10:51 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {89d4ce73-1e2f-4d63-ad14-2ae1496a1e1b}
Systemfehler:
=============
Error: (04/07/2017 08:46:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PDF24" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/07/2017 08:46:45 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/07/2017 08:41:15 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 11:06:41 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-NBS516K)
Description: Der Server "App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (04/06/2017 11:06:41 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 04:04:43 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 01:30:29 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 01:12:09 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 01:11:22 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (04/06/2017 01:11:22 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0
CodeIntegrity:
===================================
Date: 2017-04-06 13:11:21.599
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 12:14:31.647
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 11:53:07.421
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:53:07.410
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.426
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.356
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:57:49.637
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 08:12:41.630
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:41.560
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:07.830
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 24%
Installierter physikalischer RAM: 16321.99 MB
Verfügbarer physikalischer RAM: 12367.29 MB
Summe virtueller Speicher: 18753.99 MB
Verfügbarer virtueller Speicher: 14460.16 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:232.44 GB) (Free:92.37 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.41 GB) (Free:129.16 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C802C2A9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C802C2D1)
Partition 1: (Not Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
07.04.2017, 10:02
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Nach Adware Angriff,Hijack.Host Lade Dir bitte von hier
__________________ Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
__________________ |
|
07.04.2017, 10:46
| #18 |
| | Nach Adware Angriff,Hijack.Host Getan.
__________________ |
|
07.04.2017, 11:39
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [VHMHR88UKJGKO0T] => "C:\Program Files\SH8GW5V5VQ\SH8GW5V5V.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [6159] => "C:\Users\Pascal\AppData\Roaming\45786296\827204.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [ruOj4cTpe+.exe] => C:\Program Files\Microsoft Office\XCR5RZM7N2TK0\ruOj4cTpe+.exe -r1_5 -r2_1
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [UMRTDY6K0MWO87K] => "C:\Program Files\LZAE7O812S\LZAE7O812.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [5LDEE8ZQ7YU0R81] => "C:\Program Files\R825KEPMNZ\R825KEPMN.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [OPKXB4WC5AAA46E] => "C:\Program Files\V389U12JRN\V389U12JR.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [W55ARE7PITE99EB] => "C:\Program Files\L9X4M63QIN\L9X4M63QI.exe"
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Keine Datei
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt
SearchScopes: HKU\S-1-5-21-3959254474-2508283465-2998445632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Winsock: Catalog5-x64 05 C:\Windows\system32\NSBlockA.dll => Keine Datei <===== ACHTUNG
Winsock: Catalog5-x64 08 C:\Windows\system32\NSBlockB.dll => Keine Datei <===== ACHTUNG
CHR HomePage: ChromeDefaultData2 -> https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkOOmCCYjHgvUD8zQEC2onXZ0flEr-hZWd-RsmvP_SOpJeDvIzZP42wPMaHzmlcwF5M2qhrDaNB_0LXaMiqZuPt8E_yuCQj_6tziC2-4Yiln3v_mF3_BbWZUEu8CFqbQehiNhUZhTVLvtVv-RuFDbrzEm355f3f06ikvqBZITQ,,
CHR StartupUrls: ChromeDefaultData2 -> "http://www.youndoo.com/?z=6387f3cc1cb544525b2e38agdz9t8g1c5m0t0ebe5o&from=amz&uid=ST1000DM003-1SB102_Z9A3CK7CXXXXZ9A3CK7C&type=hp"
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-04-07] <==== ACHTUNG
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [432]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [432]
AlternateDataStreams: C:\Users\Pascal:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT2 [432]
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
HKLM\...\StartupApproved\Run32: => "avgnt"
C:\Program Files\SH8GW5V5VQ
C:\Program Files\Microsoft Office\XCR5RZM7N2TK0
C:\Users\Pascal\AppData\Roaming\45786296
C:\Program Files\LZAE7O812S
C:\Program Files\R825KEPMNZ
C:\Program Files\V389U12JRN
C:\Program Files\L9X4M63QIN
C:\Windows\system32\NSBlockA.dll
C:\Windows\system32\NSBlockB.dll
C:\Program Files\ZMWCF16IVP
C:\Program Files (x86)\Avira
C:\ProgramData\Avira
C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe
C:\Program Files\SUSG1LUFVL
C:\Program Files\ZOTH2H4HUY
C:\Program Files\NYCW0JIKE4
C:\Users\Pascal\Downloads\Thumbs.db
C:\Program Files\MTSV8KJOJA
C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048
C:\Users\Pascal\AppData\Roaming\Dkulyjegerward
C:\Windows\System32\Tasks\Cdusmezeent Engine
C:\Users\Pascal\AppData\Local\Lafesas
C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job
C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}
hosts:
emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.04.2017, 11:57
| #20 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (07-04-2017 12:53:08) Run:1
Gestartet von C:\Users\Pascal\Desktop
Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [VHMHR88UKJGKO0T] => "C:\Program Files\SH8GW5V5VQ\SH8GW5V5V.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [6159] => "C:\Users\Pascal\AppData\Roaming\45786296\827204.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [ruOj4cTpe+.exe] => C:\Program Files\Microsoft Office\XCR5RZM7N2TK0\ruOj4cTpe+.exe -r1_5 -r2_1
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [UMRTDY6K0MWO87K] => "C:\Program Files\LZAE7O812S\LZAE7O812.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [5LDEE8ZQ7YU0R81] => "C:\Program Files\R825KEPMNZ\R825KEPMN.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [OPKXB4WC5AAA46E] => "C:\Program Files\V389U12JRN\V389U12JR.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [W55ARE7PITE99EB] => "C:\Program Files\L9X4M63QIN\L9X4M63QI.exe"
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Keine Datei
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://search.avira.net/#/?show_is=1&source=art
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://search.avira.net/#/?show_is=1&source=art
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt
SearchScopes: HKU\S-1-5-21-3959254474-2508283465-2998445632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Winsock: Catalog5-x64 05 C:\Windows\system32\NSBlockA.dll => Keine Datei <===== ACHTUNG
Winsock: Catalog5-x64 08 C:\Windows\system32\NSBlockB.dll => Keine Datei <===== ACHTUNG
CHR HomePage: ChromeDefaultData2 -> https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkOOmCCYjHgvUD8zQEC2onXZ0flEr-hZWd-RsmvP_SOpJeDvIzZP42wPMaHzmlcwF5M2qhrDaNB_0LXaMiqZuPt8E_yuCQj_6tziC2-4Yiln3v_mF3_BbWZUEu8CFqbQehiNhUZhTVLvtVv-RuFDbrzEm355f3f06ikvqBZITQ,,
CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.youndoo.com/?z=6387f3cc1cb544525b2e38agdz9t8g1c5m0t0ebe5o&from=amz&uid=ST1000DM003-1SB102_Z9A3CK7CXXXXZ9A3CK7C&type=hp"
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-04-07] <==== ACHTUNG
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [432]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [432]
AlternateDataStreams: C:\Users\Pascal:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT2 [432]
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
HKLM\...\StartupApproved\Run32: => "avgnt"
C:\Program Files\SH8GW5V5VQ
C:\Program Files\Microsoft Office\XCR5RZM7N2TK0
C:\Users\Pascal\AppData\Roaming\45786296
C:\Program Files\LZAE7O812S
C:\Program Files\R825KEPMNZ
C:\Program Files\V389U12JRN
C:\Program Files\L9X4M63QIN
C:\Windows\system32\NSBlockA.dll
C:\Windows\system32\NSBlockB.dll
C:\Program Files\ZMWCF16IVP
C:\Program Files (x86)\Avira
C:\ProgramData\Avira
C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe
C:\Program Files\SUSG1LUFVL
C:\Program Files\ZOTH2H4HUY
C:\Program Files\NYCW0JIKE4
C:\Users\Pascal\Downloads\Thumbs.db
C:\Program Files\MTSV8KJOJA
C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048
C:\Users\Pascal\AppData\Roaming\Dkulyjegerward
C:\Windows\System32\Tasks\Cdusmezeent Engine
C:\Users\Pascal\AppData\Local\Lafesas
C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job
C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}
hosts:
emptytemp:
*****************
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\VHMHR88UKJGKO0T => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\6159 => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ruOj4cTpe+.exe => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UMRTDY6K0MWO87K => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\5LDEE8ZQ7YU0R81 => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OPKXB4WC5AAA46E => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Windows\CurrentVersion\Run\\W55ARE7PITE99EB => Wert erfolgreich entfernt
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => Schlüssel erfolgreich entfernt
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => Schlüssel nicht gefunden.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Wert erfolgreich wiederhergestellt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Wert erfolgreich wiederhergestellt
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Wert erfolgreich wiederhergestellt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Wert erfolgreich wiederhergestellt
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wert erfolgreich wiederhergestellt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wert erfolgreich wiederhergestellt
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wert erfolgreich wiederhergestellt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wert erfolgreich wiederhergestellt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Wert erfolgreich wiederhergestellt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache => Wert erfolgreich entfernt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wert erfolgreich wiederhergestellt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wert erfolgreich wiederhergestellt
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich wiederhergestellt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich wiederhergestellt
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000005 => Schlüssel erfolgreich entfernt
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000008 => Schlüssel erfolgreich entfernt
Chrome HomePage => erfolgreich entfernt
Chrome StartupUrls => erfolgreich entfernt
C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 => erfolgreich verschoben
C:\ProgramData => ":NT" ADS erfolgreich entfernt.
C:\ProgramData => ":NT2" ADS erfolgreich entfernt.
"C:\Users\All Users" => ":NT" ADS nicht gefunden.
"C:\Users\All Users" => ":NT2" ADS nicht gefunden.
C:\Users\Pascal => ":Heroes & Generals" ADS erfolgreich entfernt.
"C:\ProgramData\Anwendungsdaten" => ":NT" ADS nicht gefunden.
"C:\ProgramData\Anwendungsdaten" => ":NT2" ADS nicht gefunden.
C:\ProgramData\MTA San Andreas All => ":NT" ADS erfolgreich entfernt.
C:\ProgramData\MTA San Andreas All => ":NT2" ADS erfolgreich entfernt.
C:\Users\Pascal\Anwendungsdaten => ":NT" ADS erfolgreich entfernt.
C:\Users\Pascal\Anwendungsdaten => ":NT2" ADS erfolgreich entfernt.
"C:\Users\Pascal\AppData\Roaming" => ":NT" ADS nicht gefunden.
"C:\Users\Pascal\AppData\Roaming" => ":NT2" ADS nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\Avira SystrayStartTrigger => Wert erfolgreich entfernt
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Avira SystrayStartTrigger => Wert nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\avgnt => Wert erfolgreich entfernt
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\avgnt => Wert nicht gefunden.
"C:\Program Files\SH8GW5V5VQ" => nicht gefunden.
C:\Program Files\Microsoft Office\XCR5RZM7N2TK0 => erfolgreich verschoben
"C:\Users\Pascal\AppData\Roaming\45786296" => nicht gefunden.
"C:\Program Files\LZAE7O812S" => nicht gefunden.
"C:\Program Files\R825KEPMNZ" => nicht gefunden.
"C:\Program Files\V389U12JRN" => nicht gefunden.
"C:\Program Files\L9X4M63QIN" => nicht gefunden.
"C:\Windows\system32\NSBlockA.dll" => nicht gefunden.
"C:\Windows\system32\NSBlockB.dll" => nicht gefunden.
C:\Program Files\ZMWCF16IVP => erfolgreich verschoben
C:\Program Files (x86)\Avira => erfolgreich verschoben
C:\ProgramData\Avira => erfolgreich verschoben
C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe => erfolgreich verschoben
C:\Program Files\SUSG1LUFVL => erfolgreich verschoben
C:\Program Files\ZOTH2H4HUY => erfolgreich verschoben
C:\Program Files\NYCW0JIKE4 => erfolgreich verschoben
C:\Users\Pascal\Downloads\Thumbs.db => erfolgreich verschoben
C:\Program Files\MTSV8KJOJA => erfolgreich verschoben
C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048 => erfolgreich verschoben
C:\Users\Pascal\AppData\Roaming\Dkulyjegerward => erfolgreich verschoben
C:\Windows\System32\Tasks\Cdusmezeent Engine => erfolgreich verschoben
C:\Users\Pascal\AppData\Local\Lafesas => erfolgreich verschoben
C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job => erfolgreich verschoben
C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} => erfolgreich verschoben
C:\Windows\System32\Drivers\etc\hosts => erfolgreich verschoben
Hosts erfolgreich wiederhergestellt.
=========== EmptyTemp: ==========
BITS transfer queue => 838850 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 35522222 B
Java, Flash, Steam htmlcache => 161402389 B
Windows/system/drivers => 341545151 B
Edge => 67668561 B
Chrome => 0 B
Firefox => 383346640 B
Opera => 279592385 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 29348 B
NetworkService => 103788 B
defaultuser0 => 7296 B
Pascal => 299014766 B
RecycleBin => 4689 B
EmptyTemp: => 1.5 GB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 12:55:04 ====
|
|
07.04.2017, 12:27
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken
__________________ --> Nach Adware Angriff,Hijack.Host |
|
07.04.2017, 13:09
| #22 |
| | Nach Adware Angriff,Hijack.Host FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Pascal (Administrator) auf DESKTOP-NBS516K (07-04-2017 14:05:22)
Gestartet von C:\Users\Pascal\Desktop
Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Razer Inc) C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper64.exe
() C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe
(Razer, Inc.) C:\Users\Pascal\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\rzcefrenderprocess.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe
(TeamSpeak Systems GmbH) C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client\ts3client_win64.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\0.103.44.0\OverwolfTSHelper.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Valve Corporation) E:\Neuer Ordner\Steam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Valve Corporation) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Codemasters Software Company Limited) E:\Neuer Ordner\steamapps\common\F1 2016\F1_2016.exe
(Valve Corporation) E:\Neuer Ordner\GameOverlayUI.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16696840 2016-09-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2013-12-17] (AVM Berlin)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RoccatIskuFX] => C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe [540672 2014-10-19] (ROCCAT GmbH)
HKLM-x32\...\Run: [RoccatKoneXTDOptical] => C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.EXE [552960 2014-04-14] (ROCCAT GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.)
HKLM-x32\...\Run: [Kraken71ChromaHelper] => C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe [1600096 2017-02-14] (Razer Inc)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Discord] => C:\Users\Pascal\AppData\Local\Discord\app-0.0.297\Discord.exe [64290304 2017-01-04] (Hammer & Chisel, Inc.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Steam] => E:\Neuer Ordner\steam.exe [3019552 2017-03-23] (Valve Corporation)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Spotify Web Helper] => C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-01] (Spotify Ltd)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [1690248 2016-12-01] (BlueStack Systems, Inc.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Gaijin.Net Agent] => C:\Users\Pascal\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [1912840 2017-02-19] ()
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3044816 2017-03-14] (Electronic Arts)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] ()
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\Dxtory Software\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [f.lux] => C:\Users\Pascal\AppData\Local\FluxSoftware\Flux\flux.exe [1024240 2016-12-06] (Flux Software LLC)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [SuperF4] => C:\Users\Pascal\AppData\Roaming\SuperF4\SuperF4.exe [40960 2015-08-24] (Stefan Sundin)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Chromium] => c:\users\pascal\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27545048 2017-03-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {0e0919c9-b364-11e6-a29d-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {bd04f186-b1b0-11e6-a29a-7085c209549d} - "G:\pushinst.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa05-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa2a-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa3f-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c75a8-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c7cb1-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk [2017-04-05]
ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScpToolkit Tray Notifications.lnk [2017-04-05]
ShortcutTarget: ScpToolkit Tray Notifications.lnk -> C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe (Scarlet.Crush Productions)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{da0d42d9-18de-4b46-bcb2-42561cb5aa05}: [DhcpNameServer] 192.168.2.1
ManualProxies:
Internet Explorer:
==================
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605 [2017-04-07]
FF Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-04-05]
FF Extension: (Disable Prefetch) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\features\{54afb0fe-8646-4f03-a4d4-2020d0431a86}\disable-prefetch@mozilla.org.xpi [2017-04-05]
FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-29] [ist nicht signiert]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-04-06] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-04-06] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-11-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-23] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-23] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin HKU\S-1-5-21-3959254474-2508283465-2998445632-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-09] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-11-15] (Microsoft Corporation)
StartMenuInternet: FIREFOX.EXE - firefox.exe
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2017-04-05]
Chrome:
=======
CHR DefaultProfile: ChromeDefaultData2
CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - Chrome.exe
Opera:
=======
OPR Extension: (VK+OK AdBlock) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\fgfffefkfpmbjmhofnofmiikiolcbhll [2017-04-05]
OPR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-04-05]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] ()
S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [486936 2016-12-01] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [470552 2016-12-01] (BlueStack Systems, Inc.)
S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [511512 2016-12-01] (BlueStack Systems, Inc.)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-02-08] (Digital Wave Ltd.)
R2 Ds3Service; C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe [389632 2016-01-10] (Scarlet.Crush Productions) [Datei ist nicht signiert]
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395024 2017-01-19] (EasyAntiCheat Ltd)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-11-25] ()
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-23] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-02-23] (NVIDIA Corporation)
R2 Online Manager Service; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe [3076096 2016-09-21] (Deutsche Telekom AG) [Datei ist nicht signiert]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2123240 2017-03-14] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184688 2017-03-14] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD)
R2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH)
R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69768 2017-02-15] (Razer Inc.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] ()
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s [X]
S2 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2013-12-17] (AVM Berlin)
S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-12-01] (BlueStack Systems)
S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-11-08] (Bluestack System Inc. )
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 FairplayKD; C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [78856 2017-02-12] (Multi Theft Auto)
R3 fwlanusb6; C:\Windows\system32\DRIVERS\fwlanusb6.sys [1327744 2014-03-27] (AVM GmbH)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2017-02-02] (LogMeIn Inc.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-11-25] (Huawei Technologies Co., Ltd.)
R3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-04-01] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys [14569528 2017-02-24] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2017-02-23] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47672 2017-01-20] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [59448 2017-02-23] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWOW64\DRIVERS\papycpu2.sys [1984 2003-01-17] () [Datei ist nicht signiert]
S0x01000000 papyjoy; C:\Windows\SysWOW64\DRIVERS\papyjoy.sys [1856 2003-01-17] () [Datei ist nicht signiert]
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.)
R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 TelekomNM6; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 VBAudioVACMME; C:\Windows\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider)
R3 VBAudioVMVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2017-02-10] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2016-10-20] (WinISO.com)
S3 xhunter1; C:\Windows\xhunter1.sys [36832 2017-04-01] (Wellbia.com Co., Ltd.)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-04-07 14:05 - 2017-04-07 14:05 - 00022035 _____ C:\Users\Pascal\Desktop\FRST.txt
2017-04-07 12:53 - 2017-04-07 12:55 - 00013047 _____ C:\Users\Pascal\Desktop\Fixlog.txt
2017-04-07 12:53 - 2017-04-06 11:54 - 02424832 _____ (Farbar) C:\Users\Pascal\Desktop\FRST64.exe
2017-04-07 11:43 - 2017-04-07 11:43 - 00001079 _____ C:\Users\Public\Desktop\Revo Uninstaller.lnk
2017-04-07 08:47 - 2017-04-07 08:47 - 00000547 _____ C:\Users\Pascal\Desktop\JRT.txt
2017-04-06 12:23 - 2017-04-06 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-04-06 12:22 - 2017-04-06 12:22 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001 (1).exe
2017-04-06 12:10 - 2017-04-07 11:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-04-06 12:10 - 2017-04-06 12:10 - 07097928 _____ (VS Revo Group ) C:\Users\Pascal\Downloads\revo202setup.exe
2017-04-06 12:10 - 2017-04-06 12:10 - 00000000 ____D C:\Program Files\VS Revo Group
2017-04-06 11:55 - 2017-04-07 14:05 - 00000000 ____D C:\FRST
2017-04-06 11:54 - 2017-04-06 11:54 - 02424832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381248740.pdf
2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381243888.pdf
2017-04-06 11:16 - 2017-04-06 12:40 - 00000000 ____D C:\Users\Pascal\Desktop\Bilder
2017-04-06 09:47 - 2017-04-06 09:47 - 00004466 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-04-06 09:35 - 2017-04-06 12:14 - 00000000 ____D C:\Program Files\Common Files\AV
2017-04-06 09:34 - 2017-04-06 12:39 - 00000000 ____D C:\Users\Pascal\Desktop\Schutz
2017-04-06 09:34 - 2017-04-06 12:14 - 00000000 ____D C:\ProgramData\AVAST Software
2017-04-06 09:34 - 2017-04-06 09:34 - 06654960 _____ (AVAST Software) C:\Users\Pascal\Downloads\avast_free_antivirus_setup_online.exe
2017-04-06 08:15 - 2017-04-06 12:13 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WhatsApp
2017-04-06 08:15 - 2017-04-06 08:15 - 00002292 _____ C:\Users\Pascal\Desktop\WhatsApp.lnk
2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Local\WhatsApp
2017-04-06 08:13 - 2017-04-06 08:13 - 01496584 _____ C:\Users\Pascal\Downloads\WhatsApp3699Setup - CHIP-Installer.exe
2017-04-06 07:56 - 2017-04-06 07:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Eric_Zhang
2017-04-05 21:24 - 2017-04-07 08:46 - 01663904 _____ (Malwarebytes) C:\Users\Pascal\Downloads\JRT.exe
2017-04-05 21:21 - 2017-04-05 21:21 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001.exe
2017-04-05 13:39 - 2017-04-05 13:39 - 00001157 _____ C:\Users\Public\Desktop\PDF24.lnk
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Users\Pascal\AppData\Local\PDF24
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Program Files (x86)\PDF24
2017-04-05 13:38 - 2017-04-05 13:38 - 01496584 _____ C:\Users\Pascal\Downloads\PDF24 Creator - CHIP-Installer.exe
2017-04-05 13:36 - 2017-04-05 13:36 - 00038301 _____ C:\Users\Pascal\Downloads\images.pdf
2017-04-05 13:09 - 2017-04-05 13:09 - 00001154 _____ C:\Users\Pascal\Desktop\Opera.lnk
2017-04-05 12:45 - 2017-04-05 13:36 - 00000000 ____D C:\Users\Pascal\Desktop\Bewerbung
2017-04-05 12:22 - 2017-04-07 08:49 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-04-05 12:22 - 2017-04-06 16:15 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2017-04-05 12:22 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-04-05 12:22 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2017-04-05 12:18 - 2017-04-05 21:14 - 00000000 ____D C:\Users\Pascal\Documents\Anti
2017-04-05 12:18 - 2017-04-05 21:12 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\uTorrent
2017-04-05 11:55 - 2017-04-05 11:55 - 00003738 _____ C:\Windows\System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B}
2017-04-05 11:46 - 2017-04-05 11:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\CrashDumps
2017-04-05 11:40 - 2017-04-05 11:40 - 00000000 ____D C:\Users\Pascal\AppData\Local\PeerDistRepub
2017-04-05 11:38 - 2017-04-05 11:39 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe
2017-04-05 11:33 - 2017-04-05 11:33 - 00001357 _____ C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk
2017-04-05 11:06 - 2017-04-07 08:44 - 00000000 ____D C:\AdwCleaner
2017-04-05 11:06 - 2017-04-05 21:23 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045.exe
2017-04-05 10:37 - 2017-04-05 21:25 - 00000008 __RSH C:\Users\Pascal\ntuser.pol
2017-04-05 09:59 - 2017-04-05 09:59 - 00720033 _____ C:\Windows\unins000.exe
2017-04-05 09:59 - 2017-04-05 09:59 - 00042558 _____ C:\Windows\unins000.dat
2017-04-05 09:57 - 2017-04-05 10:06 - 00000000 ____D C:\Windows\system32\SSL
2017-04-05 09:56 - 2017-04-05 09:56 - 00000000 ____D C:\Windows\system32\sstmp
2017-04-04 19:21 - 2017-04-04 19:21 - 00000783 _____ C:\Users\Pascal\Downloads\Cyber Dragons (Jermaine Leach).ydk
2017-04-04 19:19 - 2017-04-04 19:19 - 00000798 _____ C:\Users\Pascal\Downloads\Barian Warrior Rank 4 (Sercan Tepeler).ydk
2017-04-04 19:17 - 2017-04-04 19:17 - 00000748 _____ C:\Users\Pascal\Downloads\Crystron (Berkay Gündar).ydk
2017-04-04 19:17 - 2017-04-04 19:17 - 00000745 _____ C:\Users\Pascal\Downloads\Blackwing Quasar (Samed Yazar).ydk
2017-04-04 19:16 - 2017-04-04 19:16 - 00000746 _____ C:\Users\Pascal\Downloads\D_D_D's (Emre Canyurt).ydk
2017-04-04 19:06 - 2017-04-04 19:06 - 00000762 _____ C:\Users\Pascal\Downloads\Darklords (Lucas Bartolomeu De Oliveira).ydk
2017-04-04 19:01 - 2017-04-04 19:01 - 00000750 _____ C:\Users\Pascal\Downloads\D_D Yang Zings (Giannis Feidakis).ydk
2017-04-04 19:01 - 2017-04-04 19:01 - 00000744 _____ C:\Users\Pascal\Downloads\PSY-Frames (Nick Dietz).ydk
2017-04-04 12:25 - 2017-04-04 12:34 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted Backups
2017-04-04 09:00 - 2017-04-04 09:11 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted
2017-04-04 08:58 - 2017-04-04 08:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed Most Wanted 2005
2017-04-04 07:50 - 2017-04-05 08:06 - 00000074 _____ C:\Users\Pascal\AppData\Roaming\WB.CFG
2017-04-03 20:24 - 2017-04-03 20:24 - 00013824 ___SH C:\Users\Pascal\Desktop\Thumbs.db
2017-04-03 20:22 - 2017-04-03 20:22 - 00000000 ____D C:\ProgramData\PopCap Games
2017-04-03 20:20 - 2017-04-03 20:20 - 00000000 ____D C:\Users\Pascal\Desktop\CUE In ISO
2017-04-03 20:19 - 2017-04-05 12:49 - 00002388 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
2017-04-03 20:17 - 2017-04-03 20:17 - 07898096 _____ (WinISO Computing Inc.) C:\Users\Pascal\Downloads\winiso.exe
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WinISO Computing
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Local\WinISO Computing
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Program Files (x86)\WinISO Computing
2017-04-03 20:17 - 2016-10-20 17:13 - 00204032 _____ (WinISO.com) C:\Windows\system32\Drivers\WinisoCDBus.sys
2017-04-02 20:21 - 2017-04-02 20:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\One Finger Death Punch 1.0
2017-04-02 19:35 - 2017-04-02 19:35 - 00000000 ____D C:\Users\Public\Documents\Team17
2017-04-02 19:33 - 2017-04-02 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Worms W.M.D. [GOG.com]
2017-04-02 19:20 - 2017-04-02 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One
2017-04-02 12:21 - 2017-04-02 12:21 - 00000000 ____D C:\ProgramData\Nefarius Software Solutions
2017-04-01 20:32 - 2017-04-01 20:33 - 00000000 ____D C:\Users\Pascal\Desktop\PS3 Controller
2017-04-01 20:27 - 2017-04-05 21:25 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-04-01 20:27 - 2017-04-01 20:27 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbK.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00083552 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusbK.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2017-04-01 20:27 - 2017-04-01 20:27 - 00047200 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusbK.sys
2017-04-01 20:26 - 2017-04-01 20:26 - 00003960 _____ C:\Windows\System32\Tasks\updater
2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScpToolkit
2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\Program Files\Nefarius Software Solutions
2017-04-01 20:25 - 2017-04-01 20:25 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Nefarius Software Solutions
2017-04-01 20:24 - 2017-04-01 20:25 - 23361996 _____ (Nefarius Software Solutions) C:\Users\Pascal\Downloads\ScpToolkit_Setup.exe
2017-04-01 20:18 - 2017-04-05 12:50 - 00000687 _____ C:\Users\Public\Desktop\The Saboteur.lnk
2017-04-01 20:18 - 2017-04-01 20:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Saboteur [GOG.com]
2017-04-01 20:17 - 2017-04-05 09:56 - 00000000 ____D C:\Program Files\MotioninJoy
2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\MotioninJoy
2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2017-04-01 20:17 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2017-04-01 20:16 - 2012-05-12 06:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Pascal\Downloads\MotioninJoy_071001_signed.exe
2017-04-01 20:12 - 2017-04-01 20:12 - 00000000 ____D C:\Users\Pascal\AppData\Local\BetterDS3
2017-04-01 20:11 - 2017-04-01 20:11 - 00759932 _____ C:\Users\Pascal\Downloads\BetterDS3_1.5.3.zip
2017-04-01 20:11 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Pascal\Downloads\Better DS3.exe
2017-04-01 20:10 - 2017-04-01 20:10 - 01496584 _____ C:\Users\Pascal\Downloads\Better DS3 - CHIP-Installer.exe
2017-04-01 16:47 - 2017-04-01 16:47 - 00000947 _____ C:\Users\Pascal\Downloads\60-Card Infernoid Zoodiacs (Ryan Murakami).ydk
2017-03-29 21:58 - 2017-03-29 21:58 - 00000732 _____ C:\Users\Pascal\Downloads\Chain Burn (Jameson Mcgranahan).ydk
2017-03-29 21:57 - 2017-03-29 21:57 - 00000749 _____ C:\Users\Pascal\Downloads\Dark Synchro (Duelist Unknown).ydk
2017-03-29 21:56 - 2017-03-29 21:56 - 00000776 _____ C:\Users\Pascal\Downloads\Reckless Blue-Eyes (Carlos Adams).ydk
2017-03-28 21:18 - 2017-04-05 12:49 - 00000465 _____ C:\Users\Pascal\Desktop\Ygopro.lnk
2017-03-28 21:16 - 2017-03-28 21:17 - 40482992 _____ C:\Users\Pascal\Downloads\ygopro-1.033.D-Percy.exe
2017-03-28 15:03 - 2017-03-28 15:03 - 00000209 _____ C:\Users\Pascal\Desktop\Chivalry Medieval Warfare.url
2017-03-27 22:07 - 2017-04-05 12:50 - 00000943 _____ C:\Users\Public\Desktop\Yu-Gi-Oh! The Dawn of a New Era.lnk
2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\Users\Pascal\Documents\System Files
2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yu-Gi-Oh! The Dawn of a New Era
2017-03-27 22:03 - 2017-03-27 22:03 - 00000000 ____D C:\Yu-Gi-Oh! The Dawn of a New Era
2017-03-27 21:59 - 2017-03-27 22:03 - 780766672 _____ (Kaiba Corporation ) C:\Users\Pascal\Downloads\Yu-Gi-Oh! The Dawn of a New Era - Setup.exe
2017-03-25 16:45 - 2017-03-25 16:45 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Cruderocks
2017-03-25 13:18 - 2017-04-01 20:33 - 00036832 _____ (Wellbia.com Co., Ltd.) C:\Windows\xhunter1.sys
2017-03-21 20:27 - 2017-03-22 23:45 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\RenPy
2017-03-20 21:10 - 2017-03-20 21:10 - 00000209 _____ C:\Users\Pascal\Desktop\FreeStyle Football.url
2017-03-18 22:22 - 2017-03-27 21:22 - 00000000 ____D C:\Users\Pascal\BrawlhallaReplays
2017-03-18 22:14 - 2017-03-18 22:14 - 00000209 _____ C:\Users\Pascal\Desktop\Brawlhalla.url
2017-03-18 22:10 - 2017-03-18 22:10 - 01090920 _____ (Unity Technologies ApS) C:\Users\Pascal\Downloads\UnityWebPlayer(1).exe
2017-03-18 18:22 - 2017-03-18 18:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BioShock Infinite
2017-03-18 13:17 - 2017-03-18 13:18 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\HelloGames
2017-03-18 13:17 - 2017-03-18 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No Man's Sky [GOG.com]
2017-03-17 11:33 - 2017-03-17 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spec Ops The Line
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Public\Documents\Sports Interactive
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\Documents\Sports Interactive
2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\AppData\Local\Sports Interactive
2017-03-15 16:48 - 2017-03-15 16:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sports Interactive
2017-03-15 16:45 - 2017-03-15 16:47 - 00000000 ____D C:\Program Files (x86)\Sports Interactive
2017-03-15 08:55 - 2017-03-15 08:55 - 00000000 ____D C:\ProgramData\360TSBackup
2017-03-14 23:06 - 2017-03-14 23:06 - 00000209 _____ C:\Users\Pascal\Desktop\RaceRoom Racing Experience.url
2017-03-14 22:27 - 2017-03-14 22:27 - 00423376 _____ C:\Windows\system32\FNTCACHE.DAT
2017-03-14 19:36 - 2017-04-05 12:50 - 00001273 _____ C:\Users\Public\Desktop\OBS Studio.lnk
2017-03-14 19:36 - 2017-04-04 16:11 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\obs-studio
2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio
2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\Program Files (x86)\obs-studio
2017-03-14 19:33 - 2017-03-14 19:35 - 113001480 _____ (obsproject.com) C:\Users\Pascal\Downloads\OBS-Studio-18.0.1-Full-Installer.exe
2017-03-14 13:07 - 2017-03-14 13:07 - 00000000 __SHD C:\$360Section
2017-03-14 13:02 - 2017-03-14 22:27 - 00000000 ____D C:\Windows\Tasks\360Disabled
2017-03-14 13:02 - 2017-03-14 13:07 - 00000000 ____D C:\ProgramData\360Quarant
2017-03-14 13:01 - 2017-03-15 19:45 - 00000000 ____D C:\Program Files (x86)\360
2017-03-14 13:01 - 2017-03-03 13:30 - 00095232 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys
2017-03-14 13:00 - 2017-03-14 13:00 - 50956720 _____ C:\Users\Pascal\Downloads\360TS_Setup.exe
2017-03-14 13:00 - 2017-03-14 13:00 - 01477032 _____ (QIHU 360 SOFTWARE CO. LIMITED) C:\Users\Pascal\Downloads\360TS_Setup_Mini.exe
2017-03-13 21:20 - 2017-04-05 12:49 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SuperF4.lnk
2017-03-13 21:20 - 2017-03-13 21:20 - 00111535 _____ C:\Users\Pascal\Downloads\SuperF4-1.3.exe
2017-03-13 21:20 - 2017-03-13 21:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\SuperF4
2017-03-13 21:16 - 2017-04-05 12:49 - 00002165 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\f.lux.lnk
2017-03-13 21:16 - 2017-03-13 21:16 - 00496896 _____ C:\Users\Pascal\Downloads\flux-setup.exe
2017-03-13 21:16 - 2017-03-13 21:16 - 00000000 ____D C:\Users\Pascal\AppData\Local\FluxSoftware
2017-03-11 20:05 - 2017-03-11 20:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light [GOG.com]
2017-03-10 16:59 - 2017-02-23 10:17 - 00136064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2017-03-10 16:59 - 2017-01-26 02:13 - 00103936 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2017-03-10 16:59 - 2017-01-26 02:12 - 00326656 _____ C:\Windows\SysWOW64\vulkan-1.dll
2017-03-10 16:59 - 2017-01-26 02:09 - 00322560 _____ C:\Windows\system32\vulkan-1.dll
2017-03-10 16:59 - 2017-01-26 02:09 - 00118272 _____ C:\Windows\system32\vulkaninfo.exe
2017-03-10 16:57 - 2017-02-24 00:55 - 00047664 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 40192056 _____ C:\Windows\system32\nvcompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 35272760 _____ C:\Windows\SysWOW64\nvcompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 34992184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 19007528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 14674896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 11122728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 11019888 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 09306312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 08990256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 03168192 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 02717752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01985080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6437878.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01589696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6437878.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 01052096 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00989632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00959424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00946456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFTH264.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00944224 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFThevc.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00910784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00721768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFTH264.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00719856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFThevc.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00687408 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00618416 _____ (NVIDIA Corporation) C:\Windows\system32\nvmcumd.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00609728 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00605120 _____ (NVIDIA Corporation) C:\Windows\system32\nvDecMFTMjpeg.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00576008 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00573632 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00499136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00483384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvDecMFTMjpeg.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00447984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\system32\nv-vk64.json
2017-03-09 23:56 - 2017-03-09 23:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Just Cause 3
2017-03-09 21:47 - 2017-03-19 20:15 - 00000000 ____D C:\Program Files (x86)\McAfee
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-04-07 13:47 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\TS3Client
2017-04-07 13:02 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\AppReadiness
2017-04-07 13:01 - 2016-11-23 21:16 - 07277238 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-07 13:01 - 2016-07-17 00:51 - 03618474 _____ C:\Windows\system32\perfh007.dat
2017-04-07 13:01 - 2016-07-17 00:51 - 00987606 _____ C:\Windows\system32\perfc007.dat
2017-04-07 12:58 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA
2017-04-07 12:56 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Overwolf
2017-04-07 12:55 - 2016-11-23 21:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-07 12:55 - 2016-11-23 21:11 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-04-07 12:53 - 2017-02-27 11:08 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Temp
2017-04-07 12:53 - 2016-12-18 20:53 - 00000000 ____D C:\Program Files\Microsoft Office
2017-04-07 12:52 - 2017-03-02 18:19 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Mozilla
2017-04-07 11:45 - 2016-12-14 13:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
2017-04-07 10:28 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Spotify
2017-04-07 10:28 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Spotify
2017-04-07 08:48 - 2016-11-23 21:12 - 00000000 ____D C:\Users\Pascal
2017-04-07 08:42 - 2016-12-19 00:40 - 00004174 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BDE79071-9BD6-497A-92EE-45EFD20BC43B}
2017-04-06 13:11 - 2016-07-16 08:04 - 00262144 _____ C:\Windows\system32\config\BBI
2017-04-06 10:06 - 2016-07-16 13:36 - 00000000 ____D C:\Windows\CbsTemp
2017-04-06 09:54 - 2016-11-23 21:23 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-06 09:40 - 2017-01-02 22:34 - 00002642 _____ C:\Users\Public\Desktop\Skype.lnk
2017-04-06 09:40 - 2017-01-02 22:34 - 00000000 ____D C:\ProgramData\Skype
2017-04-06 09:06 - 2016-07-16 13:45 - 00000000 ____D C:\Windows\INF
2017-04-06 08:57 - 2016-07-16 13:47 - 00000000 ___HD C:\Windows\ELAMBKUP
2017-04-06 08:15 - 2016-11-23 21:54 - 00000000 ____D C:\Users\Pascal\AppData\Local\SquirrelTemp
2017-04-05 21:22 - 2016-11-23 21:49 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\uTorrent
2017-04-05 12:50 - 2017-03-03 11:06 - 00001360 _____ C:\Users\Public\Desktop\Online Manager.lnk
2017-04-05 12:50 - 2017-03-02 18:19 - 00001134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-05 12:50 - 2017-03-02 18:19 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-04-05 12:50 - 2017-03-02 18:15 - 00001154 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 43.lnk
2017-04-05 12:50 - 2017-02-12 19:27 - 00001030 _____ C:\Users\Public\Desktop\WinFF.lnk
2017-04-05 12:50 - 2017-02-12 13:28 - 00001156 _____ C:\Users\Public\Desktop\Adobe Photoshop CS6.lnk
2017-04-05 12:50 - 2017-02-09 11:02 - 00001089 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk
2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\Users\Public\Desktop\Audacity.lnk
2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2017-04-05 12:50 - 2017-02-08 13:30 - 00001483 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-04-05 12:50 - 2017-02-07 15:41 - 00001058 _____ C:\Users\Public\Desktop\HiSuite.lnk
2017-04-05 12:50 - 2017-01-30 18:56 - 00001148 _____ C:\Users\Public\Desktop\Overwolf.lnk
2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk
2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
2017-04-05 12:50 - 2017-01-27 02:17 - 00001013 _____ C:\Users\Public\Desktop\Mass Effect 3.lnk
2017-04-05 12:50 - 2017-01-27 01:02 - 00000915 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk
2017-04-05 12:50 - 2017-01-26 23:23 - 00000902 _____ C:\Users\Public\Desktop\Mass Effect.lnk
2017-04-05 12:50 - 2017-01-26 21:21 - 00001060 _____ C:\Users\Public\Desktop\Origin.lnk
2017-04-05 12:50 - 2017-01-26 20:24 - 00000908 _____ C:\Users\Public\Desktop\Battle.net.lnk
2017-04-05 12:50 - 2017-01-13 01:06 - 00000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2017-04-05 12:50 - 2016-12-19 00:38 - 00000664 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontier Launchpad.lnk
2017-04-05 12:50 - 2016-11-27 13:37 - 00001371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-05 12:50 - 2016-11-27 13:37 - 00001353 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-05 12:50 - 2016-11-23 23:08 - 00000963 _____ C:\Users\Public\Desktop\MegaDownloader.lnk
2017-04-05 12:50 - 2016-11-23 22:55 - 00000842 _____ C:\Users\Public\Desktop\The Sims 3 Complete Collection.lnk
2017-04-05 12:50 - 2016-11-23 21:56 - 00000594 _____ C:\Users\Public\Desktop\Steam.lnk
2017-04-05 12:50 - 2016-11-23 21:47 - 00001755 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-04-05 12:50 - 2016-11-23 21:38 - 00001321 _____ C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2017-04-05 12:50 - 2016-11-23 21:23 - 00001339 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2017-04-05 12:49 - 2017-03-03 11:06 - 00001662 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Online Manager.lnk
2017-04-05 12:49 - 2017-03-03 11:06 - 00001372 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Online Manager.lnk
2017-04-05 12:49 - 2017-02-04 17:21 - 00000670 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2.lnk
2017-04-05 12:49 - 2017-01-30 18:56 - 00001287 _____ C:\Users\Pascal\Desktop\TeamSpeak 3 Client.lnk
2017-04-05 12:49 - 2017-01-30 18:56 - 00001245 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2017-04-05 12:49 - 2017-01-28 21:47 - 00001158 _____ C:\Users\Pascal\Desktop\Cheat Engine.lnk
2017-04-05 12:49 - 2017-01-27 13:40 - 00000594 _____ C:\Users\Pascal\Desktop\Steam.lnk
2017-04-05 12:49 - 2017-01-26 20:19 - 00001278 _____ C:\Users\Pascal\Desktop\Uplay.lnk
2017-04-05 12:49 - 2017-01-07 15:48 - 00001080 _____ C:\Users\Pascal\Desktop\SpeedFan.lnk
2017-04-05 12:49 - 2017-01-02 12:36 - 00001904 _____ C:\Users\Pascal\Desktop\Roccat Kone XTD Optical.lnk
2017-04-05 12:49 - 2016-12-14 00:44 - 00001766 _____ C:\Users\Pascal\Desktop\Isku FX.lnk
2017-04-05 12:49 - 2016-12-14 00:17 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk
2017-04-05 12:49 - 2016-11-23 22:56 - 00001855 _____ C:\Users\Pascal\Desktop\Spotify.lnk
2017-04-05 12:49 - 2016-11-23 22:56 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2017-04-05 12:49 - 2016-11-23 21:54 - 00002242 _____ C:\Users\Pascal\Desktop\Discord.lnk
2017-04-05 12:49 - 2016-11-23 21:50 - 00002663 _____ C:\Users\Pascal\Desktop\µTorrent.lnk
2017-04-05 12:49 - 2016-11-23 21:14 - 00002390 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ___RD C:\Windows\PrintDialog
2017-04-05 11:42 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\ConnectedDevicesPlatform
2017-04-05 10:23 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\LiveKernelReports
2017-04-04 13:53 - 2017-02-10 09:56 - 00004490 _____ C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml
2017-04-04 09:08 - 2016-12-22 00:31 - 00000000 ____D C:\Users\Pascal\Documents\My Games
2017-04-03 19:09 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\Packages
2017-04-03 16:30 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-03 10:15 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\spool
2017-04-02 20:22 - 2016-11-23 21:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\ElevatedDiagnostics
2017-04-02 00:28 - 2017-03-02 18:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-02 00:28 - 2016-12-19 23:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-28 20:11 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\VirtualStore
2017-03-28 14:00 - 2017-02-09 10:55 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Audacity
2017-03-26 23:21 - 2017-01-26 21:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Origin
2017-03-26 23:21 - 2017-01-26 21:19 - 00000000 ____D C:\ProgramData\Origin
2017-03-24 19:39 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client
2017-03-24 17:21 - 2017-01-30 18:56 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-03-20 20:00 - 2017-03-06 11:50 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-03-20 13:41 - 2017-03-06 11:41 - 00000000 ____D C:\ProgramData\McAfee
2017-03-20 11:35 - 2017-02-10 23:01 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\DVDVideoSoft
2017-03-19 14:06 - 2016-12-01 19:54 - 00000000 ____D C:\ProgramData\Steam
2017-03-18 22:11 - 2017-03-02 18:21 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Unity
2017-03-17 15:52 - 2017-01-26 20:19 - 00000000 ____D C:\Users\Pascal\AppData\Local\Ubisoft Game Launcher
2017-03-15 19:45 - 2016-11-23 21:12 - 00000000 ____D C:\Users\defaultuser0
2017-03-14 18:00 - 2017-02-09 11:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Sony
2017-03-14 13:08 - 2017-02-21 16:18 - 00000000 ____D C:\Users\Pascal\AppData\Local\LogMeIn Hamachi
2017-03-14 13:08 - 2017-01-23 17:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Notepad++
2017-03-14 13:08 - 2017-01-07 15:48 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-14 13:08 - 2016-11-23 22:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Skype
2017-03-14 13:08 - 2016-11-23 21:09 - 00000000 ____D C:\Windows\Panther
2017-03-14 13:04 - 2017-02-04 17:15 - 00003464 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-03-14 13:04 - 2017-01-30 18:56 - 00003304 _____ C:\Windows\System32\Tasks\Overwolf Updater Task
2017-03-14 13:02 - 2017-03-02 18:15 - 00003320 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488471357
2017-03-14 13:02 - 2017-02-08 13:29 - 00002956 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2017-02-08 13:29 - 00002838 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2017-02-08 13:29 - 00002786 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-03-14 13:02 - 2016-12-09 22:48 - 00002772 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2017-03-14 13:02 - 2016-11-27 13:36 - 00003556 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-03-14 13:02 - 2016-11-27 13:36 - 00003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-03-14 11:03 - 2017-01-26 21:21 - 00000000 ____D C:\Program Files (x86)\Origin
2017-03-11 23:26 - 2017-01-26 20:24 - 00000000 ____D C:\Users\Pascal\AppData\Local\Battle.net
2017-03-11 23:26 - 2017-01-26 20:23 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-03-10 19:38 - 2016-11-23 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-03-10 07:17 - 2016-07-16 13:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-03-10 07:17 - 2016-07-16 13:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-09 14:22 - 2017-03-02 18:15 - 00000000 ____D C:\Program Files\Opera
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-02-10 09:56 - 2017-04-04 13:53 - 0004490 _____ () C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml
2017-04-04 07:50 - 2017-04-05 08:06 - 0000074 _____ () C:\Users\Pascal\AppData\Roaming\WB.CFG
2017-04-05 11:33 - 2017-04-05 11:33 - 0001357 _____ () C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk
2016-11-23 21:20 - 2016-11-23 21:20 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
2017-04-07 12:56 - 2017-04-07 12:56 - 0619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-04-02 18:44
==================== Ende von FRST.txt ============================
FRST Additions Logfile: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (07-04-2017 14:05:52)
Gestartet von C:\Users\Pascal\Desktop
Windows 10 Pro Version 1607 (X64) (2016-11-23 19:12:30)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3959254474-2508283465-2998445632-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3959254474-2508283465-2998445632-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3959254474-2508283465-2998445632-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-3959254474-2508283465-2998445632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3959254474-2508283465-2998445632-1003 - Limited - Enabled)
Pascal (S-1-5-21-3959254474-2508283465-2998445632-1001 - Administrator - Enabled) => C:\Users\Pascal
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
µTorrent (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\uTorrent) (Version: 3.4.9.43388 - BitTorrent Inc.)
3CXPhone (HKLM-x32\...\{0DF8FA4D-299C-4250-9F09-C14E47E12224}) (Version: 4.0.26523.0 - 3CX)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
AlienFX for IskuFX (HKLM-x32\...\InstallShield_{2C3FC2CC-0A8B-409E-B487-8CD54F4DC1D4}) (Version: 1.02 - Roccat GmbH)
AlienFX for IskuFX (Version: 1.02 - Roccat GmbH) Hidden
Ansel (Version: 378.78 - NVIDIA Corporation) Hidden
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.78.7302 - BlueStack Systems, Inc.)
Brawlhalla (HKLM\...\Steam App 291550) (Version: - Blue Mammoth Games)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version: - Torn Banner Studios)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Discord (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
Epic Games Launcher (HKLM-x32\...\{4755FB10-B694-4B0F-BCDE-F390B957CD96}) (Version: 1.1.90.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
f.lux (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Flux) (Version: - )
F1 2016 (HKLM\...\Steam App 391040) (Version: - Codemasters)
FreeArc 0.666 (HKLM-x32\...\FreeArc) (Version: 0.666 - Bulat Ziganshin)
FreeStyle Football (HKLM\...\Steam App 568810) (Version: - Joycity)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
H1Z1: King of the Kill (HKLM\...\Steam App 433850) (Version: - Daybreak Game Company)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kinect for Windows Speech Recognition Language Pack (de-DE) (HKLM-x32\...\{898AA67F-99B8-4C7F-9611-B11F98EF6E78}) (Version: 11.0.7413.611 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32\...\{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32\...\{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32\...\{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32\...\{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.558 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.558 - LogMeIn, Inc.) Hidden
Mafia III (HKLM\...\Steam App 360430) (Version: - Hangar 13)
MAGIX Music Maker 2016 Premium Update (Version: 22.0.3.63 - MAGIX Software GmbH) Hidden
MAGIX Music Maker 2016 Premium Update (Version: 22.0.5.74 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Managed DirectX (0900) (x32 Version: 4.09.00.0900 - Microsoft) Hidden
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Mass Effect™ 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.2.1604.0 - Electronic Arts)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24516 (HKLM-x32\...\{c325004c-5538-45b3-a7ad-94473a4dcd3b}) (Version: 14.0.24516.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 52.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 52.0.2 (x86 de)) (Version: 52.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MTA:SA v1.5.3 (HKLM-x32\...\MTA:SA 1.5) (Version: v1.5.3 - Multi Theft Auto)
NASCAR® Racing 2003 Season (HKLM-x32\...\{ACC2E059-40E9-4464-B18D-C9BDD9A02CED}) (Version: - Sierra Entertainment)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.3.2 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 378.78 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.4.0.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.4.0.70 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.78 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.23 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.16.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 18.0.1 - OBS Project)
Online Manager (HKLM-x32\...\Online Manager) (Version: 2.02 - Deutsche Telekom AG)
Online Manager (Version: 2.02 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
Opera Stable 43.0.2442.1144 (HKLM-x32\...\Opera 43.0.2442.1144) (Version: 43.0.2442.1144 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.5.30491 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.103.44.0 - Overwolf Ltd.)
PDF24 Creator 8.1.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PES Professionals Patch 2017 V2 V2 (HKLM-x32\...\PES Professionals Patch 2017 V2 V2) (Version: V2 - PES Professionals)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DG0-PlanetSide 2) (Version: - Sony Online Entertainment)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DGC-PlanetSide 2) (Version: 1.0.3.192 - Daybreak Game Company)
Plants vs. Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
RaceRoom Racing Experience (HKLM\...\Steam App 211500) (Version: - Sector3 Studios)
Razer Chroma SDK Core Components (HKLM-x32\...\Razer Chroma SDK) (Version: 1.14.2 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.17.302 - Razer Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7936 - Realtek Semiconductor Corp.)
Revo Uninstaller 2.0.3 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.3 - VS Revo Group, Ltd.)
ROCCAT Isku FX Keyboard Driver (HKLM-x32\...\{DC69933C-E7B0-455D-8E54-FAC1EEF046FF}) (Version: - Roccat GmbH)
ROCCAT Kone XTD Optical Mouse Driver (HKLM-x32\...\{AD43B296-FE63-42C0-AA39-D8759B905420}) (Version: - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0015 - Roccat GmbH)
ScpToolkit (HKLM\...\{AC052048-9828-45E3-872B-04CE30A3B58B}) (Version: 1.6.238.16010 - Nefarius Software Solutions)
Scribus 1.4.6 (HKLM-x32\...\Scribus 1.4.6) (Version: 1.4.6 - The Scribus Team)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
Sid Meier's Civilization VI (HKLM\...\Steam App 289070) (Version: - Firaxis)
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Spotify (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Spotify) (Version: 1.0.52.725.g943b26a8 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SuperF4 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\SuperF4) (Version: 1.3 - Stefan Sundin)
Team Fortress 2 (HKLM\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\TeamSpeak 3 Client) (Version: 3.1.0 - TeamSpeak Systems GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
Unity Web Player (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\UnityWebPlayer) (Version: 5.3.8f1 - Unity Technologies ApS)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
VBCABLE, The Virtual Audio Cable (HKLM\...\VB:VBCABLE {87459874-1236-4469}) (Version: - VB-Audio Software)
Vegas Pro 13.0 (64-bit) (HKLM\...\{D264BD11-6A9B-11E4-A4F7-F04DA23A5C58}) (Version: 13.0.428 - Sony)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
Voicemeeter, The Virtual Mixing Console (HKLM-x32\...\VB:Voicemeeter {17359A74-1236-5467}) (Version: - VB-Audio Software)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
War Thunder (HKLM\...\Steam App 236390) (Version: - Gaijin Entertainment)
WhatsApp (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\WhatsApp) (Version: 0.2.3699 - WhatsApp)
WinISO (HKLM-x32\...\WinISO) (Version: 6.4.1.6137 - WinISO Computing Inc.)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0DDC38B9-2ABC-4047-A0EB-725D94EF2E32} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - \{5119999D-1353-9A1A-3510-24DD80442935} -> Keine Datei <==== ACHTUNG
Task: {1329C2F6-C4BA-4D0B-ABCF-76C371F1440E} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-03-21] (Overwolf LTD)
Task: {2524814B-75BC-4B9E-905E-D1B4E6C034E0} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {2CB9E534-7179-4767-A507-15226E0FB1E0} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-02-23] (NVIDIA Corporation)
Task: {3E251701-C90A-4C21-905A-00FAD98BD76A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {46627DDA-595A-4E74-A24C-B72ECFA99E5E} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-02-23] (NVIDIA Corporation)
Task: {4B22C211-4B14-4CAB-A75A-C9798A378749} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {539F7043-4785-4A26-AB46-A96DF2BC3B3C} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-02-23] (NVIDIA Corporation)
Task: {5F906855-AC11-46CB-AE0F-457BE062401C} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {7F828514-1063-4857-B54D-6F287D51BEED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {8823F342-6FC1-4DB1-81FB-EE2171B3589C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {89AB2E6E-B3BF-4EA7-AF6C-08572CD29D63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {9B2F52A4-3F4F-4B00-B4E6-C770E1E72CC9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {AC1D292C-3B38-4F40-87EC-72770B25CF58} - System32\Tasks\Opera scheduled Autoupdate 1488471357 => C:\Program Files\Opera\launcher.exe [2017-02-27] (Opera Software)
Task: {B452DF3B-CC73-4F26-A9C9-9A5A4F15807F} - System32\Tasks\updater => C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpUpdater.exe [2016-01-10] (Nefarius Software Solutions)
Task: {B534A77D-568D-4D49-AE5F-C04943B3A13E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-06] (Adobe Systems Incorporated)
Task: {C2236E80-FF55-4AF3-8983-DA0EC61C4DB6} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-02-19] (Adobe Systems Incorporated)
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - \Cdusmezeent Engine -> Keine Datei <==== ACHTUNG
Task: {C936D059-AE7D-42A9-974D-A8BEA5AC2F63} - System32\Tasks\{BF57B4F5-D0F8-4F2C-A03D-C8454499F1F5} => pcalua.exe -a D:\eauninstall.exe -d D:\
Task: {F48C5C35-1CE4-4B3C-A780-ECDCC01B63CD} - System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} => pcalua.exe -a "C:\Program Files (x86)\Common Files\ZumFix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\ZumFix\uninstall.dat" -a uninstallme 107D25D2-8157-4685-A6F7-6B6BC6263AA7 DeviceId=3be95ac1-32fa-4efb-d976-f9ecc5042de7 BarcodeId=51557003 ChannelId=3 DistributerName=APSFWemonetize
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-11-23 21:24 - 2017-02-23 10:28 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-04-02 18:45 - 2017-04-02 18:45 - 00309760 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\ReactiveSockets\ced6a6793b1806f6dbe2e73d73a91244\ReactiveSockets.ni.dll
2014-05-02 11:52 - 2014-05-02 11:52 - 00599040 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\irrKlang.NET4.dll
2014-05-02 06:55 - 2014-05-02 06:55 - 00185344 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpflac.dll
2014-05-02 06:05 - 2014-05-02 06:05 - 00173056 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpmp3.dll
2016-11-25 08:16 - 2016-11-25 08:16 - 00192200 _____ () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
2017-02-08 13:29 - 2017-02-23 20:35 - 04489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-25 01:20 - 2016-09-25 01:21 - 00189264 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-11-15 16:22 - 2016-11-15 16:22 - 08909504 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-11-23 21:41 - 2016-09-07 06:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 18:48 - 2016-12-21 09:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-11 18:48 - 2016-12-21 08:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 18:48 - 2016-12-21 08:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-22 11:19 - 2017-02-22 11:19 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 13:30 - 2017-02-06 13:30 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-01-19 05:22 - 2017-01-19 05:22 - 00298448 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
2017-03-02 18:15 - 2017-02-27 10:19 - 53908056 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_browser.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 59948632 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_child.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 02559576 _____ () C:\Program Files\Opera\43.0.2442.1144\libglesv2.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 00100952 _____ () C:\Program Files\Opera\43.0.2442.1144\libegl.dll
2017-01-12 14:24 - 2017-03-24 19:39 - 00176408 _____ () C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client\quazip.dll
2017-01-12 14:24 - 2017-03-24 19:39 - 00107288 _____ () C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2017-01-12 14:24 - 2017-03-24 19:39 - 00125208 _____ () C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2017-03-24 19:39 - 2017-04-04 13:58 - 00345880 _____ () C:\Users\Pascal\AppData\Roaming\TS3Client\plugins\clientquery_plugin_win64.dll
2017-02-26 00:17 - 2017-02-26 00:17 - 00276992 _____ () C:\Users\Pascal\AppData\Roaming\TS3Client\plugins\ClownfishForTeamspeak_win64.dll
2017-02-15 21:53 - 2017-03-27 19:45 - 00139264 _____ () C:\Users\Pascal\AppData\Roaming\TS3Client\plugins\gamepad_joystick_win64.dll
2017-02-01 13:27 - 2017-02-01 13:27 - 00126976 _____ () E:\Neuer Ordner\steamapps\common\F1 2016\amd_ags_x64.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2017-01-26 21:21 - 2017-03-14 11:03 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00900032 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 03774400 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2017-04-07 12:56 - 2017-04-07 12:56 - 00619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll
2017-03-21 22:03 - 2017-03-21 22:03 - 67310648 _____ () C:\Program Files (x86)\Overwolf\0.103.44.0\libcef.DLL
2016-12-14 00:42 - 2012-07-08 17:31 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\hiddriver.dll
2017-01-02 12:34 - 2014-03-18 10:45 - 00045056 _____ () C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\hiddriver.dll
2017-02-20 10:10 - 2017-02-20 10:10 - 00143824 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 50656768 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 01874944 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 00075264 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll
2017-03-21 22:03 - 2017-03-21 22:03 - 01565128 _____ () C:\Program Files (x86)\Overwolf\0.103.44.0\teamspeak_control_win32.dll
2017-02-08 13:29 - 2017-02-23 16:30 - 00338488 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00252352 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2017-02-08 13:29 - 2017-02-23 16:30 - 02443320 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00385592 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2017-02-08 13:30 - 2017-02-23 16:30 - 00543288 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00468536 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-11-23 21:58 - 2016-09-01 03:02 - 04969248 _____ () E:\Neuer Ordner\v8.dll
2016-11-23 21:58 - 2017-03-10 02:13 - 00674592 _____ () E:\Neuer Ordner\SDL2.dll
2016-11-23 21:58 - 2017-03-23 02:52 - 02465056 _____ () E:\Neuer Ordner\video.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 02549760 _____ () E:\Neuer Ordner\libavcodec-56.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00491008 _____ () E:\Neuer Ordner\libavformat-56.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00332800 _____ () E:\Neuer Ordner\libavresample-2.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00442880 _____ () E:\Neuer Ordner\libavutil-54.dll
2016-11-23 21:58 - 2016-01-27 09:49 - 00485888 _____ () E:\Neuer Ordner\libswscale-3.dll
2016-11-23 21:58 - 2016-09-01 03:02 - 01563936 _____ () E:\Neuer Ordner\icui18n.dll
2016-11-23 21:58 - 2016-09-01 03:02 - 01195296 _____ () E:\Neuer Ordner\icuuc.dll
2016-11-23 21:58 - 2017-03-31 00:46 - 00848672 _____ () E:\Neuer Ordner\bin\chromehtml.DLL
2016-11-23 21:58 - 2016-07-05 00:17 - 00266560 _____ () E:\Neuer Ordner\openvr_api.dll
2016-12-14 23:21 - 2017-01-30 23:41 - 68875552 _____ () E:\Neuer Ordner\bin\cef\cef.win7\libcef.dll
2016-11-23 21:58 - 2017-03-23 02:52 - 00383776 _____ () E:\Neuer Ordner\steam.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 13:47 - 2017-04-07 12:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pascal\Pictures\Cool_Desktop_Wallpapers_with_Nvidia_Logo_in_Black_and_Green-1360x768.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Gaijin.Net Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "SuperF4"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "f.lux"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{6DC6B0E4-B86F-453F-AFA5-E4839E53DD7D}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{D4D10190-59E1-4A96-8D8E-793DDBB2D763}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{772F321C-16DF-4C1F-A0F6-63CAF831811D}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{BEA8259B-7D01-44A2-9FF6-25124EF224D2}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{FAACF73E-D625-44CD-853F-891509F551B2}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{D2B0BC15-D518-4585-AB3E-47A7700B4AA4}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{C50678ED-E3F3-4AA3-9A6C-3069F6CDB719}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{EFACD55C-979F-4E4B-9AF0-A7CC9B48F74B}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [{786F89FF-F2FB-4A85-84B2-4F898D864FE0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C1742883-8941-45F2-82B9-1B8B0F61BEDF}] => (Allow) E:\Neuer Ordner\steamapps\common\raceroom racing experience\Game\RRRE.exe
FirewallRules: [{3D0688FE-93E6-4EC5-A9B5-11A76ED78EE2}] => (Allow) E:\Neuer Ordner\steamapps\common\raceroom racing experience\Game\RRRE.exe
FirewallRules: [{6F9BFF74-4F15-4341-9A26-F539806A6533}] => (Allow) C:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{30C1139A-BA19-4896-BB0A-AC98B9382624}] => (Allow) C:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{A4EF5ED2-6304-465C-AED6-2A1FDB88FCD2}] => (Allow) C:\Steam\steamapps\common\H1Z1 King of the Kill\LaunchPad.exe
FirewallRules: [{5A4D8DCF-15F6-4093-9397-4B3265D602D2}] => (Allow) C:\Steam\steamapps\common\H1Z1 King of the Kill\LaunchPad.exe
FirewallRules: [TCP Query User{6887C73A-ED44-4BA8-BEC7-0FFFCE8D8EF5}E:\neuer ordner\steamapps\common\f1 2016\f1_2016.exe] => (Allow) E:\neuer ordner\steamapps\common\f1 2016\f1_2016.exe
FirewallRules: [UDP Query User{E2E0E8D8-3BF9-4468-9441-9F15A9156A24}E:\neuer ordner\steamapps\common\f1 2016\f1_2016.exe] => (Allow) E:\neuer ordner\steamapps\common\f1 2016\f1_2016.exe
==================== Wiederherstellungspunkte =========================
24-03-2017 20:48:55 Geplanter Prüfpunkt
01-04-2017 20:18:07 DirectX wurde installiert
03-04-2017 20:19:35 DirectX wurde installiert
05-04-2017 11:29:54 Nach dem Adware angriff
05-04-2017 21:27:17 JRT Pre-Junkware Removal
06-04-2017 12:10:51 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:12:08 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:12:28 Revo Uninstaller's restore point - Avast Free Antivirus
06-04-2017 12:33:01 Malwarebytes Anti-Rootkit Restore Point
06-04-2017 13:21:55 Malwarebytes Anti-Rootkit Restore Point
06-04-2017 16:26:21 Malwarebytes Anti-Rootkit Restore Point
07-04-2017 08:46:33 JRT Pre-Junkware Removal
07-04-2017 11:44:07 Revo Uninstaller's restore point - chip 1-click download service
07-04-2017 11:44:17 chip 1-click download service wurde entfernt.
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: LogMeIn Hamachi Virtual Ethernet Adapter
Description: LogMeIn Hamachi Virtual Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn Inc.
Service: Hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (04/07/2017 11:44:40 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/07/2017 11:44:17 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/07/2017 11:44:07 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/07/2017 08:46:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/07/2017 08:42:01 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
Error: (04/06/2017 11:06:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-NBS516K)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/06/2017 04:26:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 01:21:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:33:02 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (04/06/2017 12:12:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Systemfehler:
=============
Error: (04/07/2017 12:56:06 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/07/2017 12:55:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinDefend" wurde aufgrund folgenden Fehlers nicht gestartet:
Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.
Error: (04/07/2017 12:55:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.
Error: (04/07/2017 12:55:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Hamachi2Svc" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.
Error: (04/07/2017 12:55:46 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\papycpu2.sys
Error: (04/07/2017 12:55:46 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\papyjoy.sys
Error: (04/07/2017 12:55:52 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 07.04.2017 um 12:36:48 unerwartet heruntergefahren.
Error: (04/07/2017 08:46:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PDF24" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/07/2017 08:46:45 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/07/2017 08:41:15 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
CodeIntegrity:
===================================
Date: 2017-04-07 12:55:56.253
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 13:11:21.599
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 12:14:31.647
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 11:53:07.421
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:53:07.410
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.426
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.356
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:57:49.637
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 08:12:41.630
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:41.560
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 16321.99 MB
Verfügbarer physikalischer RAM: 10301.27 MB
Summe virtueller Speicher: 18753.99 MB
Verfügbarer virtueller Speicher: 9965.76 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:232.44 GB) (Free:94.46 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.41 GB) (Free:129.3 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C802C2A9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C802C2D1)
Partition 1: (Not Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
==================== Ende von Addition.txt ============================
Geändert von MrKaru (07.04.2017 um 13:19 Uhr) |
|
07.04.2017, 13:19
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files (x86)\McAfee
C:\Program Files\Common Files\McAfee
C:\ProgramData\McAfee
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - \{5119999D-1353-9A1A-3510-24DD80442935} -> Keine Datei <==== ACHTUNG
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - \Cdusmezeent Engine -> Keine Datei <==== ACHTUNG
emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.04.2017, 13:25
| #24 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (07-04-2017 14:24:03) Run:2
Gestartet von C:\Users\Pascal\Desktop
Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
C:\Program Files (x86)\McAfee
C:\Program Files\Common Files\McAfee
C:\ProgramData\McAfee
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - \{5119999D-1353-9A1A-3510-24DD80442935} -> Keine Datei <==== ACHTUNG
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - \Cdusmezeent Engine -> Keine Datei <==== ACHTUNG
emptytemp:
*****************
C:\Program Files (x86)\McAfee => erfolgreich verschoben
C:\Program Files\Common Files\McAfee => erfolgreich verschoben
C:\ProgramData\McAfee => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{11CA0E95-667E-4E32-9214-B539B21D5954} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{11CA0E95-667E-4E32-9214-B539B21D5954} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5119999D-1353-9A1A-3510-24DD80442935} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C6A26BAC-D09E-4E22-8038-0C16A4D473BA} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6A26BAC-D09E-4E22-8038-0C16A4D473BA} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Cdusmezeent Engine => Schlüssel erfolgreich entfernt
=========== EmptyTemp: ==========
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 10606320 B
Java, Flash, Steam htmlcache => 16106274 B
Windows/system/drivers => 22487 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 99852074 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 818 B
NetworkService => 0 B
defaultuser0 => 0 B
Pascal => 90094828 B
RecycleBin => 108245 B
EmptyTemp: => 206.7 MB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 14:24:07 ====
|
|
07.04.2017, 16:32
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte: 1. Schritt: Malwarebytes Version 3 Downloade Dir bitte Malwarebytes Anti-Malware 3
2. Schritt: ESET ESET Online Scanner
3. Schritt: SecurityCheck Downloade Dir bitte  SecurityCheck und:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.04.2017, 21:54
| #26 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 07.04.2017 Suchlaufzeit: 18:03 Protokolldatei: Mbam Log.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2017.04.07.04 Rootkit-Datenbank: v2017.04.02.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: Pascal Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 305448 Abgelaufene Zeit: 3 Min., 54 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter C:\FRST\Quarantine\C\Users\Pascal\AppData\Local\Lafesas\Mahemo.dat VBS/Kryptik.DY Trojaner Gesäubert durch Löschen
C:\FRST\Quarantine\C\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe.xBAD Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Program Files (x86)\WinISO Computing\WinISO\setup\setup.exe Variante von Win32/FusionCore.K eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\Audacity - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\Better DS3 - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\LogMeIn Hamachi - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\PDF24 Creator - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\WhatsApp3699Setup - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\WinFF - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
C:\Users\Pascal\Downloads\winiso.exe Variante von Win32/FusionCore.K eventuell unerwünschte Anwendung Gesäubert durch Löschen
E:\Downloads\HTML Editor Phase - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
E:\Downloads\Nvu HTML Editor - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
E:\Downloads\Tor Browser Paket - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung Gesäubert durch Löschen
Code:
ATTFilter Results of screen317's Security Check version 1.009
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 25.0.0.127
Mozilla Firefox (52.0.2)
Google Chrome (57.0.2987.133)
Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````
Deutsche Telekom AG Online Manager NMInfraIS2 OnlineManager_Service.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
|
|
08.04.2017, 21:23
| #27 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host ESET Logfile bitte vollständig posten wie in der Anleitung beschrieben.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.04.2017, 23:38
| #28 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=115249fec22baf458aa88875e1ad07d7
# end=init
# utc_time=2017-04-08 08:52:43
# local_time=2017-04-08 10:52:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32999
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=115249fec22baf458aa88875e1ad07d7
# end=updated
# utc_time=2017-04-08 08:54:26
# local_time=2017-04-08 10:54:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=115249fec22baf458aa88875e1ad07d7
# engine=32999
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-04-08 10:20:19
# local_time=2017-04-09 12:20:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 884631 23020635 0 0
# scanned=1294763
# found=0
# cleaned=0
# scan_time=5152
|
|
09.04.2017, 10:08
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Warum sind da jetzt keine Funde?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.04.2017, 10:29
| #30 |
| | Nach Adware Angriff,Hijack.Host Ich habe nichts gemacht was du mir nicht gesagt hast Edit: Malwarebites findet auch nichtsmehr. |
|
| Themen zu Nach Adware Angriff,Hijack.Host |
| abstürze, abstürzen, adware, angezeigt, angriff, anti-malware, browser, datei, defender, falsch, griff, guten, kriege, löschen, malwarebytes, minuten, morgen, namens, natürlich, nervige, neustart, nichts, probleme, virus, werbung, windows |
dann auf 
und dann auf 
. 
Linear-Darstellung
