| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Nach Adware Angriff,Hijack.HostWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.04.2017, 08:39
| #1 |
 |  Nach Adware Angriff,Hijack.Host Guten Morgen, Das ist mein erstes mal hier, also hoffe ich mal das ich nichts falsch mache. Ich hatte vor kurzem eine sehr nervige Adware auf meinem PC,die nicht nur überall Werbung angezeigt hat und all meine Browser abstürzen lassen hat,sondern anscheinend (so sagt es mir Windows jedenfalls) mein Windows Defender per Grupp- enrichtlinien abgeschaltet hat und immer noch abgeschaltet ist da ich es nicht gebacken kriege sie wieder anzustellen. Das ist aber nur Eins von Zwei Problemen. Denn ganz nebenbei sagt der Anti-Malware von Malwarebytes mir nun das ich ca. über 20 Fälle der Bedrohung durch eine Datei namens Hijack.Host habe die sich im Pfad Windows/System32/drivers/etc/hosts eingenistet hat. Gut was tut man dann? Natürlich löschen gesagt getan,gelöscht. Nach dem Neustart nochmal laufen lassen. Dauert ca 5-8 Minuten;wieder ca. 20 Fälle aber endweder waren sie nie weg oder sie kommen immer wieder. Ich wäre über jede Hilfe unendlich Dankbar! SuchlaufLog: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 06.04.2017 Suchlaufzeit: 09:02 Protokolldatei: SuchlaufLog.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2017.04.06.02 Rootkit-Datenbank: v2017.04.02.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: Pascal Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 306185 Abgelaufene Zeit: 4 Min., 46 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 93 Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 92.53.119.169 469ba60d9681f961064c-3cca6631dac1b4997db921c060b712f6.r30.cf2.rackcdn.com), Ersetzt,[05d5d8154a5eee4857593b0f34cdda26] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1 123.sogou.com 127.0.0.1 ), Ersetzt,[835731bc4d5bf244842cd278748d27d9] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[efeb3eaf02a66bcbd1dfdc6e9e63ca36] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[fbdf6a831e8ad165238d53f7679a57a9] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[c3175697e5c32b0b8729b2989968e11f] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[18c239b461478fa7228e1e2c1ce53ac6] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[7e5c638a0e9a7bbb3878f852ce336c94] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0), Ersetzt,[3c9e22cbd7d1c274496793b726dba35d] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0), Ersetzt,[9a40cd205c4cd363139d351557aaec14] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0), Ersetzt,[c8128d606a3ea98ddbd57cceb34efc04] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0), Ersetzt,[42983eaf7a2e41f5228e7fcb847d3dc3] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1), Ersetzt,[5c7ea944525680b67937d377679a24dc] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[a634eb022f79c670e1cfbe8cbb4638c8] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[b327fdf056524ee8ecc41d2d6e93b54b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[f7e3c12ce0c850e6e9c7a4a64fb2ca36] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[d109faf3e0c815217e325beffa07f010] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[508a618c347420164769cc7eb948b24e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 12), Ersetzt,[a7336885307863d3a9070a40df22a55b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[f4e656971494f442ae021634b24fe719] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1 down.baidu2016.com 127.0.0.1), Ersetzt,[5e7cbf2e05a393a3a8085cee917009f7] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[8555a24b9018d95d337d78d221e0bf41] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 1), Ersetzt,[588212db1395d75fe4cce3679c659769] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[25b52bc2783050e6ad0338122dd4659b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0), Ersetzt,[31a95a93ebbda3934c6405459c65b050] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0), Ersetzt,[be1c0ce1e8c0a49298182c1ed22f51af] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.), Ersetzt,[92488964a107280e258b1c2e53aed52b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.), Ersetzt,[66742ebfaefae650416fd8725da42dd3] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[c3179a53dccc2a0c298782c80ff2f20e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[8d4de30a792f3204b7f907432dd44eb2] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[ad2d5697d9cf25114f6152f8b44d46ba] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[875302eb5058a88edcd41d2d2ed340c0] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.), Ersetzt,[b92117d66345be783a76f258c43d11ef] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[eaf046a701a7a294e9c75af039c8eb15] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0), Ersetzt,[6575f1fc2c7cfc3a5e52103aee132cd4] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.), Ersetzt,[7a60f4f9a70142f4169aea607e836f91] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[2cae14d994144aecf5bbe46631d018e8] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[7565925b9612ed49a907f95128d93ac6] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.1), Ersetzt,[f8e2a24b3d6bc373317f6edcc140629e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[5e7c7a736a3eba7c416fde6cad543cc4] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[736727c66b3df145763af555a16057a9] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[da0038b5159345f19f111e2c7f82956b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[32a85a9301a71d19e0d045058a779d63] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[4b8fe60702a6b1854c64f05a55ac5ca4] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 123.s), Ersetzt,[499166871e8a94a27a36d87246bb6d93] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 123.sogou.co), Ersetzt,[8a507d7003a5d2646947c28814ed1fe1] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 1), Ersetzt,[4d8da548ebbd8da9763a3e0cf30e718f] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.), Ersetzt,[aa3031bc228681b567490d3dda27d62a] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[2ab0707df7b12e08456b65e5738e39c7] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[6e6cec01f5b342f4d6da2c1eac55c937] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[e3f72ac3d2d6dd5937790c3e956cad53] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 1), Ersetzt,[d802c5287d2b6fc7c0f017336a975ca4] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[459537b6f2b65bdb0ba5e565cb366e92] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1), Ersetzt,[7367bd30515771c5edc3014921e038c8] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[a6341dd050588ea8fdb31f2b18e928d8] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127), Ersetzt,[be1ca04d891ffd391a961b2fd62bea16] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t 127.0.0.1 down.baidu2016.com 1), Ersetzt,[ae2c7677396fe74f535db39751b02bd5] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[00daf1fc9b0d1422446c6dddc53cbd43] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[885222cbe8c043f30fa12a200001e020] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[607afdf0dbcd2e08fbb5b09a2ed305fb] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[6872ac4163453402436d4bff32cf13ed] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 12), Ersetzt,[b22843aab2f63cfa8b25e5654eb3847c] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[1dbd8469cddbac8a10a04901867b07f9] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 1), Ersetzt,[d5058b621395a5910aa6ea60dc258f71] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t 127.0.0.1 down.baidu2016.com 127.0), Ersetzt,[1ac00be27e2a8da950600a40ff02926e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[bd1dd11c6c3cc076f8b80644af5252ae] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 12), Ersetzt,[11c9e5089e0a3303ae0243070cf533cd] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 ), Ersetzt,[defc6e7fb9efb6806f41aaa028d9dc24] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[ac2eec01f0b8979f89270a40f30e9e62] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 123.sogou), Ersetzt,[d802737a9c0c88ae248cd971b051817f] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[4595ae3f723643f3357b69e18a77ea16] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127), Ersetzt,[7961519c97113402efc1e565ef12f808] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 12), Ersetzt,[a634f8f5406857dfc7e9272346bbce32] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0), Ersetzt,[15c50de07434171fa7091733d928cf31] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[64762fbee7c1ad89189886c4d32efa06] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[bc1e32bbc6e2033377397cce68991ae6] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[16c4db128a1e9e984c6406443cc5cb35] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (t 127.0.0.1 down.baidu2016.com 12), Ersetzt,[13c7db12fbad7db9981877d3b24f53ad] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[7664effeb0f8fc3a446c0545b34e956b] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1 123), Ersetzt,[b921d11c792f4fe7f7b91b2fa75a6f91] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (1 down.baidu2016.com 127.0.0.1 123.sogo), Ersetzt,[0eccad4066423df9e9c71b2f827fb34d] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (1 down.baidu2016.com 127.0.0.1 1), Ersetzt,[9f3b4ca154540135129e1e2ccc355fa1] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (27.0.0.1 down.baidu2016.com 127.0.0.1 123.), Ersetzt,[528808e53b6d20164d63103a15eca25e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( down.baidu2016.com 127.0.0.1 123), Ersetzt,[c119836a40682115119f5cee14ede21e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1 down.baidu2016.com 127.0.0.1 12), Ersetzt,[ac2e2ac3c5e3e0567f3156f4b24fbb45] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[e4f6bd30a701b28409a7eb5fe61bc739] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[6c6e9d50495f4fe79c149fab7c85b749] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.), Ersetzt,[32a8d31aefb97db9ab05ba90f9087987] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: ( 127.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[ffdb39b402a646f07c34f8529d64b848] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 123), Ersetzt,[895142abdccc1620eac606447c8512ee] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (7.0.0.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[e5f55b92c9dfa3938030e26818e9b050] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 123.so), Ersetzt,[7e5c30bd7f2983b3149c4109748da25e] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.1 down.baidu2016.com 127.0.0.1 ), Ersetzt,[3f9bfbf26a3e94a2a8082624c53c7987] Hijack.HostFile, C:\Windows\System32\drivers\etc\hosts, Gut: (), Schlecht: (.0.0.1 down.baidu2016.com 127.0.0.1), Ersetzt,[04d69657fcace94dab057cce936eea16] Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Geändert von cosinus (06.04.2017 um 10:46 Uhr) Grund: code tags |
|
06.04.2017, 10:47
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Nach Adware Angriff,Hijack.Host Scan mit Farbar's Recovery Scan Tool (FRST)
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
06.04.2017, 11:04
| #3 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017 durchgeführt von Pascal (Administrator) auf DESKTOP-NBS516K (06-04-2017 11:55:08) Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir10056_9357 Geladene Profile: Pascal (Verfügbare Profile: defaultuser0 & Pascal) Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe (Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe (Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe (Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe (WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe (WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe (WhatsApp) C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\WhatsApp.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe (ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe (Scarlet.Crush Productions) C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe (ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.exe (Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer Inc) C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe (Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe (Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper.exe (Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.103.44.0\OverwolfHelper64.exe (Razer, Inc.) C:\Users\Pascal\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\rzcefrenderprocess.exe (Microsoft Corporation) C:\Windows\System32\InstallAgent.exe (Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Spotify Ltd) C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Opera Software) C:\Program Files\Opera\43.0.2442.1144\opera.exe ==================== Registry (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16696840 2016-09-14] (Realtek Semiconductor) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-06] (AVAST Software) HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2013-12-17] (AVM Berlin) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [RoccatIskuFX] => C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe [540672 2014-10-19] (ROCCAT GmbH) HKLM-x32\...\Run: [RoccatKoneXTDOptical] => C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\KoneXTDOpticalMonitor.EXE [552960 2014-04-14] (ROCCAT GmbH) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2017-03-02] (Razer Inc.) HKLM-x32\...\Run: [Kraken71ChromaHelper] => C:\Program Files (x86)\Razer\Razer_Kraken71Chroma_Driver\Drivers\SysAudio\Kraken71ChromaHelper.exe [1600096 2017-02-14] (Razer Inc) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Discord] => C:\Users\Pascal\AppData\Local\Discord\app-0.0.297\Discord.exe [64290304 2017-01-04] (Hammer & Chisel, Inc.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Steam] => E:\Neuer Ordner\steam.exe [3019552 2017-03-23] (Valve Corporation) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Spotify Web Helper] => C:\Users\Pascal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-01] (Spotify Ltd) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [1690248 2016-12-01] (BlueStack Systems, Inc.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Gaijin.Net Agent] => C:\Users\Pascal\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [1912840 2017-02-19] () HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3044816 2017-03-14] (Electronic Arts) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1058360 2017-03-21] () HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Dxtory Update Checker 2.0] => C:\Program Files (x86)\Dxtory Software\Dxtory2.0\UpdateChecker.exe [93696 2010-10-17] (Dxtory Software) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [f.lux] => C:\Users\Pascal\AppData\Local\FluxSoftware\Flux\flux.exe [1024240 2016-12-06] (Flux Software LLC) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [SuperF4] => C:\Users\Pascal\AppData\Roaming\SuperF4\SuperF4.exe [40960 2015-08-24] (Stefan Sundin) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Chromium] => c:\users\pascal\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [VHMHR88UKJGKO0T] => "C:\Program Files\SH8GW5V5VQ\SH8GW5V5V.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [6159] => "C:\Users\Pascal\AppData\Roaming\45786296\827204.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [ruOj4cTpe+.exe] => C:\Program Files\Microsoft Office\XCR5RZM7N2TK0\ruOj4cTpe+.exe -r1_5 -r2_1 HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [UMRTDY6K0MWO87K] => "C:\Program Files\LZAE7O812S\LZAE7O812.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [5LDEE8ZQ7YU0R81] => "C:\Program Files\R825KEPMNZ\R825KEPMN.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [OPKXB4WC5AAA46E] => "C:\Program Files\V389U12JRN\V389U12JR.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [W55ARE7PITE99EB] => "C:\Program Files\L9X4M63QIN\L9X4M63QI.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27545048 2017-03-14] (Skype Technologies S.A.) HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {0e0919c9-b364-11e6-a29d-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {bd04f186-b1b0-11e6-a29a-7085c209549d} - "G:\pushinst.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa05-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa2a-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {db94aa3f-f8f8-11e6-a2bc-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c75a8-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe" HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\MountPoints2: {ec0c7cb1-ecad-11e6-a2b7-7085c209549d} - "G:\HiSuiteDownLoader.exe" ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-06] (AVAST Software) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk [2017-04-05] ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScpToolkit Tray Notifications.lnk [2017-04-05] ShortcutTarget: ScpToolkit Tray Notifications.lnk -> C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpTrayApp.exe (Scarlet.Crush Productions) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Winsock: Catalog5-x64 05 C:\Windows\system32\NSBlockA.dll => Keine Datei <===== ACHTUNG Winsock: Catalog5-x64 08 C:\Windows\system32\NSBlockB.dll => Keine Datei <===== ACHTUNG Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{da0d42d9-18de-4b46-bcb2-42561cb5aa05}: [DhcpNameServer] 192.168.2.1 ManualProxies: Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#/?show_is=1&source=art HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#/?show_is=1&source=art SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt SearchScopes: HKU\S-1-5-21-3959254474-2508283465-2998445632-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-10-11] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605 [2017-04-06] FF Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-04-05] FF Extension: (Disable Prefetch) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\q0kri7iy.default-1491386508605\features\{54afb0fe-8646-4f03-a4d4-2020d0431a86}\disable-prefetch@mozilla.org.xpi [2017-04-05] FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-29] [ist nicht signiert] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-06] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-04-06] () FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-04-06] () FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-11-15] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-23] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-23] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin HKU\S-1-5-21-3959254474-2508283465-2998445632-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-09] (Unity Technologies ApS) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-11-15] (Microsoft Corporation) StartMenuInternet: FIREFOX.EXE - firefox.exe FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2017-04-05] Chrome: ======= CHR DefaultProfile: ChromeDefaultData2 CHR HomePage: ChromeDefaultData2 -> hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkOOmCCYjHgvUD8zQEC2onXZ0flEr-hZWd-RsmvP_SOpJeDvIzZP42wPMaHzmlcwF5M2qhrDaNB_0LXaMiqZuPt8E_yuCQj_6tziC2-4Yiln3v_mF3_BbWZUEu8CFqbQehiNhUZhTVLvtVv-RuFDbrzEm355f3f06ikvqBZITQ,, CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.youndoo.com/?z=6387f3cc1cb544525b2e38agdz9t8g1c5m0t0ebe5o&from=amz&uid=ST1000DM003-1SB102_Z9A3CK7CXXXXZ9A3CK7C&type=hp" CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-04-06] <==== ACHTUNG CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx StartMenuInternet: Google Chrome - Chrome.exe Opera: ======= OPR Extension: (VK+OK AdBlock) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\fgfffefkfpmbjmhofnofmiikiolcbhll [2017-04-05] OPR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-04-05] StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe ==================== Dienste (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) U4 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [487432 2017-03-21] (Avira Operations GmbH & Co. KG) R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7398336 2017-04-06] (AVAST Software s.r.o.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-06] (AVAST Software) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] () S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [486936 2016-12-01] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [470552 2016-12-01] (BlueStack Systems, Inc.) S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [511512 2016-12-01] (BlueStack Systems, Inc.) R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert] R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-02-08] (Digital Wave Ltd.) R2 Ds3Service; C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe [389632 2016-01-10] (Scarlet.Crush Productions) [Datei ist nicht signiert] S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395024 2017-01-19] (EasyAntiCheat Ltd) R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-11-25] () S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-23] (NVIDIA Corporation) R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-02-23] (NVIDIA Corporation) R2 Online Manager Service; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe [3076096 2016-09-21] (Deutsche Telekom AG) [Datei ist nicht signiert] S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2123240 2017-03-14] (Electronic Arts) R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184688 2017-03-14] (Electronic Arts) S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325384 2017-03-21] (Overwolf LTD) R2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [217736 2017-03-31] (Geek Software GmbH) R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69768 2017-02-15] (Razer Inc.) R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [189264 2016-09-25] () S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation) S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation) S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s [X] S2 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ====================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [307736 2017-04-06] (AVAST Software s.r.o.) R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-04-06] (AVAST Software s.r.o.) R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334088 2017-04-06] (AVAST Software s.r.o.) R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-04-06] (AVAST Software s.r.o.) S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-04-06] (AVAST Software) R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32600 2017-04-06] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [127112 2017-04-06] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [101152 2017-04-06] (AVAST Software) S0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-04-06] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1005048 2017-04-06] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [556784 2017-04-06] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [164064 2017-04-06] (AVAST Software) R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [339696 2017-04-06] (AVAST Software) R4 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [161824 2017-03-21] (Avira Operations GmbH & Co. KG) U4 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [163976 2017-03-21] (Avira Operations GmbH & Co. KG) R4 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [44488 2017-03-21] (Avira Operations GmbH & Co. KG) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2013-12-17] (AVM Berlin) S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-12-01] (BlueStack Systems) S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-11-08] (Bluestack System Inc. ) S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) S3 FairplayKD; C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [78856 2017-02-12] (Multi Theft Auto) R3 fwlanusb6; C:\Windows\system32\DRIVERS\fwlanusb6.sys [1327744 2014-03-27] (AVM GmbH) S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2017-02-02] (LogMeIn Inc.) U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-11-25] (Huawei Technologies Co., Ltd.) S3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-04-01] (hxxp://libusb-win32.sourceforge.net) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2017-04-06] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] () R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys [14569528 2017-02-24] (NVIDIA Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2017-02-23] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [47672 2017-01-20] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [59448 2017-02-23] (NVIDIA Corporation) S0x01000000 papycpu2; C:\Windows\SysWOW64\DRIVERS\papycpu2.sys [1984 2003-01-17] () [Datei ist nicht signiert] S0x01000000 papyjoy; C:\Windows\SysWOW64\DRIVERS\papyjoy.sys [1856 2003-01-17] () [Datei ist nicht signiert] R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-09-17] (Razer, Inc.) R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-09-07] (Razer, Inc.) R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions) S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) S3 TelekomNM6; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 VBAudioVACMME; C:\Windows\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider) R3 VBAudioVMVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2017-02-10] (Windows (R) Win 7 DDK provider) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation) R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2016-10-20] (WinISO.com) S3 xhunter1; C:\Windows\xhunter1.sys [36832 2017-04-01] (Wellbia.com Co., Ltd.) R4 avusbflt; System32\Drivers\avusbflt.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-04-06 11:55 - 2017-04-06 11:55 - 00000000 ____D C:\FRST 2017-04-06 11:54 - 2017-04-06 11:54 - 02424832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe 2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381248740.pdf 2017-04-06 11:51 - 2017-04-06 11:51 - 00009993 _____ C:\Users\Pascal\Desktop\Versand 1.pdf 2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Downloads\Shipping_Label_1381243888.pdf 2017-04-06 11:51 - 2017-04-06 11:51 - 00009977 _____ C:\Users\Pascal\Desktop\Versand 2.pdf 2017-04-06 11:16 - 2017-04-06 11:16 - 00000000 ____D C:\Users\Pascal\Desktop\Bilder 2017-04-06 10:41 - 2017-04-06 10:41 - 00000179 _____ C:\Users\Pascal\Desktop\XBox tec Ausfall.txt 2017-04-06 10:07 - 2017-04-06 10:07 - 00017002 _____ C:\Users\Pascal\Desktop\SuchlaufLog.txt 2017-04-06 09:47 - 2017-04-06 09:47 - 00004466 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype 2017-04-06 09:40 - 2017-04-06 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2017-04-06 09:36 - 2017-04-06 09:36 - 00032600 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2017-04-06 09:36 - 2017-04-06 09:36 - 00004044 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1491464191 2017-04-06 09:36 - 2017-04-06 09:36 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk 2017-04-06 09:35 - 2017-04-06 09:35 - 01005048 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00556784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00399944 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2017-04-06 09:35 - 2017-04-06 09:35 - 00339696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00334088 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbloga.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00307736 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdrivera.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00189768 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsha.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00164064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00127112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00101152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00075704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00048528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbuniva.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00038296 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys 2017-04-06 09:35 - 2017-04-06 09:35 - 00003994 _____ C:\Windows\System32\Tasks\Avast Emergency Update 2017-04-06 09:35 - 2017-04-06 09:35 - 00001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk 2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software 2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\AVAST Software 2017-04-06 09:35 - 2017-04-06 09:35 - 00000000 ____D C:\Program Files\Common Files\AV 2017-04-06 09:34 - 2017-04-06 09:49 - 00000000 ____D C:\ProgramData\AVAST Software 2017-04-06 09:34 - 2017-04-06 09:37 - 00000000 ____D C:\Users\Pascal\Desktop\Schutz 2017-04-06 09:34 - 2017-04-06 09:36 - 00000000 ____D C:\Program Files\AVAST Software 2017-04-06 09:34 - 2017-04-06 09:34 - 06654960 _____ (AVAST Software) C:\Users\Pascal\Downloads\avast_free_antivirus_setup_online.exe 2017-04-06 08:15 - 2017-04-06 08:58 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WhatsApp 2017-04-06 08:15 - 2017-04-06 08:15 - 00002292 _____ C:\Users\Pascal\Desktop\WhatsApp.lnk 2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp 2017-04-06 08:15 - 2017-04-06 08:15 - 00000000 ____D C:\Users\Pascal\AppData\Local\WhatsApp 2017-04-06 08:13 - 2017-04-06 08:13 - 01496584 _____ C:\Users\Pascal\Downloads\WhatsApp3699Setup - CHIP-Installer.exe 2017-04-06 07:56 - 2017-04-06 07:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Eric_Zhang 2017-04-05 21:24 - 2017-04-05 21:24 - 01663904 _____ (Malwarebytes) C:\Users\Pascal\Downloads\JRT.exe 2017-04-05 21:21 - 2017-04-05 21:21 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Pascal\Downloads\mbar-1.09.3.1001.exe 2017-04-05 13:39 - 2017-04-05 13:39 - 00001157 _____ C:\Users\Public\Desktop\PDF24.lnk 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Users\Pascal\AppData\Local\PDF24 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24 2017-04-05 13:39 - 2017-04-05 13:39 - 00000000 ____D C:\Program Files (x86)\PDF24 2017-04-05 13:38 - 2017-04-05 13:38 - 01496584 _____ C:\Users\Pascal\Downloads\PDF24 Creator - CHIP-Installer.exe 2017-04-05 13:36 - 2017-04-05 13:36 - 00038301 _____ C:\Users\Pascal\Downloads\images.pdf 2017-04-05 13:09 - 2017-04-05 13:09 - 00001154 _____ C:\Users\Pascal\Desktop\Opera.lnk 2017-04-05 12:45 - 2017-04-05 13:36 - 00000000 ____D C:\Users\Pascal\Desktop\Bewerbung 2017-04-05 12:22 - 2017-04-06 09:02 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-04-05 12:22 - 2017-04-05 12:22 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2017-04-05 12:22 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2017-04-05 12:22 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2017-04-05 12:22 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2017-04-05 12:18 - 2017-04-05 21:14 - 00000000 ____D C:\Users\Pascal\Documents\Anti 2017-04-05 12:18 - 2017-04-05 21:12 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\uTorrent 2017-04-05 11:55 - 2017-04-05 11:55 - 00003738 _____ C:\Windows\System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} 2017-04-05 11:46 - 2017-04-05 11:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\CrashDumps 2017-04-05 11:40 - 2017-04-05 11:40 - 00000000 ____D C:\Users\Pascal\AppData\Local\PeerDistRepub 2017-04-05 11:38 - 2017-04-05 11:39 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe 2017-04-05 11:33 - 2017-04-05 11:33 - 00001357 _____ C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk 2017-04-05 11:06 - 2017-04-05 21:25 - 00000000 ____D C:\AdwCleaner 2017-04-05 11:06 - 2017-04-05 21:23 - 04089296 _____ C:\Users\Pascal\Downloads\adwcleaner_6.045.exe 2017-04-05 11:02 - 2017-04-05 11:08 - 00000000 ____D C:\Program Files\ZMWCF16IVP 2017-04-05 10:55 - 2017-04-06 09:54 - 00000000 ____D C:\ProgramData\Avira 2017-04-05 10:55 - 2017-04-06 09:54 - 00000000 ____D C:\Program Files (x86)\Avira 2017-04-05 10:55 - 2017-03-21 14:01 - 00163976 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2017-04-05 10:55 - 2017-03-21 14:01 - 00161824 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2017-04-05 10:55 - 2017-03-21 14:01 - 00044488 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2017-04-05 10:52 - 2017-04-05 10:52 - 01496584 _____ C:\Users\Pascal\Downloads\AntiVir Avira Free Antivirus - CHIP-Installer.exe 2017-04-05 10:40 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\SUSG1LUFVL 2017-04-05 10:37 - 2017-04-05 21:25 - 00000008 __RSH C:\Users\Pascal\ntuser.pol 2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\ZOTH2H4HUY 2017-04-05 10:37 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\NYCW0JIKE4 2017-04-05 10:04 - 2017-04-05 13:19 - 00141312 ___SH C:\Users\Pascal\Downloads\Thumbs.db 2017-04-05 09:59 - 2017-04-05 12:32 - 00000000 ____D C:\Program Files\MTSV8KJOJA 2017-04-05 09:59 - 2017-04-05 09:59 - 00720033 _____ C:\Windows\unins000.exe 2017-04-05 09:59 - 2017-04-05 09:59 - 00042558 _____ C:\Windows\unins000.dat 2017-04-05 09:57 - 2017-04-05 11:07 - 00000000 ____D C:\Program Files (x86)\a34d3033-7ff7-476c-a539-beb5e95b7f461491379048 2017-04-05 09:57 - 2017-04-05 10:06 - 00000000 ____D C:\Windows\system32\SSL 2017-04-05 09:56 - 2017-04-05 09:56 - 00000000 ____D C:\Windows\system32\sstmp 2017-04-05 09:55 - 2017-04-05 12:32 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Dkulyjegerward 2017-04-05 09:55 - 2017-04-05 09:55 - 00006058 _____ C:\Windows\System32\Tasks\Cdusmezeent Engine 2017-04-04 19:21 - 2017-04-04 19:21 - 00000783 _____ C:\Users\Pascal\Downloads\Cyber Dragons (Jermaine Leach).ydk 2017-04-04 19:19 - 2017-04-04 19:19 - 00000798 _____ C:\Users\Pascal\Downloads\Barian Warrior Rank 4 (Sercan Tepeler).ydk 2017-04-04 19:17 - 2017-04-04 19:17 - 00000748 _____ C:\Users\Pascal\Downloads\Crystron (Berkay Gündar).ydk 2017-04-04 19:17 - 2017-04-04 19:17 - 00000745 _____ C:\Users\Pascal\Downloads\Blackwing Quasar (Samed Yazar).ydk 2017-04-04 19:16 - 2017-04-04 19:16 - 00000746 _____ C:\Users\Pascal\Downloads\D_D_D's (Emre Canyurt).ydk 2017-04-04 19:06 - 2017-04-04 19:06 - 00000762 _____ C:\Users\Pascal\Downloads\Darklords (Lucas Bartolomeu De Oliveira).ydk 2017-04-04 19:01 - 2017-04-04 19:01 - 00000750 _____ C:\Users\Pascal\Downloads\D_D Yang Zings (Giannis Feidakis).ydk 2017-04-04 19:01 - 2017-04-04 19:01 - 00000744 _____ C:\Users\Pascal\Downloads\PSY-Frames (Nick Dietz).ydk 2017-04-04 12:25 - 2017-04-04 12:34 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted Backups 2017-04-04 09:00 - 2017-04-04 09:11 - 00000000 ____D C:\Users\Pascal\Documents\NFS Most Wanted 2017-04-04 08:58 - 2017-04-04 08:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed Most Wanted 2005 2017-04-04 07:50 - 2017-04-05 08:06 - 00000074 _____ C:\Users\Pascal\AppData\Roaming\WB.CFG 2017-04-03 20:24 - 2017-04-03 20:24 - 00013824 ___SH C:\Users\Pascal\Desktop\Thumbs.db 2017-04-03 20:22 - 2017-04-03 20:22 - 00000000 ____D C:\ProgramData\PopCap Games 2017-04-03 20:20 - 2017-04-05 12:50 - 00000577 _____ C:\Users\Public\Desktop\Plants vs. Zombies.lnk 2017-04-03 20:20 - 2017-04-03 20:20 - 00000000 ____D C:\Users\Pascal\Desktop\CUE In ISO 2017-04-03 20:19 - 2017-04-05 12:49 - 00002388 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk 2017-04-03 20:18 - 2017-04-05 12:30 - 00000000 ____D C:\Users\Pascal\AppData\Local\Lafesas 2017-04-03 20:18 - 2017-04-05 10:23 - 00000296 _____ C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job 2017-04-03 20:18 - 2017-04-03 20:18 - 00002836 _____ C:\Windows\System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} 2017-04-03 20:17 - 2017-04-03 20:17 - 07898096 _____ (WinISO Computing Inc.) C:\Users\Pascal\Downloads\winiso.exe 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\WinISO Computing 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Local\WinISO Computing 2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\Program Files (x86)\WinISO Computing 2017-04-03 20:17 - 2016-10-20 17:13 - 00204032 _____ (WinISO.com) C:\Windows\system32\Drivers\WinisoCDBus.sys 2017-04-02 20:21 - 2017-04-02 20:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\One Finger Death Punch 1.0 2017-04-02 19:35 - 2017-04-02 19:35 - 00000000 ____D C:\Users\Public\Documents\Team17 2017-04-02 19:33 - 2017-04-02 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Worms W.M.D. [GOG.com] 2017-04-02 19:20 - 2017-04-02 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\State of Decay Year-One 2017-04-02 12:21 - 2017-04-02 12:21 - 00000000 ____D C:\ProgramData\Nefarius Software Solutions 2017-04-01 20:32 - 2017-04-01 20:33 - 00000000 ____D C:\Users\Pascal\Desktop\PS3 Controller 2017-04-01 20:27 - 2017-04-05 21:25 - 00000008 __RSH C:\ProgramData\ntuser.pol 2017-04-01 20:27 - 2017-04-01 20:27 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbK.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00083552 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusbK.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll 2017-04-01 20:27 - 2017-04-01 20:27 - 00047200 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusbK.sys 2017-04-01 20:26 - 2017-04-01 20:26 - 00003960 _____ C:\Windows\System32\Tasks\updater 2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScpToolkit 2017-04-01 20:26 - 2017-04-01 20:26 - 00000000 ____D C:\Program Files\Nefarius Software Solutions 2017-04-01 20:25 - 2017-04-01 20:25 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Nefarius Software Solutions 2017-04-01 20:24 - 2017-04-01 20:25 - 23361996 _____ (Nefarius Software Solutions) C:\Users\Pascal\Downloads\ScpToolkit_Setup.exe 2017-04-01 20:18 - 2017-04-05 12:50 - 00000687 _____ C:\Users\Public\Desktop\The Saboteur.lnk 2017-04-01 20:18 - 2017-04-01 20:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Saboteur [GOG.com] 2017-04-01 20:17 - 2017-04-05 09:56 - 00000000 ____D C:\Program Files\MotioninJoy 2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\MotioninJoy 2017-04-01 20:17 - 2017-04-01 20:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy 2017-04-01 20:17 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll 2017-04-01 20:16 - 2012-05-12 06:33 - 04199240 _____ (www.motioninjoy.com ) C:\Users\Pascal\Downloads\MotioninJoy_071001_signed.exe 2017-04-01 20:12 - 2017-04-01 20:12 - 00000000 ____D C:\Users\Pascal\AppData\Local\BetterDS3 2017-04-01 20:11 - 2017-04-01 20:11 - 00759932 _____ C:\Users\Pascal\Downloads\BetterDS3_1.5.3.zip 2017-04-01 20:11 - 2017-04-01 20:11 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH 2017-04-01 20:11 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Pascal\Downloads\Better DS3.exe 2017-04-01 20:10 - 2017-04-01 20:10 - 01496584 _____ C:\Users\Pascal\Downloads\Better DS3 - CHIP-Installer.exe 2017-04-01 16:47 - 2017-04-01 16:47 - 00000947 _____ C:\Users\Pascal\Downloads\60-Card Infernoid Zoodiacs (Ryan Murakami).ydk 2017-03-29 21:58 - 2017-03-29 21:58 - 00000732 _____ C:\Users\Pascal\Downloads\Chain Burn (Jameson Mcgranahan).ydk 2017-03-29 21:57 - 2017-03-29 21:57 - 00000749 _____ C:\Users\Pascal\Downloads\Dark Synchro (Duelist Unknown).ydk 2017-03-29 21:56 - 2017-03-29 21:56 - 00000776 _____ C:\Users\Pascal\Downloads\Reckless Blue-Eyes (Carlos Adams).ydk 2017-03-28 21:18 - 2017-04-05 12:49 - 00000465 _____ C:\Users\Pascal\Desktop\Ygopro.lnk 2017-03-28 21:16 - 2017-03-28 21:17 - 40482992 _____ C:\Users\Pascal\Downloads\ygopro-1.033.D-Percy.exe 2017-03-28 15:03 - 2017-03-28 15:03 - 00000209 _____ C:\Users\Pascal\Desktop\Chivalry Medieval Warfare.url 2017-03-27 22:07 - 2017-04-05 12:50 - 00000943 _____ C:\Users\Public\Desktop\Yu-Gi-Oh! The Dawn of a New Era.lnk 2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\Users\Pascal\Documents\System Files 2017-03-27 22:07 - 2017-03-27 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yu-Gi-Oh! The Dawn of a New Era 2017-03-27 22:03 - 2017-03-27 22:03 - 00000000 ____D C:\Yu-Gi-Oh! The Dawn of a New Era 2017-03-27 21:59 - 2017-03-27 22:03 - 780766672 _____ (Kaiba Corporation ) C:\Users\Pascal\Downloads\Yu-Gi-Oh! The Dawn of a New Era - Setup.exe 2017-03-25 16:45 - 2017-03-25 16:45 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Cruderocks 2017-03-25 13:18 - 2017-04-01 20:33 - 00036832 _____ (Wellbia.com Co., Ltd.) C:\Windows\xhunter1.sys 2017-03-21 20:27 - 2017-03-22 23:45 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\RenPy 2017-03-20 21:10 - 2017-03-20 21:10 - 00000209 _____ C:\Users\Pascal\Desktop\FreeStyle Football.url 2017-03-18 22:22 - 2017-03-27 21:22 - 00000000 ____D C:\Users\Pascal\BrawlhallaReplays 2017-03-18 22:14 - 2017-03-18 22:14 - 00000209 _____ C:\Users\Pascal\Desktop\Brawlhalla.url 2017-03-18 22:10 - 2017-03-18 22:10 - 01090920 _____ (Unity Technologies ApS) C:\Users\Pascal\Downloads\UnityWebPlayer(1).exe 2017-03-18 18:22 - 2017-03-18 18:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BioShock Infinite 2017-03-18 13:17 - 2017-03-18 13:18 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\HelloGames 2017-03-18 13:17 - 2017-03-18 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No Man's Sky [GOG.com] 2017-03-17 11:33 - 2017-03-17 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spec Ops The Line 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Public\Documents\Sports Interactive 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\Documents\Sports Interactive 2017-03-15 16:55 - 2017-03-15 17:51 - 00000000 ____D C:\Users\Pascal\AppData\Local\Sports Interactive 2017-03-15 16:48 - 2017-03-15 16:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sports Interactive 2017-03-15 16:45 - 2017-03-15 16:47 - 00000000 ____D C:\Program Files (x86)\Sports Interactive 2017-03-15 08:55 - 2017-03-15 08:55 - 00000000 ____D C:\ProgramData\360TSBackup 2017-03-14 23:06 - 2017-03-14 23:06 - 00000209 _____ C:\Users\Pascal\Desktop\RaceRoom Racing Experience.url 2017-03-14 22:27 - 2017-03-14 22:27 - 00423376 _____ C:\Windows\system32\FNTCACHE.DAT 2017-03-14 19:36 - 2017-04-05 12:50 - 00001273 _____ C:\Users\Public\Desktop\OBS Studio.lnk 2017-03-14 19:36 - 2017-04-04 16:11 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\obs-studio 2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio 2017-03-14 19:36 - 2017-03-14 19:36 - 00000000 ____D C:\Program Files (x86)\obs-studio 2017-03-14 19:33 - 2017-03-14 19:35 - 113001480 _____ (obsproject.com) C:\Users\Pascal\Downloads\OBS-Studio-18.0.1-Full-Installer.exe 2017-03-14 13:07 - 2017-03-14 13:07 - 00000000 __SHD C:\$360Section 2017-03-14 13:02 - 2017-03-14 22:27 - 00000000 ____D C:\Windows\Tasks\360Disabled 2017-03-14 13:02 - 2017-03-14 13:07 - 00000000 ____D C:\ProgramData\360Quarant 2017-03-14 13:01 - 2017-03-15 19:45 - 00000000 ____D C:\Program Files (x86)\360 2017-03-14 13:01 - 2017-03-03 13:30 - 00095232 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys 2017-03-14 13:00 - 2017-03-14 13:00 - 50956720 _____ C:\Users\Pascal\Downloads\360TS_Setup.exe 2017-03-14 13:00 - 2017-03-14 13:00 - 01477032 _____ (QIHU 360 SOFTWARE CO. LIMITED) C:\Users\Pascal\Downloads\360TS_Setup_Mini.exe 2017-03-13 21:20 - 2017-04-05 12:49 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SuperF4.lnk 2017-03-13 21:20 - 2017-03-13 21:20 - 00111535 _____ C:\Users\Pascal\Downloads\SuperF4-1.3.exe 2017-03-13 21:20 - 2017-03-13 21:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\SuperF4 2017-03-13 21:16 - 2017-04-05 12:49 - 00002165 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\f.lux.lnk 2017-03-13 21:16 - 2017-03-13 21:16 - 00496896 _____ C:\Users\Pascal\Downloads\flux-setup.exe 2017-03-13 21:16 - 2017-03-13 21:16 - 00000000 ____D C:\Users\Pascal\AppData\Local\FluxSoftware 2017-03-11 20:05 - 2017-03-11 20:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light [GOG.com] 2017-03-10 16:59 - 2017-02-23 10:17 - 00136064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2017-03-10 16:59 - 2017-01-26 02:13 - 00103936 _____ C:\Windows\SysWOW64\vulkaninfo.exe 2017-03-10 16:59 - 2017-01-26 02:12 - 00326656 _____ C:\Windows\SysWOW64\vulkan-1.dll 2017-03-10 16:59 - 2017-01-26 02:09 - 00322560 _____ C:\Windows\system32\vulkan-1.dll 2017-03-10 16:59 - 2017-01-26 02:09 - 00118272 _____ C:\Windows\system32\vulkaninfo.exe 2017-03-10 16:57 - 2017-02-24 00:55 - 00047664 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 40192056 _____ C:\Windows\system32\nvcompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 35272760 _____ C:\Windows\SysWOW64\nvcompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 34992184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 19007528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 14674896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 11122728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 11019888 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 09306312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 08990256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 03168192 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 02717752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01985080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6437878.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01589696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6437878.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 01052096 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00989632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00959424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00946456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFTH264.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00944224 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFThevc.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00910784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00721768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFTH264.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00719856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFThevc.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00687408 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00618416 _____ (NVIDIA Corporation) C:\Windows\system32\nvmcumd.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00609728 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00605120 _____ (NVIDIA Corporation) C:\Windows\system32\nvDecMFTMjpeg.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00576008 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00573632 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00499136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00483384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvDecMFTMjpeg.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00447984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\SysWOW64\nv-vk32.json 2017-03-10 16:57 - 2017-02-23 12:32 - 00000669 _____ C:\Windows\system32\nv-vk64.json 2017-03-09 23:56 - 2017-03-09 23:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Just Cause 3 2017-03-09 21:47 - 2017-03-19 20:15 - 00000000 ____D C:\Program Files (x86)\McAfee 2017-03-07 16:17 - 2017-03-07 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultimate Marvel vs. Capcom 3 ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2017-04-06 11:29 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Spotify 2017-04-06 11:05 - 2017-03-02 18:19 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Mozilla 2017-04-06 10:20 - 2016-11-23 22:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Spotify 2017-04-06 10:06 - 2016-07-16 13:36 - 00000000 ____D C:\Windows\CbsTemp 2017-04-06 09:54 - 2016-11-23 21:23 - 00000000 ____D C:\ProgramData\Package Cache 2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-04-06 09:47 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\Macromed 2017-04-06 09:40 - 2017-01-02 22:34 - 00002642 _____ C:\Users\Public\Desktop\Skype.lnk 2017-04-06 09:40 - 2017-01-02 22:34 - 00000000 ____D C:\ProgramData\Skype 2017-04-06 09:40 - 2016-11-23 21:12 - 00000000 ____D C:\Users\Pascal 2017-04-06 09:06 - 2016-07-16 13:45 - 00000000 ____D C:\Windows\INF 2017-04-06 09:03 - 2016-11-23 21:16 - 07102098 _____ C:\Windows\system32\PerfStringBackup.INI 2017-04-06 09:03 - 2016-07-17 00:51 - 03524346 _____ C:\Windows\system32\perfh007.dat 2017-04-06 09:03 - 2016-07-17 00:51 - 00960498 _____ C:\Windows\system32\perfc007.dat 2017-04-06 09:01 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA 2017-04-06 08:58 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\Overwolf 2017-04-06 08:57 - 2016-11-23 21:11 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-04-06 08:57 - 2016-07-16 13:47 - 00000000 ___HD C:\Windows\ELAMBKUP 2017-04-06 08:57 - 2016-07-16 08:04 - 00262144 _____ C:\Windows\system32\config\BBI 2017-04-06 08:15 - 2016-11-23 21:54 - 00000000 ____D C:\Users\Pascal\AppData\Local\SquirrelTemp 2017-04-06 07:41 - 2016-12-19 00:40 - 00004174 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BDE79071-9BD6-497A-92EE-45EFD20BC43B} 2017-04-05 21:55 - 2016-11-23 21:11 - 00000000 ____D C:\Windows\system32\SleepStudy 2017-04-05 21:22 - 2016-11-23 21:49 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\uTorrent 2017-04-05 12:50 - 2017-03-03 11:06 - 00001360 _____ C:\Users\Public\Desktop\Online Manager.lnk 2017-04-05 12:50 - 2017-03-02 18:19 - 00001134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-04-05 12:50 - 2017-03-02 18:19 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-04-05 12:50 - 2017-03-02 18:15 - 00001154 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera 43.lnk 2017-04-05 12:50 - 2017-02-12 19:27 - 00001030 _____ C:\Users\Public\Desktop\WinFF.lnk 2017-04-05 12:50 - 2017-02-12 13:28 - 00001156 _____ C:\Users\Public\Desktop\Adobe Photoshop CS6.lnk 2017-04-05 12:50 - 2017-02-09 11:02 - 00001089 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk 2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\Users\Public\Desktop\Audacity.lnk 2017-04-05 12:50 - 2017-02-09 10:55 - 00000587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk 2017-04-05 12:50 - 2017-02-08 13:30 - 00001483 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2017-04-05 12:50 - 2017-02-07 15:41 - 00001058 _____ C:\Users\Public\Desktop\HiSuite.lnk 2017-04-05 12:50 - 2017-01-30 18:56 - 00001148 _____ C:\Users\Public\Desktop\Overwolf.lnk 2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\Users\Public\Desktop\Epic Games Launcher.lnk 2017-04-05 12:50 - 2017-01-28 21:06 - 00001323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk 2017-04-05 12:50 - 2017-01-27 02:17 - 00001013 _____ C:\Users\Public\Desktop\Mass Effect 3.lnk 2017-04-05 12:50 - 2017-01-27 01:02 - 00000915 _____ C:\Users\Public\Desktop\Mass Effect 2.lnk 2017-04-05 12:50 - 2017-01-26 23:23 - 00000902 _____ C:\Users\Public\Desktop\Mass Effect.lnk 2017-04-05 12:50 - 2017-01-26 21:21 - 00001060 _____ C:\Users\Public\Desktop\Origin.lnk 2017-04-05 12:50 - 2017-01-26 20:24 - 00000908 _____ C:\Users\Public\Desktop\Battle.net.lnk 2017-04-05 12:50 - 2017-01-13 01:06 - 00000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2017-04-05 12:50 - 2016-12-19 00:38 - 00000664 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontier Launchpad.lnk 2017-04-05 12:50 - 2016-11-27 13:37 - 00001371 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-04-05 12:50 - 2016-11-27 13:37 - 00001353 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-04-05 12:50 - 2016-11-23 23:08 - 00000963 _____ C:\Users\Public\Desktop\MegaDownloader.lnk 2017-04-05 12:50 - 2016-11-23 22:55 - 00000842 _____ C:\Users\Public\Desktop\The Sims 3 Complete Collection.lnk 2017-04-05 12:50 - 2016-11-23 21:56 - 00000594 _____ C:\Users\Public\Desktop\Steam.lnk 2017-04-05 12:50 - 2016-11-23 21:47 - 00001755 _____ C:\Users\Public\Desktop\League of Legends.lnk 2017-04-05 12:50 - 2016-11-23 21:38 - 00001321 _____ C:\Users\Public\Desktop\Virtual CloneDrive.lnk 2017-04-05 12:50 - 2016-11-23 21:23 - 00001339 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-04-05 12:49 - 2017-03-03 11:06 - 00001662 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Online Manager.lnk 2017-04-05 12:49 - 2017-03-03 11:06 - 00001372 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Online Manager.lnk 2017-04-05 12:49 - 2017-02-04 17:21 - 00000670 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2.lnk 2017-04-05 12:49 - 2017-01-30 18:56 - 00001287 _____ C:\Users\Pascal\Desktop\TeamSpeak 3 Client.lnk 2017-04-05 12:49 - 2017-01-30 18:56 - 00001245 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk 2017-04-05 12:49 - 2017-01-28 21:47 - 00001158 _____ C:\Users\Pascal\Desktop\Cheat Engine.lnk 2017-04-05 12:49 - 2017-01-27 13:40 - 00000594 _____ C:\Users\Pascal\Desktop\Steam.lnk 2017-04-05 12:49 - 2017-01-26 20:19 - 00001278 _____ C:\Users\Pascal\Desktop\Uplay.lnk 2017-04-05 12:49 - 2017-01-07 15:48 - 00001080 _____ C:\Users\Pascal\Desktop\SpeedFan.lnk 2017-04-05 12:49 - 2017-01-02 12:36 - 00001904 _____ C:\Users\Pascal\Desktop\Roccat Kone XTD Optical.lnk 2017-04-05 12:49 - 2016-12-14 00:44 - 00001766 _____ C:\Users\Pascal\Desktop\Isku FX.lnk 2017-04-05 12:49 - 2016-12-14 00:17 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BlueStacks.lnk 2017-04-05 12:49 - 2016-11-23 22:56 - 00001855 _____ C:\Users\Pascal\Desktop\Spotify.lnk 2017-04-05 12:49 - 2016-11-23 22:56 - 00001841 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2017-04-05 12:49 - 2016-11-23 21:54 - 00002242 _____ C:\Users\Pascal\Desktop\Discord.lnk 2017-04-05 12:49 - 2016-11-23 21:50 - 00002663 _____ C:\Users\Pascal\Desktop\µTorrent.lnk 2017-04-05 12:49 - 2016-11-23 21:14 - 00002390 _____ C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ___RD C:\Windows\PrintDialog 2017-04-05 12:41 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\AppReadiness 2017-04-05 11:42 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\ConnectedDevicesPlatform 2017-04-05 10:23 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\LiveKernelReports 2017-04-05 09:55 - 2016-12-18 20:53 - 00000000 ____D C:\Program Files\Microsoft Office 2017-04-04 16:38 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\TS3Client 2017-04-04 13:53 - 2017-02-10 09:56 - 00004490 _____ C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml 2017-04-04 09:08 - 2016-12-22 00:31 - 00000000 ____D C:\Users\Pascal\Documents\My Games 2017-04-03 19:09 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\Packages 2017-04-03 16:30 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps 2017-04-03 10:15 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\system32\spool 2017-04-02 20:22 - 2016-11-23 21:52 - 00000000 ____D C:\Users\Pascal\AppData\Local\ElevatedDiagnostics 2017-04-02 00:28 - 2017-03-02 18:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-04-02 00:28 - 2016-12-19 23:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-03-28 20:11 - 2016-11-23 21:13 - 00000000 ____D C:\Users\Pascal\AppData\Local\VirtualStore 2017-03-28 14:00 - 2017-02-09 10:55 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Audacity 2017-03-26 23:21 - 2017-01-26 21:21 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Origin 2017-03-26 23:21 - 2017-01-26 21:19 - 00000000 ____D C:\ProgramData\Origin 2017-03-24 19:39 - 2017-01-30 18:56 - 00000000 ____D C:\Users\Pascal\AppData\Local\TeamSpeak 3 Client 2017-03-24 17:21 - 2017-01-30 18:56 - 00000000 ____D C:\Program Files (x86)\Overwolf 2017-03-20 20:00 - 2017-03-06 11:50 - 00000000 ____D C:\Program Files\Common Files\McAfee 2017-03-20 13:41 - 2017-03-06 11:41 - 00000000 ____D C:\ProgramData\McAfee 2017-03-20 11:35 - 2017-02-10 23:01 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\DVDVideoSoft 2017-03-19 14:06 - 2016-12-01 19:54 - 00000000 ____D C:\ProgramData\Steam 2017-03-18 22:11 - 2017-03-02 18:21 - 00000000 ____D C:\Users\Pascal\AppData\LocalLow\Unity 2017-03-17 15:52 - 2017-01-26 20:19 - 00000000 ____D C:\Users\Pascal\AppData\Local\Ubisoft Game Launcher 2017-03-15 19:45 - 2016-11-23 21:12 - 00000000 ____D C:\Users\defaultuser0 2017-03-14 18:00 - 2017-02-09 11:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Sony 2017-03-14 13:08 - 2017-02-21 16:18 - 00000000 ____D C:\Users\Pascal\AppData\Local\LogMeIn Hamachi 2017-03-14 13:08 - 2017-01-23 17:20 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Notepad++ 2017-03-14 13:08 - 2017-01-07 15:48 - 00000000 ____D C:\Program Files (x86)\SpeedFan 2017-03-14 13:08 - 2016-11-23 22:04 - 00000000 ____D C:\Users\Pascal\AppData\Roaming\Skype 2017-03-14 13:08 - 2016-11-23 21:09 - 00000000 ____D C:\Windows\Panther 2017-03-14 13:04 - 2017-02-04 17:15 - 00003464 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-03-14 13:04 - 2017-01-30 18:56 - 00003304 _____ C:\Windows\System32\Tasks\Overwolf Updater Task 2017-03-14 13:02 - 2017-03-02 18:15 - 00003320 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488471357 2017-03-14 13:02 - 2017-02-08 13:29 - 00002956 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2017-02-08 13:29 - 00002838 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2017-02-08 13:29 - 00002786 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-03-14 13:02 - 2016-12-09 22:48 - 00002772 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2 2017-03-14 13:02 - 2016-11-27 13:36 - 00003556 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-03-14 13:02 - 2016-11-27 13:36 - 00003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-03-14 11:03 - 2017-01-26 21:21 - 00000000 ____D C:\Program Files (x86)\Origin 2017-03-11 23:26 - 2017-01-26 20:24 - 00000000 ____D C:\Users\Pascal\AppData\Local\Battle.net 2017-03-11 23:26 - 2017-01-26 20:23 - 00000000 ____D C:\Program Files (x86)\Battle.net 2017-03-10 19:38 - 2016-11-23 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-03-10 16:59 - 2016-11-23 21:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-03-10 07:17 - 2016-07-16 13:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-03-10 07:17 - 2016-07-16 13:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-03-09 14:22 - 2017-03-02 18:15 - 00000000 ____D C:\Program Files\Opera ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2017-02-10 09:56 - 2017-04-04 13:53 - 0004490 _____ () C:\Users\Pascal\AppData\Roaming\VoiceMeeterDefault.xml 2017-04-04 07:50 - 2017-04-05 08:06 - 0000074 _____ () C:\Users\Pascal\AppData\Roaming\WB.CFG 2017-04-05 11:33 - 2017-04-05 11:33 - 0001357 _____ () C:\Users\Pascal\AppData\Local\FredaikisAB - Verknüpfung.lnk 2016-11-23 21:20 - 2016-11-23 21:20 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Dateien, die verschoben oder gelöscht werden sollten: ==================== C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job Einige Dateien in TEMP: ==================== 2017-04-05 11:10 - 2017-04-06 08:58 - 0619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll 2017-04-06 09:40 - 2017-04-06 09:40 - 14456872 _____ (Microsoft Corporation) C:\Users\Pascal\AppData\Local\Temp\vc_redist.x86.exe ==================== Bamital & volsnap ====================== (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2017-04-02 18:44 ==================== Ende von FRST.txt ============================ |
|
06.04.2017, 11:05
| #4 |
| | Nach Adware Angriff,Hijack.Host FRST Additions Logfile: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Pascal (06-04-2017 11:55:33)
Gestartet von C:\Users\Pascal\AppData\Local\Temp\scoped_dir10056_9357
Windows 10 Pro Version 1607 (X64) (2016-11-23 19:12:30)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3959254474-2508283465-2998445632-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3959254474-2508283465-2998445632-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3959254474-2508283465-2998445632-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-3959254474-2508283465-2998445632-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3959254474-2508283465-2998445632-1003 - Limited - Enabled)
Pascal (S-1-5-21-3959254474-2508283465-2998445632-1001 - Administrator - Enabled) => C:\Users\Pascal
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
µTorrent (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\uTorrent) (Version: 3.4.9.43388 - BitTorrent Inc.)
3CXPhone (HKLM-x32\...\{0DF8FA4D-299C-4250-9F09-C14E47E12224}) (Version: 4.0.26523.0 - 3CX)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
AlienFX for IskuFX (HKLM-x32\...\InstallShield_{2C3FC2CC-0A8B-409E-B487-8CD54F4DC1D4}) (Version: 1.02 - Roccat GmbH)
AlienFX for IskuFX (Version: 1.02 - Roccat GmbH) Hidden
Ansel (Version: 378.78 - NVIDIA Corporation) Hidden
Aufstieg des Hexenkönigs™ (HKLM-x32\...\{B931FB80-537A-4600-00AD-AC5DEDB6C25B}) (Version: - )
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.78.7302 - BlueStack Systems, Inc.)
Brawlhalla (HKLM\...\Steam App 291550) (Version: - Blue Mammoth Games)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
Chivalry: Medieval Warfare (HKLM\...\Steam App 219640) (Version: - Torn Banner Studios)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Discord (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
Epic Games Launcher (HKLM-x32\...\{4755FB10-B694-4B0F-BCDE-F390B957CD96}) (Version: 1.1.90.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
f.lux (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Flux) (Version: - )
F1 2016 (HKLM\...\Steam App 391040) (Version: - Codemasters)
FreeArc 0.666 (HKLM-x32\...\FreeArc) (Version: 0.666 - Bulat Ziganshin)
FreeStyle Football (HKLM\...\Steam App 568810) (Version: - Joycity)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
H1Z1: King of the Kill (HKLM\...\Steam App 433850) (Version: - Daybreak Game Company)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kinect for Windows Speech Recognition Language Pack (de-DE) (HKLM-x32\...\{898AA67F-99B8-4C7F-9611-B11F98EF6E78}) (Version: 11.0.7413.611 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32\...\{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32\...\{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32\...\{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32\...\{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.558 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.558 - LogMeIn, Inc.) Hidden
Mafia III (HKLM\...\Steam App 360430) (Version: - Hangar 13)
MAGIX Music Maker 2016 Premium Update (Version: 22.0.3.63 - MAGIX Software GmbH) Hidden
MAGIX Music Maker 2016 Premium Update (Version: 22.0.5.74 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Managed DirectX (0900) (x32 Version: 4.09.00.0900 - Microsoft) Hidden
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Mass Effect™ 2 (HKLM-x32\...\{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}) (Version: 1.2.1604.0 - Electronic Arts)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24516 (HKLM-x32\...\{c325004c-5538-45b3-a7ad-94473a4dcd3b}) (Version: 14.0.24516.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 52.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 52.0.2 (x86 de)) (Version: 52.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MTA:SA v1.5.3 (HKLM-x32\...\MTA:SA 1.5) (Version: v1.5.3 - Multi Theft Auto)
NASCAR® Racing 2003 Season (HKLM-x32\...\{ACC2E059-40E9-4464-B18D-C9BDD9A02CED}) (Version: - Sierra Entertainment)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.3.2 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 378.78 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.4.0.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.4.0.70 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.78 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.23 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.16.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 18.0.1 - OBS Project)
Online Manager (HKLM-x32\...\Online Manager) (Version: 2.02 - Deutsche Telekom AG)
Online Manager (Version: 2.02 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
Opera Stable 43.0.2442.1144 (HKLM-x32\...\Opera 43.0.2442.1144) (Version: 43.0.2442.1144 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 10.4.5.30491 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.103.44.0 - Overwolf Ltd.)
PDF24 Creator 8.1.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PES Professionals Patch 2017 V2 V2 (HKLM-x32\...\PES Professionals Patch 2017 V2 V2) (Version: V2 - PES Professionals)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DG0-PlanetSide 2) (Version: - Sony Online Entertainment)
PlanetSide 2 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\DGC-PlanetSide 2) (Version: 1.0.3.192 - Daybreak Game Company)
Plants vs. Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
RaceRoom Racing Experience (HKLM\...\Steam App 211500) (Version: - Sector3 Studios)
Razer Chroma SDK Core Components (HKLM-x32\...\Razer Chroma SDK) (Version: 1.14.2 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.17.302 - Razer Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7936 - Realtek Semiconductor Corp.)
ROCCAT Isku FX Keyboard Driver (HKLM-x32\...\{DC69933C-E7B0-455D-8E54-FAC1EEF046FF}) (Version: - Roccat GmbH)
ROCCAT Kone XTD Optical Mouse Driver (HKLM-x32\...\{AD43B296-FE63-42C0-AA39-D8759B905420}) (Version: - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0015 - Roccat GmbH)
SafeZone Stable 3.55.2393.596 (x32 Version: 3.55.2393.596 - Avast Software) Hidden
ScpToolkit (HKLM\...\{AC052048-9828-45E3-872B-04CE30A3B58B}) (Version: 1.6.238.16010 - Nefarius Software Solutions)
Scribus 1.4.6 (HKLM-x32\...\Scribus 1.4.6) (Version: 1.4.6 - The Scribus Team)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
Sid Meier's Civilization VI (HKLM\...\Steam App 289070) (Version: - Firaxis)
Skype™ 7.33 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.33.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Spotify (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\Spotify) (Version: 1.0.52.725.g943b26a8 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SuperF4 (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\SuperF4) (Version: 1.3 - Stefan Sundin)
Team Fortress 2 (HKLM\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\TeamSpeak 3 Client) (Version: 3.1.0 - TeamSpeak Systems GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
Unity Web Player (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\UnityWebPlayer) (Version: 5.3.8f1 - Unity Technologies ApS)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3161988) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E1C47F57-5CCA-4077-96A6-7BFD2A026ECD}) (Version: - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
VBCABLE, The Virtual Audio Cable (HKLM\...\VB:VBCABLE {87459874-1236-4469}) (Version: - VB-Audio Software)
Vegas Pro 13.0 (64-bit) (HKLM\...\{D264BD11-6A9B-11E4-A4F7-F04DA23A5C58}) (Version: 13.0.428 - Sony)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
Voicemeeter, The Virtual Mixing Console (HKLM-x32\...\VB:Voicemeeter {17359A74-1236-5467}) (Version: - VB-Audio Software)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
War Thunder (HKLM\...\Steam App 236390) (Version: - Gaijin Entertainment)
WhatsApp (HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\WhatsApp) (Version: 0.2.3699 - WhatsApp)
WinISO (HKLM-x32\...\WinISO) (Version: 6.4.1.6137 - WinISO Computing Inc.)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0DDC38B9-2ABC-4047-A0EB-725D94EF2E32} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {11CA0E95-667E-4E32-9214-B539B21D5954} - System32\Tasks\{5119999D-1353-9A1A-3510-24DD80442935} => C:\Users\Pascal\AppData\Local\Lafesas\sync.exe
Task: {1329C2F6-C4BA-4D0B-ABCF-76C371F1440E} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-03-21] (Overwolf LTD)
Task: {2524814B-75BC-4B9E-905E-D1B4E6C034E0} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {2CB9E534-7179-4767-A507-15226E0FB1E0} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-02-23] (NVIDIA Corporation)
Task: {319CD93D-EFB6-4F43-84EC-4799DA209C36} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-06] (AVAST Software)
Task: {3E251701-C90A-4C21-905A-00FAD98BD76A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {46627DDA-595A-4E74-A24C-B72ECFA99E5E} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-02-23] (NVIDIA Corporation)
Task: {4B22C211-4B14-4CAB-A75A-C9798A378749} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {539F7043-4785-4A26-AB46-A96DF2BC3B3C} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-02-23] (NVIDIA Corporation)
Task: {5F906855-AC11-46CB-AE0F-457BE062401C} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {7F828514-1063-4857-B54D-6F287D51BEED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {86FFF51A-B889-4EAE-8744-FADCC6282324} - System32\Tasks\SafeZone scheduled Autoupdate 1491464191 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)
Task: {8823F342-6FC1-4DB1-81FB-EE2171B3589C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {89AB2E6E-B3BF-4EA7-AF6C-08572CD29D63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-27] (Google Inc.)
Task: {9B2F52A4-3F4F-4B00-B4E6-C770E1E72CC9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {AC1D292C-3B38-4F40-87EC-72770B25CF58} - System32\Tasks\Opera scheduled Autoupdate 1488471357 => C:\Program Files\Opera\launcher.exe [2017-02-27] (Opera Software)
Task: {B452DF3B-CC73-4F26-A9C9-9A5A4F15807F} - System32\Tasks\updater => C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpUpdater.exe [2016-01-10] (Nefarius Software Solutions)
Task: {B534A77D-568D-4D49-AE5F-C04943B3A13E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-06] (Adobe Systems Incorporated)
Task: {C2236E80-FF55-4AF3-8983-DA0EC61C4DB6} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-02-19] (Adobe Systems Incorporated)
Task: {C6A26BAC-D09E-4E22-8038-0C16A4D473BA} - System32\Tasks\Cdusmezeent Engine => C:\Program Files (x86)\Ghezeentghicay\zernly.exe
Task: {C936D059-AE7D-42A9-974D-A8BEA5AC2F63} - System32\Tasks\{BF57B4F5-D0F8-4F2C-A03D-C8454499F1F5} => pcalua.exe -a D:\eauninstall.exe -d D:\
Task: {E1784AF7-9DBF-45E7-91A2-E7B1D24CD587} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-06] (AVAST Software)
Task: {F48C5C35-1CE4-4B3C-A780-ECDCC01B63CD} - System32\Tasks\{CE264F75-6856-4478-A803-8B4425BE3F9B} => pcalua.exe -a "C:\Program Files (x86)\Common Files\ZumFix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\ZumFix\uninstall.dat" -a uninstallme 107D25D2-8157-4685-A6F7-6B6BC6263AA7 DeviceId=3be95ac1-32fa-4efb-d976-f9ecc5042de7 BarcodeId=51557003 ChannelId=3 DistributerName=APSFWemonetize
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\{5119999D-1353-9A1A-3510-24DD80442935}.job =>
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-11-23 21:24 - 2017-02-23 10:28 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-04-02 18:45 - 2017-04-02 18:45 - 00309760 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\ReactiveSockets\ced6a6793b1806f6dbe2e73d73a91244\ReactiveSockets.ni.dll
2014-05-02 11:52 - 2014-05-02 11:52 - 00599040 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\irrKlang.NET4.dll
2014-05-02 06:55 - 2014-05-02 06:55 - 00185344 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpflac.dll
2014-05-02 06:05 - 2014-05-02 06:05 - 00173056 _____ () C:\Program Files\Nefarius Software Solutions\ScpToolkit\irrKlang\amd64\ikpmp3.dll
2016-11-25 08:16 - 2016-11-25 08:16 - 00192200 _____ () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
2017-02-08 13:29 - 2017-02-23 20:35 - 04489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-25 01:20 - 2016-09-25 01:21 - 00189264 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-12-15 14:15 - 2016-12-09 12:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-11-15 16:22 - 2016-11-15 16:22 - 08909504 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-02-13 00:31 - 2017-02-13 00:31 - 00230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2016-11-23 21:41 - 2016-09-07 06:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 18:48 - 2016-12-21 09:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-22 11:19 - 2017-02-22 11:19 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-22 11:19 - 2017-02-22 11:19 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 13:30 - 2017-02-06 13:30 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 02259968 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\ffmpeg.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 02917376 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\libglesv2.dll
2017-04-06 08:15 - 2017-03-09 17:31 - 00095232 _____ () C:\Users\Pascal\AppData\Local\WhatsApp\app-0.2.3699\libegl.dll
2017-04-06 08:58 - 2017-04-06 08:58 - 00486912 _____ () \\?\C:\Users\Pascal\AppData\Local\Temp\71A5.tmp.node
2017-01-19 05:22 - 2017-01-19 05:22 - 00298448 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
2017-01-11 18:48 - 2016-12-21 08:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 18:48 - 2016-12-21 08:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 18:48 - 2016-12-21 08:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 53908056 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_browser.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 59948632 _____ () C:\Program Files\Opera\43.0.2442.1144\opera_child.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 02559576 _____ () C:\Program Files\Opera\43.0.2442.1144\libglesv2.dll
2017-03-02 18:15 - 2017-02-27 10:19 - 00100952 _____ () C:\Program Files\Opera\43.0.2442.1144\libegl.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2017-02-10 23:01 - 2017-02-08 16:11 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2017-01-26 21:21 - 2017-03-14 11:03 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 03774400 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2017-02-08 13:29 - 2017-02-23 20:35 - 00900032 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-04-05 11:10 - 2017-04-06 08:58 - 00619616 _____ () C:\Users\Pascal\AppData\Local\Temp\0Kraken71ChromaDevProps.dll
2017-03-21 22:03 - 2017-03-21 22:03 - 67310648 _____ () C:\Program Files (x86)\Overwolf\0.103.44.0\libcef.DLL
2016-12-14 00:42 - 2012-07-08 17:31 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\hiddriver.dll
2017-01-02 12:34 - 2014-03-18 10:45 - 00045056 _____ () C:\Program Files (x86)\ROCCAT\Kone XTD Optical Mouse\hiddriver.dll
2017-02-20 10:10 - 2017-02-20 10:10 - 00143824 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 50656768 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 01874944 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll
2017-01-05 10:42 - 2016-10-08 09:13 - 00075264 _____ () C:\Users\Pascal\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll
2017-02-08 13:29 - 2017-02-23 16:30 - 00338488 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00252352 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2017-02-08 13:29 - 2017-02-23 16:30 - 02443320 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00385592 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2017-02-08 13:30 - 2017-02-23 16:30 - 00543288 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2017-02-08 13:29 - 2017-02-23 16:30 - 00468536 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-11-15 16:23 - 2016-11-15 16:23 - 08909504 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-04-06 09:35 - 2017-04-06 09:35 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [432]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [432]
AlternateDataStreams: C:\Users\Pascal:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\Pascal\Anwendungsdaten:NT2 [432]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Pascal\AppData\Roaming:NT2 [432]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-07-16 13:47 - 2017-04-06 10:20 - 00007580 ____A C:\Windows\system32\Drivers\etc\hosts
1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
92.53.119.169 a.bf-ad.net
92.53.119.169 a.visualrevenue.com
92.53.119.169 a1.vdna-assets.com
92.53.119.169 a248.e.akamai.net
92.53.119.169 aax.amazon-adsystem.com
92.53.119.169 ad.crwdcntrl.net
92.53.119.169 ad.mail.ru
92.53.119.169 ade.clmbtech.com
92.53.119.169 ads.adfox.ru
92.53.119.169 ads.pubmatic.com
92.53.119.169 apis.google.com
92.53.119.169 asset.pagefair.net
92.53.119.169 assets.adobedtm.com
92.53.119.169 assets.flocktory.com
92.53.119.169 autocontext.begun.ru
92.53.119.169 b.grvcdn.com
92.53.119.169 b.ns1p.net
92.53.119.169 b.scorecardresearch.com
92.53.119.169 b.wal.co
92.53.119.169 babator-stg-cdn.babator.com
92.53.119.169 beacon.krxd.net
92.53.119.169 beacon.walmart.com
92.53.119.169 c.amazon-adsystem.com
92.53.119.169 c.vepxl1.net
92.53.119.169 c2.taboola.com
92.53.119.169 cdn.3lift.com
92.53.119.169 cdn.admixer.net
92.53.119.169 cdn.brcdn.com
92.53.119.169 cdn.cxense.com
92.53.119.169 cdn.interactivemedia.ne
92.53.119.169 cdn.krxd.net
92.53.119.169 cdn.lenmit.com
92.53.119.169 cdn.livefyre.com
92.53.119.169 cdn.m-pathy.com
92.53.119.169 cdn.mathjax.org
92.53.119.169 cdn.mxpnl.com
92.53.119.169 cdn.onthe.io
92.53.119.169 cdn.optimizely.com
92.53.119.169 cdn.prom.st
92.53.119.169 cdn.pushwoosh.com
92.53.119.169 cdn.scarabresearch.com
92.53.119.169 cdn.taboola.com
92.53.119.169 cdn.taplytics.com
92.53.119.169 cdn.tt.omtrdc.net
92.53.119.169 cdn.unid.go.com
92.53.119.169 cdn1.graphiq.com
92.53.119.169 cdn3.optimizely.com
92.53.119.169 cdnjs.cloudflare.com
92.53.119.169 cdnssl.clicktale.net
92.53.119.169 comet.yahoo.com
92.53.119.169 consent.truste.com
92.53.119.169 content.adriver.ru
92.53.119.169 contextual.media.net
92.53.119.169 cstatic.weborama.fr
92.53.119.169 d134l0cdryxgwa.cloudfront.net
92.53.119.169 d2oh4tlt9mrke9.cloudfront.net
92.53.119.169 dpm.demdex.net
92.53.119.169 e.monetate.net
92.53.119.169 edge.quantserve.com
92.53.119.169 edx-uk.s3ae.com
92.53.119.169 eu-services.babator.com
92.53.119.169 fc.yahoo.com
92.53.119.169 gaua.hit.gemius.pl
92.53.119.169 gde-default.hit.gemius.pl
92.53.119.169 go.flx1.com
92.53.119.169 googleadservices.com
92.53.119.169 hpr.outbrain.com
92.53.119.169 i.cricketcb.com
92.53.119.169 i.tfag.de
92.53.119.169 ib.adnxs.com
92.53.119.169 imagesrv.adition.com
92.53.119.169 img.imgsmail.ru
92.53.119.169 img7.auto.ria.com
92.53.119.169 j.ophan.co.uk
92.53.119.169 js-agent.newrelic.com
92.53.119.169 js-sec.indexww.com
92.53.119.169 js.revsci.net
92.53.119.169 js.ui-portal.de
92.53.119.169 kamradamnaradost.ru
92.53.119.169 kpmediagaua.hit.gemius.pl
92.53.119.169 level1cdn.com
92.53.119.169 mc.yandex.ru
92.53.119.169 ml314.com
92.53.119.169 mtrx.go.sonobi.com
92.53.119.169 ninja.onap.io
92.53.119.169 o.aolcdn.com
92.53.119.169 odb.outbrain.com
92.53.119.169 ok-bar.love.mail.ru
92.53.119.169 ok-portal.mail.ru
92.53.119.169 optimize-stats.voxmedia.com
92.53.119.169 p.d.0fmm.com
92.53.119.169 p.t-online.de
92.53.119.169 pagead2.googlesyndication.com
Da befinden sich 60 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3959254474-2508283465-2998445632-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pascal\Pictures\Cool_Desktop_Wallpapers_with_Nvidia_Logo_in_Black_and_Green-1360x768.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run32: => "Avira SystrayStartTrigger"
HKLM\...\StartupApproved\Run32: => "avgnt"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Gaijin.Net Agent"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "SuperF4"
HKU\S-1-5-21-3959254474-2508283465-2998445632-1001\...\StartupApproved\Run: => "f.lux"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{6DC6B0E4-B86F-453F-AFA5-E4839E53DD7D}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{D4D10190-59E1-4A96-8D8E-793DDBB2D763}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{772F321C-16DF-4C1F-A0F6-63CAF831811D}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{BEA8259B-7D01-44A2-9FF6-25124EF224D2}] => (Allow) E:\Neuer Ordner\Steam.exe
FirewallRules: [{FAACF73E-D625-44CD-853F-891509F551B2}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{D2B0BC15-D518-4585-AB3E-47A7700B4AA4}] => (Allow) E:\Neuer Ordner\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{C50678ED-E3F3-4AA3-9A6C-3069F6CDB719}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{EFACD55C-979F-4E4B-9AF0-A7CC9B48F74B}C:\users\pascal\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\pascal\appdata\roaming\spotify\spotify.exe
FirewallRules: [{4705292B-D46B-4A3D-B527-3783D8E1AE3C}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe
FirewallRules: [{786F89FF-F2FB-4A85-84B2-4F898D864FE0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
==================== Wiederherstellungspunkte =========================
17-03-2017 11:44:32 DirectX wurde installiert
24-03-2017 20:48:55 Geplanter Prüfpunkt
01-04-2017 20:18:07 DirectX wurde installiert
03-04-2017 20:19:35 DirectX wurde installiert
05-04-2017 11:29:54 Nach dem Adware angriff
05-04-2017 21:27:17 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: LogMeIn Hamachi Virtual Ethernet Adapter
Description: LogMeIn Hamachi Virtual Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn Inc.
Service: Hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "WmiApRpl" in der DLL "C:\Windows\system32\wbem\wmiaprpl.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.
Error: (04/06/2017 11:03:32 AM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Das Serverdienst-Leistungsobjekt kann nicht geöffnet werden. Die ersten vier Bytes (DWORD) des Datenabschnitts enthalten den Statuscode.
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "MSDTC" in der DLL "C:\Windows\system32\msdtcuiu.DLL" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "Lsa" in der DLL "C:\Windows\System32\Secur32.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "ESENT" in der DLL "C:\Windows\system32\esentprf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (04/06/2017 11:03:32 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (04/06/2017 11:03:31 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm League of Legends.exe, Version 7.7.182.1428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11bc
Startzeit: 01d2aeb2423b1a5c
Beendigungszeit: 4294967295
Anwendungspfad: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.169\deploy\League of Legends.exe
Berichts-ID: e71524e6-1aa7-11e7-a2dd-7085c209549d
Vollständiger Name des fehlerhaften Pakets:
Auf das fehlerhafte Paket bezogene Anwendungs-ID:
Error: (04/06/2017 09:35:28 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST Software\Avast\setup\iplugins\IStats.dll".
Die abhängige Assemblierung "Avast.VC110.CRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/06/2017 07:40:57 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
Systemfehler:
=============
Error: (04/06/2017 11:03:24 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 09:54:13 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 08:59:16 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Avira Webschutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der Dienst konnte nicht gestartet werden.
Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Avira Email-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der Dienst konnte nicht gestartet werden.
Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.
Error: (04/06/2017 08:59:16 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.
Error: (04/06/2017 08:57:50 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (04/06/2017 08:57:50 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (04/06/2017 08:57:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinDefend" wurde aufgrund folgenden Fehlers nicht gestartet:
Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.
CodeIntegrity:
===================================
Date: 2017-04-06 11:53:07.421
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:53:07.410
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.426
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 11:52:15.356
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:57:49.637
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-04-06 08:12:41.630
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:41.560
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:07.830
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:12:07.815
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.103.44.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-04-06 08:11:36.702
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvspcap64.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 30%
Installierter physikalischer RAM: 16321.99 MB
Verfügbarer physikalischer RAM: 11304.32 MB
Summe virtueller Speicher: 18753.99 MB
Verfügbarer virtueller Speicher: 12596.12 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:232.44 GB) (Free:90 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.41 GB) (Free:129.29 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C802C2A9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C802C2D1)
Partition 1: (Not Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
06.04.2017, 11:08
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Bitte Avast deinstallieren, am besten mit revo. Das Teil können wir einfach nicht mehr guten Gewissens empfehlen. => Antivirensoftware: Schutz Für Ihre Dateien, Aber Auf Kosten Ihrer Privatsphäre? | Emsisoft Blog Auch andere Freewareanbieter wie Avira, AVG oder Panda springen auf diesen oder ähnlichen Zügen rauf, basteln Junkware in die Setups, arbeiten mit ASK zusammen etc; so was ist bei Sicherheitssoftware einfach inakzeptabel. Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Gib Bescheid wenn Avast weg ist; wenn wir hier durch sind, kannst du auf einen anderen Virenscanner umsteigen, Infos folgen dann im Abschlussposting. Bitte JETZT nix mehr ohne Absprache installieren!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
06.04.2017, 11:15
| #6 |
| | Nach Adware Angriff,Hijack.Host Avast ist runter. |
|
06.04.2017, 11:20
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.04.2017, 11:35
| #8 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter ---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.3.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 10.0.9200 Windows 10 x64
Account is Administrative
Internet Explorer version: 11.576.14393.0
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 3.192000 GHz
Memory total: 17114845184, free: 13719511040
Downloaded database version: v2017.04.06.02
Downloaded database version: v2017.04.02.01
Downloaded database version: v2017.04.03.01
=======================================
Initializing...
Driver version: 0.3.0.4
------------ Kernel report ------------
04/06/2017 12:23:49
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\cng.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volume.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\drivers\iorate.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\ElbyCDIO.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_a140581a8f8b58b7\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_2a6e383a1adc0e24\nvlddmkm.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\e1i63x64.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\nvvhci.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\ScpVBus.sys
\SystemRoot\System32\drivers\VClone.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\system32\DRIVERS\vbaudio_vmvaio64_win7.sys
\SystemRoot\system32\DRIVERS\vbaudio_cable64_win7.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\fwlanusb6.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\wcifs.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\wcnfs.sys
\SystemRoot\System32\drivers\registry.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\system32\drivers\mmcss.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\Windows\system32\drivers\rzpnk.sys
\??\C:\Windows\system32\drivers\rzpmgrk.sys
\??\C:\Windows\SysWoW64\speedfan.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\drivers\WinisoCDBus.sys
\SystemRoot\System32\drivers\condrv.sys
\SystemRoot\System32\drivers\tunnel.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
----------- End -----------
Done!
Scan started
Database versions:
main: v2017.04.06.02
rootkit: v2017.04.02.01
<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffac09534ee060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffac09534eeae0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffac09534ee060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffac0952341690, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b16c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b19400, DeviceName: \Device\00000032\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffac09534ef060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffac0953404ae0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffac09534ef060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffac0952b14c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952b15e40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffac0952a83060, DeviceName: \Device\00000031\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C802C2A9
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition is bootable
Partition file system is NTFS
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953312768
Partition is not bootable
Partition file system is NTFS
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 1000204886016 bytes
Sector size: 512 bytes
Done!
Drive 1
This is a System drive
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C802C2D1
Partition information:
Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 487469056
Partition is not bootable
Partition file system is NTFS
Partition 1 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 487471104 Numsec = 921600
Partition is not bootable
Partition file system is NTFS
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 250059350016 bytes
Sector size: 512 bytes
Done!
File "C:\Users\Pascal\AppData\Local\Comms\UnistoreDB\store.vol" is sparse (flags = 32768)
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Infected: C:\Windows\System32\drivers\etc\hosts --> [Hijack.HostFile]
Scan finished
Creating System Restore point...
Cleaning up...
Removal successful. No system shutdown is required.
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-487471104-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removal finished
|
|
06.04.2017, 11:48
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Anleitung richtig lesen - richtiges Log posten.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.04.2017, 11:50
| #10 |
| | Nach Adware Angriff,Hijack.HostCode:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2017.04.06.02
rootkit: v2017.04.02.01
Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]
06.04.2017 12:23:53
mbar-log-2017-04-06 (12-23-53).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309147
Time elapsed: 8 minute(s), 13 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 92
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a.bf-ad.net ) Good: () -> Replace on reboot. [607a5a938622d660308039119d6413ed]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [efeb32bbf6b22e08a50b99b1ba47926e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [1dbd2ebf1e8ac86e8729e5659869b34d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl.) Good: () -> Replace on reboot. [e1f939b40c9cc86ee0d082c824ddd030]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [e7f3c825317770c65f518ac0df2251af]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [f6e4737ab4f4e254c3ed1a30fc05f50b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czz) Good: () -> Replace on reboot. [a139ea0324846dc9139d07439f621ae6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czz) Good: () -> Replace on reboot. [4e8c14d9ebbd66d005ab96b451b002fe]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsy) Good: () -> Replace on reboot. [fddd5d905553290d8d236fdbdf22db25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzsy) Good: () -> Replace on reboot. [8456a845efb92214b7f990baf90845bb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzx) Good: () -> Replace on reboot. [5486cc2180281a1cded2b595e918b44c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [12c82bc220881125555beb5f1ae7926e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [6f6b07e6bcec7fb7cbe5b3977a87a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [4e8cab4205a3a393f4bc59f142bfdb25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [b822f1fcd4d41c1a3c7473d708f905fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [86548b628127979f4a6679d17f829967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.) Good: () -> Replace on reboot. [8357c726b2f6b482129ec28842bfad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [8e4c5a93a008a195e5cbad9dc73a0bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
127.0.0.1 www.czzsyzx) Good: () -> Replace on reboot. [895128c5a800db5bcae64bffa25f5ba5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [786232bbd1d73204f4bc76d4b24f9b65]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [eaf043aa3672072ffdb392b80af7d030]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [d406717c1791fd39f5bbf1596d943dc3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czz) Good: () -> Replace on reboot. [a03ada13deca290d931d0941926f10f0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czz) Good: () -> Replace on reboot. [37a379748b1d251109a7c981da279769]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzs) Good: () -> Replace on reboot. [a83249a4396f70c67937af9be51cac54]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzs) Good: () -> Replace on reboot. [8753e20b941438feb8f8f45638c9e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [5d7d97565a4e4de9fdb3d07aaf526898]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [0ad018d503a550e6b7f92b1fda2743bd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [eeecf1fc3c6c9e98169a1a30e8197789]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [4496cc2106a28caacbe554f6778a738d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.cz) Good: () -> Replace on reboot. [1fbb628b8f194cea8927a2a89a6711ef]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [43975c91bcec52e44b651b2fd42df10f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsy) Good: () -> Replace on reboot. [bd1d7a73c5e3eb4bd0e057f3c8393fc1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
127.0.0.1 www.czzs) Good: () -> Replace on reboot. [439718d5e6c20036b9f73416c0412ed2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [fcdec12cd5d30b2b515f69e1b44db54b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [7c5e638adbcd092d525e08428c754bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyzx) Good: () -> Replace on reboot. [c218ce1f4860b581169ab9918c75fb05]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [6a700de06246f442803087c391702cd4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [1ebc727b10981224218f0c3e6998916f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [904a925b1395fa3cfbb5a2a860a1e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [706a836a258347efbdf30446f11044bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [4a909e4fb2f639fd911fb29811f0e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.) Good: () -> Replace on reboot. [0cce2dc08c1ce0563779123850b107f9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 ) Good: () -> Replace on reboot. [499132bb01a776c059578bbf22df3bc5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [bd1dcc21565286b0149ca3a7ce33b14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czzs) Good: () -> Replace on reboot. [eaf08d608523e84e2789b19923de8878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [ae2c00ed9711af87585819312ad7f20e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.) Good: () -> Replace on reboot. [cd0da6475a4ef83ea40c3e0c6f928779]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [aa30b5380c9c7cba1d93aaa0d62b0af6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [ffdb5d90a800e155e0d0aaa02ad72bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [f6e41bd27f29c274f7b91139fa072bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 1.www.czzsyzgm.com
127.0.0.1 www.czzsyzx) Good: () -> Replace on reboot. [f5e5d617bbed34022c842c1e1ee327d9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [62788469713772c4f8b86fdba160728e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.c) Good: () -> Replace on reboot. [29b1d31a6048989e416fd674709143bd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www) Good: () -> Replace on reboot. [904ad21b5454df57cde346046e93936d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [03d7e30a2187ab8b565a4703ba47b947]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [31a918d55f4947ef0aa6450526db0cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [39a103ea6840bc7a4967034703fe2ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.) Good: () -> Replace on reboot. [4e8c44a9268241f5c6eab59515ec5ca4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
1) Good: () -> Replace on reboot. [08d2618cc9dfc86ef7b995b5ce332fd1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [d80234b9ccdcfe38139de66408f90cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www) Good: () -> Replace on reboot. [9e3c0de00e9a69cdac04d17933ce3bc5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czz) Good: () -> Replace on reboot. [ae2c20cd11974bebe0d08dbd50b1b749]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.c) Good: () -> Replace on reboot. [22b800edb3f565d1f4bc410934cd0cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
1) Good: () -> Replace on reboot. [7565b13cc5e34de9d7d94efcd32e19e7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [32a822cb9216e6508a26ff4bf40d0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [6b6f7875e2c65dd9159bcc7e11f037c9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (gm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.) Good: () -> Replace on reboot. [f0ea7e6f28801c1abff1b991f50c23dd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [9842c627e0c84fe7f8b8cf7b9e63b44c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.c) Good: () -> Replace on reboot. [1dbd16d7c7e1191d941c76d406fbc838]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.) Good: () -> Replace on reboot. [6773707dddcb3501e2ced47633cebd43]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czzsy) Good: () -> Replace on reboot. [c81206e78820e94d2987024811f035cb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [23b78e5f6e3aa1958a2697b3a45dc13f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [3c9edb12c7e12c0ac0f0dc6e16ebfd03]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [a8323ab3446446f0832d4bff52af916f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.) Good: () -> Replace on reboot. [8159d21b71376fc7624e52f8d130a65a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com) Good: () -> Replace on reboot. [6179faf3307860d6892751f9a35e47b9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
12) Good: () -> Replace on reboot. [02d8f2fbbcecc1757937c48628d90000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (yzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0) Good: () -> Replace on reboot. [fae0df0e6b3d1d193f71a7a32bd6e61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (yzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [627810dd1692b3830ea279d1bc45c739]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (ww.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127) Good: () -> Replace on reboot. [13c7d617c5e339fd3c7493b748b9b14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m.com
127.0.0.1 www.czzsyzxl.com
12) Good: () -> Replace on reboot. [5b7fd21b792f270f3e7253f74cb56a96]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
127.0.0.1 www.czzsyzxl.com
1) Good: () -> Replace on reboot. [0fcb9c51dccc52e499170644ad54ae52]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (zzsyzgm.com
127.0.0.1 www.czzsyzxl.) Good: () -> Replace on reboot. [03d71ecf248478becfe10644639e2bd5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (czzsyzgm.com
127.0.0.1 www.czzsyzxl.) Good: () -> Replace on reboot. [cb0f7d7041679a9cf2be9eac18e9dd23]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
1.www.czzsyzgm.com
127.0.0.1 www.czzsyz) Good: () -> Replace on reboot. [439718d5e5c3e452555bcf7b17ea0bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (1.www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.co) Good: () -> Replace on reboot. [f4e61dd0edbb2d093f715bef3bc635cb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.com
12) Good: () -> Replace on reboot. [d5057e6f664205318d235cee8a7705fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (w.czzsyzgm.com
127.0.0.1 www.czzsyzxl) Good: () -> Replace on reboot. [15c54ba2693fcd691f91094108f9d42c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.com
127.0) Good: () -> Replace on reboot. [25b5bd30396f52e4dfd1b4960ef3e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (syzgm.com
127.0.0.1 www.czzsyzxl.com
) Good: () -> Replace on reboot. [b42637b64a5e290d5a5650faf40dde22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.czzsyzgm.com
127.0.0.1 www.czzsyzx) Good: () -> Replace on reboot. [2eac8568a7016fc7dad655f5f50c32ce]
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
06.04.2017, 12:07
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Du sollst was machen wenn MBAR fündig wurde?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.04.2017, 15:29
| #12 |
| | Nach Adware Angriff,Hijack.Host Läuft gerade Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2017.04.06.02
rootkit: v2017.04.02.01
Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]
06.04.2017 13:12:48
mbar-log-2017-04-06 (13-12-48).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309154
Time elapsed: 8 minute(s), 10 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 91
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a.visualrevenue.com ) Good: () -> Replace on reboot. [62788d6041679a9cd8d89eacd22fc739]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [3e9c24c963459e9806aacf7b22df44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [2fab16d7891fc472ab054109cb368977]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [8d4d7d70e8c0e94da10fa9a1ce3357a9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [904a4aa3e1c7bf773c7452f825dc4bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [ba2044a9ccdcf93db6fa88c2c73a2ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [2baf00ed4266e94dc7e925250df40df3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
x) Good: () -> Replace on reboot. [607a14d9c7e16dc903ad39119869cb35]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
x) Good: () -> Replace on reboot. [23b7d01d218760d6dad6c882a1601de3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.) Good: () -> Replace on reboot. [6d6da64717915adca9071139ae538c74]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [5f7b07e63e6a42f4f4bc0446738e9070]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [c21835b8ccdc47efd7d98ac0d82939c7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [e3f7f6f7bfe9280e0da3b991ab5626da]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
1) Good: () -> Replace on reboot. [5c7e925b733539fd0da350fac14015eb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [ae2c2cc118904aecf9b7440612efaa56]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.c) Good: () -> Replace on reboot. [d8025d90dbcdf244d9d7ef5b34cd5ea2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [d40699541098ba7ca60a7cce8f720ef2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
xl.) Good: () -> Replace on reboot. [29b1ffee792ffd39832d202af30e1be5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [409ad5188c1c60d6bdf31b2fe61bba46]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1 union.baidu2019.com
xl.com
12) Good: () -> Replace on reboot. [6e6c727b02a683b33e7246047190a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [904ae5084e5aca6c238d242660a1966a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [5288509db8f053e3149c400ab64b22de]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [8a50c528d7d155e13779e169976ab14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [c61435b83a6e1a1c7838a4a6e819e818]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [8e4c45a8decabf778f2179d15fa25da3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [16c49b525652989ea40c36149071b64a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [a63405e807a1e84ea60a78d2818024dc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [42985f8e2f79979f7e32fc4ee12048b8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [5f7bf7f6bfe9072f169a33178f728d73]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com) Good: () -> Replace on reboot. [4397fbf2beea0234c5eb5eec5fa21ee2]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [dcfe4f9ecbddb581317f1535a0617c84]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
x) Good: () -> Replace on reboot. [0ecc638a7335b77fe5cb5cee30d1df21]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [eaf08c611f89ce681a96153556abc937]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [8b4fcc21d8d06ec857590743907129d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [0bcf559815932115ebc51f2be120a65a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl.) Good: () -> Replace on reboot. [0ad034b9f8b06accb4fc0f3b43be44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [da00ae3f495f47ef4a669fab33cec13f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [d2086d80693fec4a4967183214ed7d83]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [6872737a0d9b66d006aa202a40c130d0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [cd0d37b69414f343218f143621e07987]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [1ac0529b96129a9cfbb562e818e9e61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
127.0.) Good: () -> Replace on reboot. [16c4cf1e9c0cb185c1ef96b4768b46ba]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1 union.baidu2019.com
xl.com
127.0.0.1 ) Good: () -> Replace on reboot. [2fabd01d6e3ab284c8e828223cc53ac6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1 union.baidu2019.com
xl.com
12) Good: () -> Replace on reboot. [26b4dd101b8df93d2d833a10a55c44bc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [706a9b5243652e08b2fe5febb84947b9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [4d8d7677c7e1072fa20eb7937e83669a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [a83209e45c4c3402d3dd2e1c4fb220e0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [20ba6b821692ba7c882863e712ef857b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.com
12) Good: () -> Replace on reboot. [ae2c7f6ed8d063d3c8e83c0e0ef37f81]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [18c28568594f54e2961a3e0c48b98878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
127.0.0.1 union.baidu2019.com
xl.) Good: () -> Replace on reboot. [409ab6375256e155555b4505f70aac54]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [568437b6882055e15957183244bd59a7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.co) Good: () -> Replace on reboot. [5c7ebb32a107290d7b357fcb9d64ad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.) Good: () -> Replace on reboot. [be1c9b528127ee487f3183c759a8b64a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [48926a8316920a2cf0c06fdbfb0650b0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [0dcdf1fca2061b1bd0e01b2fca37e719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [dcfea4498523a78f5f51e961c839629e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [499199543276c472e3cde66461a0f50b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
127) Good: () -> Replace on reboot. [f1e94da07d2b142287294a00ed1438c8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [3d9d8865e6c205310aa69ab0827f31cf]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.) Good: () -> Replace on reboot. [d901af3e5e4ad95d8c24d575db266b95]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [479315d86b3ded49e3cd9baf4ab7f30d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com) Good: () -> Replace on reboot. [9941618c02a62d092a8668e257aa8878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.com
127) Good: () -> Replace on reboot. [23b788650e9ac175a60ad476010018e8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [b62486676d3b9d996b45103a3ec3ee12]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
xl.com
1) Good: () -> Replace on reboot. [499144a920887cba69473812f70ade22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1 union.baidu2019.com
xl.com
127.0.0.1 ) Good: () -> Replace on reboot. [2ab041ac792f2412ffb174d6847d21df]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [31a99b5223852412169a2921bf4242be]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.co) Good: () -> Replace on reboot. [4b8f36b7931526107d334efc3dc419e7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.c) Good: () -> Replace on reboot. [20bad518198f0630e9c72525f11017e9]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
x) Good: () -> Replace on reboot. [508a74791296cb6b4e62bd8d0ff2d927]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [ad2d40ad4860cd6903adc98150b1fc04]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [c81257964860e254129e0743c938f40c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [27b3f0fdaff955e1a808381220e1a759]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.c) Good: () -> Replace on reboot. [f2e81ecf5157ee482f81ce7c5ca5fd03]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [4d8d4aa3ccdce1551f91e26804fdb34d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.com
127.) Good: () -> Replace on reboot. [8357e904edbbd3630ca4e66403fed927]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
xl.com
127.0.0.1) Good: () -> Replace on reboot. [ffdba746dccc4cea179966e4d42d7c84]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
xl.com
12) Good: () -> Replace on reboot. [19c1e30a278178be8c243b0f05fc40c0]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
xl.com
127.0) Good: () -> Replace on reboot. [f7e38f5e9d0b95a12f81c08afe03fc04]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1 union.baidu2019.com
xl.com
127.) Good: () -> Replace on reboot. [a93118d5693fee4806aa4307ae5322de]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
xl.com
127) Good: () -> Replace on reboot. [9644707dcddbeb4bab0591b946bba759]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [5a8034b9792fd75faa06b09a69989967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.co) Good: () -> Replace on reboot. [9248905d347465d1c2ee9fab0ff2ce32]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
xl) Good: () -> Replace on reboot. [5585ed0056520d29654b9ab0e120bf41]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [9446db1261471d197b358cbe41c00cf4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com
127.) Good: () -> Replace on reboot. [f0ea8c617a2e2a0c6749381214ed0af6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
xl.c) Good: () -> Replace on reboot. [4e8c38b54167d363713fc387a45df907]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com
127.0.0) Good: () -> Replace on reboot. [32a8db12c0e8f93db8f862e8e0213ac6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
xl.com
) Good: () -> Replace on reboot. [e2f801eca60243f37b35b09a946d8b75]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
xl.) Good: () -> Replace on reboot. [fddd4ca1179178be743cd179c938c33d]
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Hijack kommt immer wieder : Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2017.04.06.02
rootkit: v2017.04.02.01
Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Pascal :: DESKTOP-NBS516K [administrator]
06.04.2017 16:16:02
mbar-log-2017-04-06 (16-16-02).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 309681
Time elapsed: 8 minute(s), 59 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 90
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 92.53.119.169 a1.vdna-assets.com ) Good: () -> Replace on reboot. [ae2cfeef0c9c0f27d0e0cc7e3ac7a060]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
9) Good: () -> Replace on reboot. [ac2e14d9e8c0c76f0aa63a1025dc3fc1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [f7e3f7f6beea082e1e92f456ea1712ee]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [37a3ab42cfd94bebd1df46045ba629d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [7565d21b98101c1ac7e94604877a6f91]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [30aa608ddcccd264783871d9a55c7987]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [588245a8b7f160d6dcd405456d94d729]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [d90116d760483df91b95fd4df70a9d63]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [5882e10c4e5a71c5f8b842086e93ca36]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [7e5c608dd4d4fd39605091b9669bd22e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [21b9b439e1c795a1a20e42082ad75ba5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [05d53cb11692b383aa0684c641c08878]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
92.53.) Good: () -> Replace on reboot. [29b1ca231a8ea393eac60743ca378e72]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [37a3c12c495f57df179988c2fc056b95]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.co) Good: () -> Replace on reboot. [68725e8fe4c48da9c1efe26858a9758b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [91499954b9efdb5bf9b794b62ad729d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [32a8d11c951370c6456b6ae031d03cc4]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [af2beeff9810a4927838c08a34cdcb35]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1 union.baidu2019.com
92.53.1) Good: () -> Replace on reboot. [ab2f1dd07f2988aeb8f884c61ce5c23e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [766448a5535568ceefc18fbb5ca5ec14]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [3aa02ac31f89d3632090b793d42d9967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [94462dc03d6b6bcba20e92b8e120d42c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [578311dc238542f4664a22280bf6db25]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [4b8fb03d198f280e723e4ffb09f8a858]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [eeec7776f8b0072fbcf4c189e819d22e]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (27.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [fae00ce1abfd290db7f9a2a86f9229d7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [e7f3618c169288ae8030222846bbe41c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [6c6e8964a602d6609020db6f847d0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [a139945985239e9818988ebc14ed34cc]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [67737e6f28809c9a149cb8929d6449b7]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [845633baa50357dfdbd52129b44db947]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [4991886506a2a591e7c960ea02ffd729]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [5d7dcf1e1a8e26108030123857aa6898]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [6773cb22307886b0d2dead9ddc250bf5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [e2f866876a3e4de903ad193190719e62]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [fddde9045553d660f7b92a2026db2dd3]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [5e7cdf0e34743105248cf5553bc6847c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [e5f527c6eabeb97d0fa1ae9cbf42c040]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [fbdfc8251890fb3bded2f65453ae0000]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [17c3905d2088270f9a1688c2cd3428d8]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92.53.119.1) Good: () -> Replace on reboot. [27b3ffee8424181e644cec5e19e854ac]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1 union.baidu2019.com
92.53.119.169 a1.v) Good: () -> Replace on reboot. [cc0e68855e4a2c0ab1ffd2784bb6857b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1 union.baidu2019.com
92.53.1) Good: () -> Replace on reboot. [855543aa63458caa02ae87c320e105fb]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [e1f9e508f9af82b4fdb355f5768be51b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [cd0df8f52f7915210ba586c4f0112ad6]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
9) Good: () -> Replace on reboot. [e6f434b963455ed803ad321813eed12f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [8f4ba944624635011c940f3b34cde719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
92.53.1) Good: () -> Replace on reboot. [ca100edfaff9ab8becc419318b76f10f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [d307707d1791d066edc36cdefd0453ad]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [e0fa8865783095a11799ea6009f8ae52]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [9644cf1edeca51e5268a2e1c8978e51b]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com) Good: () -> Replace on reboot. [17c3e706e9bf77bfb9f7c7836a97e31d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.c) Good: () -> Replace on reboot. [18c2d91426825adcfcb4a0aa55acad53]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [bb1fa845387067cf258b4a001be6e020]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [e6f419d4f8b0ac8adad65ded827f9967]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [786240ad70389e9809a75befc43da15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
9) Good: () -> Replace on reboot. [11c9c4292d7b41f5bdf3c288a55c6997]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92.53.11) Good: () -> Replace on reboot. [65755d90b4f4003608a8c48643be6c94]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [fcde7e6fcedabc7ae2cedb6fa45dc43c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.c) Good: () -> Replace on reboot. [c812f0fda701e452cde3ef5b59a803fd]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [04d64ba26a3e1b1becc4de6c7c85be42]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92) Good: () -> Replace on reboot. [e1f9608d9e0a87af634d064415ec5fa1]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
92.53.11) Good: () -> Replace on reboot. [04d600edaefa201699179cae60a1a15f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [fcdeec01e1c71a1c317f3812738ecd33]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
92.53.) Good: () -> Replace on reboot. [a1397578e1c7fd395e52b694a958ef11]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.1 union.baidu2019.com
92.53.119.169 a) Good: () -> Replace on reboot. [0ecc9756dbcdc175e4ccda707a87de22]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [e1f914d95a4e37ffc9e70d3d827f4bb5]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com) Good: () -> Replace on reboot. [c6142fbe63453600298756f40bf68080]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.co) Good: () -> Replace on reboot. [9149c825941481b5ac0460ea3cc5ee12]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [ddfdf7f6981082b4b4fc0e3c8081ca36]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [1bbfc726416767cf3c7405451de48c74]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (com
127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [8c4e35b8d7d15cda2b85a6a454ad7d83]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [6f6b608d288081b5f0c0a5a51de4b848]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.co) Good: () -> Replace on reboot. [4f8b3cb1aefa55e1b4fceb5f45bcb14f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.com
127.0.0.1 union.baidu2019.com
92.5) Good: () -> Replace on reboot. [cd0d37b6426646f0654b78d2cd34639d]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
92.53.119) Good: () -> Replace on reboot. [1dbdcd20396f1224d6da252548b99a66]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1 union.baidu2019.com
92.53.119.169 ) Good: () -> Replace on reboot. [75652fbe8c1c48eea30d004a7f8221df]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (.0.0.1 union.baidu2019.com
92.53.1) Good: () -> Replace on reboot. [37a3826be2c675c1cbe5e862000116ea]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (om
127.0.0.1 union.baidu2019.com
92.53.119.) Good: () -> Replace on reboot. [6a70f9f45b4d55e1e5cbdd6d0ef3cf31]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (0.1 union.baidu2019.com
92.53.119) Good: () -> Replace on reboot. [c41610dd495fa6904a66c28834cd817f]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
92.53.11) Good: () -> Replace on reboot. [12c88f5ed1d770c6e6ca51f9946d7090]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (127.0.0.1 union.baidu2019.com
9) Good: () -> Replace on reboot. [57833bb2d0d895a11a96e66443bee61a]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: ( 127.0.0.1 union.baidu2019.com
9) Good: () -> Replace on reboot. [a535d51868408fa7fcb4e268e918dc24]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
xl.com
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [99415d900c9c02349e123f0b09f87789]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (l.com
127.0.0.1 union.baidu2019.com
92.) Good: () -> Replace on reboot. [f5e55598575105317e32d278a55c9e62]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92.53.119) Good: () -> Replace on reboot. [53877578feaa0f27e4cc7eccfe03e917]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (m
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [34a6717c733594a26a46f456d829e719]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92.53.119.16) Good: () -> Replace on reboot. [d5051ad38523a096f7b92e1c1de48f71]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (7.0.0.1 union.baidu2019.com
92.53) Good: () -> Replace on reboot. [12c8e00d22866ec85f5163e7bf42e41c]
C:\Windows\System32\drivers\etc\hosts (Hijack.HostFile) -> Bad: (
127.0.0.1 union.baidu2019.com
) Good: () -> Replace on reboot. [8f4baa43aff9ce686a463f0bba4752ae]
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
06.04.2017, 21:18
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Wir haben leider noch ne ältere Anleitung vom adwCleaner, bitte nochmal ausführen und so einstellen:  2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.04.2017, 07:54
| #14 |
| | Nach Adware Angriff,Hijack.Host AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v6.045 - Bericht erstellt am 07/04/2017 um 08:44:52
# Aktualisiert am 28/03/2017 von Malwarebytes
# Datenbank : 2017-04-06.1 [Server]
# Betriebssystem : Windows 10 Pro (X64)
# Benutzername : Pascal - DESKTOP-NBS516K
# Gestartet von : C:\Users\Pascal\Downloads\adwcleaner_6.045(1).exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support
***** [ Dienste ] *****
Keine schädlichen Dienste gefunden.
***** [ Ordner ] *****
Keine schädlichen Ordner gefunden.
***** [ Dateien ] *****
Keine schädlichen Dateien gefunden.
***** [ DLL ] *****
Keine infizierten DLLs gefunden.
***** [ WMI ] *****
Keine schädlichen Schlüssel gefunden.
***** [ Verknüpfungen ] *****
Keine infizierten Verknüpfungen gefunden.
***** [ Aufgabenplanung ] *****
Keine schädlichen Aufgaben gefunden.
***** [ Registrierungsdatenbank ] *****
Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.
***** [ Internetbrowser ] *****
Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [17274 Bytes] - [05/04/2017 11:09:03]
C:\AdwCleaner\AdwCleaner[C2].txt - [3509 Bytes] - [05/04/2017 11:40:20]
C:\AdwCleaner\AdwCleaner[C3].txt - [1564 Bytes] - [05/04/2017 11:44:15]
C:\AdwCleaner\AdwCleaner[C4].txt - [1674 Bytes] - [05/04/2017 11:49:58]
C:\AdwCleaner\AdwCleaner[C5].txt - [2055 Bytes] - [05/04/2017 21:25:51]
C:\AdwCleaner\AdwCleaner[S0].txt - [15673 Bytes] - [05/04/2017 11:07:48]
C:\AdwCleaner\AdwCleaner[S1].txt - [3971 Bytes] - [05/04/2017 11:40:01]
C:\AdwCleaner\AdwCleaner[S2].txt - [1702 Bytes] - [05/04/2017 11:43:57]
C:\AdwCleaner\AdwCleaner[S3].txt - [1855 Bytes] - [05/04/2017 11:47:03]
C:\AdwCleaner\AdwCleaner[S4].txt - [1994 Bytes] - [05/04/2017 11:53:01]
C:\AdwCleaner\AdwCleaner[S5].txt - [2067 Bytes] - [05/04/2017 12:11:27]
C:\AdwCleaner\AdwCleaner[S6].txt - [2084 Bytes] - [05/04/2017 21:24:46]
C:\AdwCleaner\AdwCleaner[S7].txt - [2078 Bytes] - [07/04/2017 08:44:52]
########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [2151 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.2 (03.10.2017)
Operating System: Windows 10 Pro x64
Ran by Pascal (Administrator) on 07.04.2017 at 8:46:33,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 0
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.04.2017 at 8:47:11,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
07.04.2017, 08:16
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Nach Adware Angriff,Hijack.Host Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Nach Adware Angriff,Hijack.Host |
| abstürze, abstürzen, adware, angezeigt, angriff, anti-malware, browser, datei, defender, falsch, griff, guten, kriege, löschen, malwarebytes, minuten, morgen, namens, natürlich, nervige, neustart, nichts, probleme, virus, werbung, windows |
dann auf 
und dann auf 
. 
Linear-Darstellung
