Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Windows 8 Phishing Links angeklickt

Windows 8 Phishing Links angeklickt


Plagegeister aller Art und deren Bekämpfung: Windows 8 Phishing Links angeklickt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 3 1 23
Alt 22.05.2017, 23:48   #1
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Schönen guten Tag.

Ich habe folgendes Problem.
Mein Kumpel hat am 21.05.2017 Zwei Phishing links angeklickt wobei der eine nicht funktioniert hat und der andere Blockiert wurde von Avira.
Allerdings bin ich immernoch ein wenig in Sorge das ich mir einen Trojaner eingefangen hab.
Ich hab direkt mal Malwarebytes Anti-Malware durchlaufen lassen und dort ist folgendes bei Raus gekommen.
Die Phishing links kommen aus Gefakten Amazon E-Mails (beide als Textdokument auf dem Pc gespeichert)

Code:
ATTFilter
Version: 2.2.1.1043
Malware-Datenbank: v2017.05.22.09
Rootkit-Datenbank: v2017.04.02.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Tonyw_000

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 343016
Abgelaufene Zeit: 30 Min., 43 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe, 1712, , [949dbd5e3574f73f7f5567d5da267987]

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 65
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FD1B7376-A344-48BD-857D-C87B4D8502EF}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{921462B2-5269-45A2-AA8D-F8F7A3690255}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Amazon1ButtonBrowserHelper.Amazon1ButtonBHO, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6B7479D5-C493-40F0-99B6-BFC901980034}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6B7479D5-C493-40F0-99B6-BFC901980034}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BFF94CF8-2D3B-4B2F-BB83-3600280AFEBA}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{48DDEC26-CEC3-478E-9566-0842DAF10CEA}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\Amazon1ButtonRuntime.Amazon1ButtonRuntime, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\Amazon1ButtonRuntime.AmazonRuntimeServer, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Amazon1ButtonRuntime.Amazon1ButtonRuntime, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Amazon1ButtonRuntime.AmazonRuntimeServer, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Amazon1ButtonRuntime.Amazon1ButtonRuntime, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Amazon1ButtonRuntime.AmazonRuntimeServer, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6557DB6C-EFE1-45AC-92A6-FBB1554B7502}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Amazon 1Button App Service, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\TYPELIB\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\INTERFACE\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\INTERFACE\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3268A00F-D329-42E1-ABF0-E78D5656BA2A}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{571139B2-8D93-4B29-9AA9-496EF27D6AF8}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{EB2BEAEF-150C-4DE4-9D09-F16403C22769}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\AmazonAppIE.AppGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AmazonAppIE.AppGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\AmazonAppIE.AppGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\AmazonAppIE.GadgetGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AmazonAppIE.GadgetGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\AmazonAppIE.GadgetGateway, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E4ADC61E-D06A-4E0E-8582-78C809CC8450}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, HKU\S-1-5-21-534249407-474532976-2470648924-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{10F312F8-B2C3-41D6-BD20-7A5417CD6ABC}, , [b27ffc1f4d5c0135090140c4df21a45c], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9FB6625A-1D1F-4074-8C65-DD7ADE3342D7}, , [959ce6351b8ef73f34d6818342bee818], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{EE9D1547-6ABE-49D7-8A21-D5A2297DA79B}, , [5ad7a3787237f541da30aa5a03fdc53b], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F671B499-8616-41B0-9651-4BDE53273CA8}, , [8ea34ad102a77eb8b852f60e1fe12cd4], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DistromaticSearchProtect-hourly, , [cc65879474350432a8c8c63cf9074cb4], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DistromaticSearchProtect-logon, , [42efb46777321d19f57ba45ec8389b65], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DistromaticUpdater-logon, , [ba7713083a6f11251c546f93ee12e51b], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DistromaticUpdater-periodic, , [1a17f52644652a0ce48c2ed43cc48a76], 
PUP.Optional.DriverWhiz, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\DriverWhiz_RASAPI32, , [43ee23f85f4afe38da97729b847cdc24], 
PUP.Optional.DriverWhiz, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\DriverWhiz_RASMANCS, , [a68bc358dacfb48287ea30dd42be29d7], 
PUP.Optional.383Media, HKU\S-1-5-21-534249407-474532976-2470648924-1002\SOFTWARE\DriverWhiz, , [87aa44d73475d6604953a460a55eb947], 
PUP.Optional.DriverAgentPlus, HKU\S-1-5-21-534249407-474532976-2470648924-1002\SOFTWARE\ESUPPORT.COM\DriverAgent, , [98994ecd3178999d0d9350b418ebc13f], 
PUP.Optional.Distromatic, HKU\S-1-5-21-534249407-474532976-2470648924-1003\SOFTWARE\Distromatic, , [c56c6ab1e5c4d6600768811925dbba46], 
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Amazon Assistant, , [38f9001b169332045fb7a3617f81fa06], 

Registrierungswerte: 5
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{10F312F8-B2C3-41D6-BD20-7A5417CD6ABC}|Path, \DistromaticSearchProtect-logon, , [b27ffc1f4d5c0135090140c4df21a45c]
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9FB6625A-1D1F-4074-8C65-DD7ADE3342D7}|Path, \DistromaticUpdater-logon, , [959ce6351b8ef73f34d6818342bee818]
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{EE9D1547-6ABE-49D7-8A21-D5A2297DA79B}|Path, \DistromaticUpdater-periodic, , [5ad7a3787237f541da30aa5a03fdc53b]
PUP.Optional.AmazonBrowserSettings, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F671B499-8616-41B0-9651-4BDE53273CA8}|Path, \DistromaticSearchProtect-hourly, , [8ea34ad102a77eb8b852f60e1fe12cd4]
PUP.Optional.WebBar, HKU\S-1-5-21-534249407-474532976-2470648924-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|wb.exe, 10000, , [f839fe1d3376072f54c200f2a26034cc]

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 6
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.ScreenSnapShotTool, C:\Users\Jason\AppData\Roaming\ScreenSnapshotTool\dump, , [aa87e635c7e24aec75b45383b151837d], 
PUP.Optional.ScreenSnapShotTool, C:\Users\Jason\AppData\Roaming\ScreenSnapshotTool, , [aa87e635c7e24aec75b45383b151837d], 
PUP.Optional.AmazonBrowserSettings, C:\Users\Tonyw_000\AppData\Local\Amazon Browser Settings, , [2e0356c50f9a6ccadb8339c9dd2325db], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.ScreenSnapshot, C:\Users\Public\Documents\Guid\Common\I18N\IPCSUpdateCache\ScreenSnapshot, , [8ea3e239dccd181e01fa3808c939f30d], 

Dateien: 30
PUP.Optional.383Media, C:\$Recycle.Bin\S-1-5-21-534249407-474532976-2470648924-1002\$RJC17WS.exe, , [a889a8735c4d211591ccf1cfab569769], 
PUP.Optional.383Media, C:\$Recycle.Bin\S-1-5-21-534249407-474532976-2470648924-1002\$RJFITDA.exe, , [dd545cbfd3d69d99ca934d7329d86898], 
PUP.Optional.383Media, C:\Users\Jason\AppData\Local\Temp\DRHelper_installFinish.exe, , [55dc3edd3c6d60d61bcfafc96b9644bc], 
PUP.Optional.383Media, C:\Users\Jason\AppData\Local\Temp\DRHelper_installStart.exe, , [2c0565b621882b0b5e8c671155ac0cf4], 
PUP.Optional.383Media, C:\Users\Jason\AppData\Local\Temp\Driverwhiz_de.exe, , [7ab7f922a0098da917468a3660a1c040], 
PUP.Optional.ChinAd, C:\Users\Jason\AppData\Local\Temp\InstallHelper.exe, , [b67b44d72b7e053199607ff915ecdd23], 
PUP.Optional.OpenCandy, C:\Users\Jason\AppData\Local\Temp\HYDC57E.tmp.1454083910\HTA\install.1454083910.zip, , [032e41daf3b675c12e35869cf013b050], 
PUP.Optional.383Media, C:\Users\Tonyw_000\AppData\Local\Temp\DRHelper_uninstallComplete.exe, , [e849a07b4366cb6b9a50f88059a85da3], 
PUP.Optional.ChinAd, C:\Users\Jason\AppData\Roaming\RPEng\BEB45C183B064575ACB911C29A1D7CFD\openchannel2_ger.exe, , [072a9487783158de36c3abcd09f83ac6], 
PUP.Optional.AmazonBrowserSettings, C:\Windows\System32\Tasks\DistromaticSearchProtect-hourly, , [b978ba619e0b0036d4d30ff67d83847c], 
PUP.Optional.AmazonBrowserSettings, C:\Windows\System32\Tasks\DistromaticSearchProtect-logon, , [a78ab764b9f086b03e69af566b950000], 
PUP.Optional.AmazonBrowserSettings, C:\Windows\System32\Tasks\DistromaticUpdater-logon, , [bf720b104e5b76c0e8bf1ce944bcb34d], 
PUP.Optional.AmazonBrowserSettings, C:\Windows\System32\Tasks\DistromaticUpdater-periodic, , [b18067b4ddcc1e18aff8dc29cd33aa56], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper64.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonRuntime.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE64.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.Amazon1Button.AppFlsh, C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll, , [949dbd5e3574f73f7f5567d5da267987], 
PUP.Optional.AmazonTB, C:\Users\Tonyw_000\AppData\Roaming\Mozilla\Firefox\Profiles\wvobzg7e.default\extensions\abb@amazon.com.xpi, , [1f120912ccdda78fc37207ac798930d0], 
PUP.Optional.ScreenSnapShotTool, C:\Users\Jason\AppData\Roaming\ScreenSnapshotTool\dump\BugReportConfig.ini, , [aa87e635c7e24aec75b45383b151837d], 
PUP.Optional.AmazonBrowserSettings, C:\Users\Tonyw_000\AppData\Local\Amazon Browser Settings\protect.json, , [2e0356c50f9a6ccadb8339c9dd2325db], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\installer.json, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\uninstall.ico, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\uninstall.json, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\uninstaller.exe, , [38f9001b169332045fb7a3617f81fa06], 
PUP.Optional.AmazonBrowserSettings, C:\Program Files (x86)\Amazon Browser Settings\updater.exe, , [38f9001b169332045fb7a3617f81fa06], 

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Ich hoffe mir kann hier geholfen werden LG
Geändert von cosinus (23.05.2017 um 12:38 Uhr) Grund: CODE-Tags

Alt 23.05.2017, 12:39   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Hallo und

+++ WICHTIGE HINWEISE +++



1. Während der Analyse und Bereinigung nimmst du keine Änderungen auf eigene Faust vor, d.h. du installierst oder deinstallierst keine Software ohne Absprache!


2. Du veränderst keine Systemeinstellungen, solange wir deinen Fall bearbeiten. Änderungen, Installationen oder Deinstallationen machst du nur auf Anweisung.


3. Es wird erforderlich sein, deinen Virenscanner zu deaktivieren und in bestimmten Fällen auch zu deinstallieren, damit vernünftig bereinigt werden kann. Dein System ist daher erst wenn wir hier fertig sind wieder für den alltäglichen Gebrauch wie surfen oder mailen von mir freigegeben.


4. Während der Analyse bitte keine Nebenfragen wie zB welcher Virenscanner etc. - das wird alles zum Schluss geklärt damit die Analyse nicht unterbrochen wird.



Gelesen und verstanden?



Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 23.05.2017, 12:59   #3
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


FRST.TXT
Code:
ATTFilter
==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Amazon Inc.) C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavSvc.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BHipsSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\bavhm.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Comfort Software Group) C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(SPEEDLINK) C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Monitor.EXE
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\ipmgui.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [R.A.T.TE] => C:\Program Files\Mad Catz\R.A.T.TE\RAT_TE_Profiler.exe
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-05-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [61944 2017-04-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [912768 2017-04-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [67168 2017-04-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SL-6397 Gaming Mouse] => "C:\Program Files (x86)\SPEEDLINK\DECUS Gaming Mouse\Monitor.exe"
HKLM-x32\...\Run: [DECUS RESPEC Gaming Mouse Driver] => C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Monitor.exe [3588096 2016-10-18] (SPEEDLINK)
HKLM-x32\...\Run: [Baidu Antivirus] => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe [1998832 2017-05-15] (Baidu, Inc.)
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\Run: [FreeCT] => C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe [4126624 2015-12-16] (Comfort Software Group)
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\MountPoints2: {cab30463-bb96-11e5-be6e-902b34d40f30} - "E:\HTC_Sync_Manager_PC.exe" 
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\MountPoints2: {eba7f596-118a-11e7-bf92-902b34d40f30} - "E:\Setup.exe" 
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavShx64.dll [2017-05-15] (Baidu, Inc.)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
Startup: C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-01-22]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Tonyw_000\AppData\Local\MEGAsync\MEGAsync.exe (Keine Datei)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1702902E-D0B6-443F-9E8B-1B65F4213177}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
Addition.txt
Code:
ATTFilter
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Baidu Antivirus (Enabled - Up to date) {0B023102-4312-4570-585A-1BAAA3570E16}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Baidu Antivirus (Enabled - Up to date) {B063D0E6-6528-4AFE-62EA-20D8D8D044AB}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Age of Empires II: HD Edition (HKLM\...\Steam App 221380) (Version:  - Skybox Labs)
Amazon 1Button App (HKLM-x32\...\{FA378CD1-F32D-4610-9884-3902DF8AF826}) (Version: 2.3.8 - Amazon) <==== ACHTUNG
Amazon Assistant (HKLM-x32\...\Amazon Assistant) (Version: 2.3.4 - Amazon) <==== ACHTUNG
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ARK: Survival Evolved (HKLM\...\Steam App 346110) (Version:  - Studio Wildcard)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)
Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM\...\Steam App 224580) (Version:  - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM-x32\...\Steam App 224580) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.26.48 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{0b46d918-af4f-4612-8076-5c0ae67cb2aa}) (Version: 1.2.81.41506 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{897e4d08-9554-48e9-ba07-ce6040867fa3}) (Version: 1.2.83.46341 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.83.46341 - Avira Operations GmbH & Co. KG) Hidden
Baidu Antivirus (HKLM-x32\...\Baidu Antivirus) (Version: 5.4.3.148966 - Baidu, Inc.)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Clicker Heroes (HKLM\...\Steam App 363970) (Version:  - Playsaurus)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4427.02 - CyberLink Corp.)
DayZ Commander (HKLM-x32\...\{668B7711-6DAF-465F-9BE2-F3C07C962131}) (Version: 0.92.117 - Dotjosh Studios)
Dead Island Riptide (HKLM-x32\...\Steam App 216250) (Version:  - Techland)
DECUS Gaming Mouse (HKLM-x32\...\{B62CC42A-D1D9-4E91-BEDE-8614DE2AD943}) (Version: 1.0 - SPEEDLINK)
DECUS RESPEC Gaming Mouse Driver (HKLM-x32\...\{CF88BB19-254D-4063-88C3-F0DF688ED577}) (Version: 1.2 - Joellenbeck GmbH)
DiRT Showdown (HKLM-x32\...\Steam App 201700) (Version:  - Codemasters Racing Studio)
Epic Games Launcher (HKLM-x32\...\{2DE76AAC-8061-4D9B-B7BA-A7CFBE0F8048}) (Version: 1.1.86.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
GDMO (HKLM-x32\...\DMO_GSP) (Version:  - Movegames)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 58.0.3029.110 - Google Inc.)
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
GRID 2 (HKLM-x32\...\Steam App 44350) (Version:  - Codemasters Racing)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version:  - Daybreak Games)
H1Z1: Just Survive (HKLM\...\Steam App 295110) (Version:  - Daybreak Game Company)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.0.1013 - Intel Corporation)
Java 8 Update 91 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Xbox One Controller for Windows (HKLM\...\{DC2CB48C-FD96-48EB-A36A-7D995BB587EB}) (Version: 1.0.2 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 48.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 48.0.2 (x86 de)) (Version: 48.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 48.0.2.6079 - Mozilla)
Norton Identity Safe (HKLM-x32\...\NST) (Version: 2014.7.11.42 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 364.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 364.44 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 364.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 364.72 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.3.6 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.3.6 - NVIDIA Corporation)
NVIDIA Grafiktreiber 364.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 364.72 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OSC Third Party Libraries (Version: 1.1 - NVIDIA Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.104.210.0 - Overwolf Ltd.)
Pokémon Trading Card Game Online (HKLM-x32\...\{3E41FC3F-4A7E-41AA-8713-2973A8EE4E9F}) (Version: 2.34.1 - The Pokémon Company International)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
R.A.T.TE (HKLM\...\{A8AFFB99-8FC9-4B2E-99A1-C3D5D391ADAE}) (Version: 7.0.43.0 - Mad Catz Inc)
R.A.T.TE Game Profiles (HKLM-x32\...\{85CC37AC-5734-4C2F-9779-D6BB5D6CF92C}) (Version: 1.0.0.0 - Mad Catz Inc)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.3.6 - NVIDIA Corporation) Hidden
Skype™ 7.31 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.31.104 - Skype Technologies S.A.)
Soccer Manager 2017 (HKLM\...\Steam App 510630) (Version:  - Soccer Manager Ltd)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
TERA (HKLM\...\Steam App 212740) (Version:  - Bluehole, Inc.)
The Binding of Isaac (HKLM\...\Steam App 113200) (Version:  - Edmund McMillen and Florian Himsl)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version:  - Nicalis, Inc.)
The Culling (HKLM\...\Steam App 437220) (Version:  - Xaviant)
Trials Fusion (HKLM-x32\...\Uplay Install 297) (Version:  - Ubisoft)
Trove (HKLM\...\Steam App 304050) (Version:  - Trion Worlds)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.353 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.353 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.353 - TuneUp Software) Hidden
UE4 Prerequisites (x64) (x32 Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 15.0 - Ubisoft)
Vulkan Run Time Libraries 1.0.5.1 (HKLM\...\VulkanRT1.0.5.1) (Version: 1.0.5.1 - LunarG, Inc.)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Worms Ultimate Mayhem (HKLM-x32\...\Steam App 70600) (Version:  - Team17 Digital Ltd)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {10F312F8-B2C3-41D6-BD20-7A5417CD6ABC} - System32\Tasks\DistromaticSearchProtect-logon => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {1B5B21A0-2E09-4821-B9A5-0D17E17EDC9A} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe [2016-06-25] (Microsoft Corporation)
Task: {294258B9-52F2-4FD2-AB1D-54A3836FB755} - System32\Tasks\AviraSystemSpeedupUpdate => C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe [2017-04-25] (Avira Operations GmbH & Co. KG                              )
Task: {302D5225-D895-4924-BC90-F3C730B446AB} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [2017-04-07] (Avira Operations GmbH & Co. KG)
Task: {590D79AB-9505-4853-A10E-9D3A0A7D3EB6} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Baidu Security\Duplicaterecord.js"
Task: {5E802B47-F25A-449E-8A56-C35B763659D4} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-05-11] (Microsoft Corporation)
Task: {63260AA1-491D-4248-81CB-D2350694E87F} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2015-07-27] (Symantec Corporation)
Task: {640654D0-51B5-4AE4-8DD8-F6C0FBB3D64E} - System32\Tasks\Baidu Antivirus Update => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavUpdater.exe [2017-05-15] (Baidu, Inc.)
Task: {93BB90CC-A71E-40D2-8A38-2E5F318DEF8E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-15] (Google Inc.)
Task: {9FB6625A-1D1F-4074-8C65-DD7ADE3342D7} - System32\Tasks\DistromaticUpdater-logon => C:\Program Files (x86)\Amazon Browser Settings\updater.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {AEAC088E-4047-4730-939A-56784FAE6DA4} - System32\Tasks\Avira\System Speedup\SpeedupSysTray => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe [2017-04-07] (Avira Operations GmbH & Co. KG)
Task: {B086D6BC-B437-4286-9A5D-3D7C0EFE959C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-15] (Google Inc.)
Task: {B876DA0D-7094-49F6-8567-D1D50A233282} - System32\Tasks\DistromaticSearchProtect-hourly => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {C5DAC656-A661-4B88-AE74-5DB911620E4B} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2015-06-25] (TuneUp Software)
Task: {C94C333A-C6A8-4132-ABB8-6BE48DFEC550} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {E5DDE1A4-C381-4EE9-973F-93306C89F8CE} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {EE9D1547-6ABE-49D7-8A21-D5A2297DA79B} - System32\Tasks\DistromaticUpdater-periodic => C:\Program Files (x86)\Amazon Browser Settings\updater.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {F72657F9-094D-4E27-BC9F-760C437CA9A6} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-05-14] (Overwolf LTD)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

ShortcutWithArgument: C:\Users\Tonyw_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MoveGames\DMO_GSP\GameKing.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://dmo.gameking.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-01-07 11:36 - 2016-03-22 04:25 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2015-09-23 23:41 - 2015-09-23 23:41 - 00188072 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2015-06-25 08:53 - 2015-06-25 08:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-04-15 00:42 - 2016-05-02 20:31 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-04-15 00:42 - 2016-05-02 20:31 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2017-05-12 19:32 - 2017-05-09 11:13 - 03767640 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libglesv2.dll
2017-05-12 19:32 - 2017-05-09 11:13 - 00100696 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libegl.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00297968 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\HipsLogger.dll
2017-05-15 15:32 - 2015-05-28 13:44 - 00198128 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\dark.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00540656 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\sqlite.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00110952 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00253800 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\collector.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00295272 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\stat.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00104296 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00020328 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00044392 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2016-08-23 15:05 - 2016-08-23 15:05 - 00048304 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-01 18:53 - 2016-11-02 15:24 - 00036864 _____ () C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Lang.dll
2017-02-01 18:53 - 2016-09-30 17:45 - 00045056 _____ () C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\hiddriver.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00277488 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\Pulgin_Dark_DeleteFileTip.dll
2016-07-18 14:12 - 2016-07-18 14:12 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\f5b642de6be876f5fa7f4866d2828cd9\PSIClient.ni.dll
2013-01-07 11:33 - 2012-07-18 12:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BavSvc => "Service"=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BavSvc => "Service"=""

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\amazon.de -> hxxps://amazon.de
IE trusted site: HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\amazon.de -> hxxps://amazon.de

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2012-07-26 07:26 - 2016-01-22 12:55 - 00001472 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-534249407-474532976-2470648924-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Tonyw_000\Desktop\Pokemon\311.gif
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{46858A86-D064-4826-AA66-443A1027ADB1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{A82B7522-CE49-4FC8-AC8E-51F83B66C750}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{001B69CF-B1FA-46EE-8F98-FFEE7185A785}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{4133509A-59EC-4A16-B2F1-F51CC3B0EADE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F8B1A1D4-CA59-4BAC-8D3E-CA305585CFC0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{29BA8BC0-ED8E-4C1D-802D-9017648641D1}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{FA399862-F17A-413A-BD76-EC64BE288E5F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [{47D0DB0E-A9D7-490B-846D-975116315F02}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [{2297D08C-C736-48BF-8727-0680BA138571}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\diriptide\DeadIslandGame_x86_rwdi.exe
FirewallRules: [{2518073A-2C08-4477-BB5B-A35FF91A34F1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\diriptide\DeadIslandGame_x86_rwdi.exe
FirewallRules: [TCP Query User{8CD3622B-1E42-49C3-80F5-22B03678FE5F}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{6AB7ABB3-7615-4682-9627-3A8DE846790F}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [{B705949E-B7F2-4C7F-BDC9-4B3DBBBC7799}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{25469F66-8785-4CC4-992A-C96DA8622F10}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4F3622B2-0730-4F36-8830-BC79A8FD3718}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{79686481-0AA7-4C2C-BEC5-A54E179B7845}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B8849157-FB20-41B0-8437-7EE1708F1428}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{35A98026-DDA7-45B2-92AE-7D847CFF3865}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{F4A5E3E4-0CE1-4351-A947-4CCBB8D69D2B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA_BE.exe
FirewallRules: [{49BA131F-3626-4B18-9241-8774975BACB7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA_BE.exe
FirewallRules: [{E973C639-8BD7-4916-BBEC-B351557630A6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe
FirewallRules: [{AD58340A-51D7-47BB-94F4-CA3D5519BC4A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe
FirewallRules: [{A4ADEC89-E428-4ACE-BEF5-B98B7E0CFD2D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{F9E5F561-AFE9-4B9A-AB7E-4CF3CDC6169B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{F4A9E164-127E-4640-BC36-E09AA0402D00}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{9FC71DCE-B003-494D-8B33-666ACCCC2349}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{B6DF9E17-3855-4129-A9B6-D1FBB2B51248}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2C15B935-CE92-4D0B-9BBA-3AF13B9D26BF}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{4112F64D-C27E-409B-A0A5-35C35F878167}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5E3E33F3-EB4A-42AC-9791-6428E634FB49}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E96E71BF-9EEA-4FD7-AFF7-5BA1928E455C}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{357E2CAA-A745-49BA-8B65-5F9A8EB63D43}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{4492AEFE-68AD-4A9B-BCD4-0E497E2964D8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E0260E04-DC11-4A88-83AC-757328078CED}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{BB76987C-9CE4-465E-8BFB-2552D5C26151}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{D08E0F51-5ADC-4B20-B06A-B63E545732BA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{E536CCF7-D2F7-4D53-9AE5-14F01A9094DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{0481A621-BBD3-481C-9713-1A404F1A10B8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{F78B87F8-3860-4C01-88AD-4BF8FBE46215}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{7258FC1D-A111-4C55-B9D7-1CD0DA423B13}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{ACE44ECB-1D32-43C5-8216-8D3B62208094}] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{E7B20D28-D000-43E0-B5A1-898BA74C47D4}] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{E079FCAE-FA1E-4985-9221-F7EEBE6DCC62}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{A048EF29-0ABB-428B-8D9C-A97901D763EE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{CFA3A303-6341-4F0C-9C8F-E27E395B79B9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\BAF\datacachepreprocessor.exe
FirewallRules: [{5F9E7A21-5ADD-4F26-ABC0-90E0F82AA3EF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\BAF\datacachepreprocessor.exe
FirewallRules: [{E9BC865B-A083-495D-89AA-B96B26A4CB2A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{E8CE3D04-CC44-48C0-BDB3-B7EA94BBB7EC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{3865CFC0-DAE0-4383-B76D-62E7F7A06B95}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\grid 2\grid2.exe
FirewallRules: [{EB2EDCC0-03FB-4B75-AAFB-078092F8F5E3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\grid 2\grid2.exe
FirewallRules: [{E4C4C725-21C4-4B42-BAC9-9E7F85C355CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DiRT Showdown\showdown.exe
FirewallRules: [{58BDACC5-82DB-4F23-81A5-598734C6E3A3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DiRT Showdown\showdown.exe
FirewallRules: [TCP Query User{FE295201-AADA-4AFE-B017-292AD8CE571B}C:\users\tonyw_000\desktop\lavanda2-client\python23.dll] => (Allow) C:\users\tonyw_000\desktop\lavanda2-client\python23.dll
FirewallRules: [UDP Query User{5CB54BBC-A184-436B-85DB-23365B8A1A75}C:\users\tonyw_000\desktop\lavanda2-client\python23.dll] => (Allow) C:\users\tonyw_000\desktop\lavanda2-client\python23.dll
FirewallRules: [TCP Query User{27F192B4-4158-4BB7-94D1-22B39419677C}C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe
FirewallRules: [UDP Query User{45E4636D-FE65-48DD-9BE3-DF3C54D49D2F}C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe
FirewallRules: [TCP Query User{B96F7E12-2827-4C29-B3AD-4F285F05FD55}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [UDP Query User{742FA5F2-C572-41BE-801E-4E8AB68C621A}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [{228C1ABF-9764-4FEC-917C-B7AA538EEF06}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{6A36D50C-5AEF-4985-B227-FE60084E25D6}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{D2F46D21-7FA5-47E3-B24D-1E90D900CC77}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{80F2847A-3649-4519-91B5-1937D90394A0}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{7A33823D-22DC-4409-841F-03D4B9238DB2}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DEB49BC1-CDA3-46A8-9B01-599F8C217C55}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C3DEBEF6-53A5-46CF-875C-DAF265F1B4BB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [{E06079A6-FE49-4A01-A2C4-07ADFB3AF241}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [TCP Query User{44D63482-E5A9-4959-93DD-6018732E5116}C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe
FirewallRules: [UDP Query User{35FAA5B8-8C1D-4F5A-A136-E5DABF90427E}C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe
FirewallRules: [TCP Query User{D4D9AEE3-C00C-47C0-B4E4-58F5BFD7CF55}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [UDP Query User{EF1BDFEA-F4B9-4729-A9FC-7D932BC73D7D}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [{960461CF-495B-4B69-B2EA-B855D170B550}] => (Allow) C:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{371D66DB-11B3-4D0C-A867-B3D05511D32D}] => (Allow) C:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{C99EA2A2-D998-4306-B725-C73560540265}] => (Allow) C:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [{40E26472-A9D8-4E7E-95A6-51C6347030E2}] => (Allow) C:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [TCP Query User{81CC7C8D-1426-4268-AE7C-F764C724BC97}C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe
FirewallRules: [UDP Query User{D79D000B-C869-4E4D-9DAF-F260ED97CDE5}C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe
FirewallRules: [TCP Query User{D3D437FD-A443-49B2-8187-0BCF608A2B56}C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe
FirewallRules: [UDP Query User{D2EB3B6C-E56B-48F5-B5D8-D38BC3DDFFC5}C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe
FirewallRules: [{23BFA62F-3B16-4B5B-90DE-74BFB70CE9D0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{16B5FC6D-052C-443E-94DF-DB2B0D12C65C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{923F0A12-6BFB-48EA-8922-11301DD62EE4}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [UDP Query User{54199F32-A02A-4900-AA1E-7B1390AAE3AE}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [TCP Query User{421DDC1B-9DD1-4DF4-8776-0F16DA5811C7}C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe
FirewallRules: [UDP Query User{6CBEA069-186D-40DA-97A8-99BD768A39AD}C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe
FirewallRules: [TCP Query User{059EFE8B-D910-43F1-A029-0829699AAB42}C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe
FirewallRules: [UDP Query User{668158FC-8973-40E2-ADD4-4364D0F8DBB6}C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe
FirewallRules: [{11EDB929-6A53-4DD9-9E85-6A0ADC85A120}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe
FirewallRules: [{D6D74056-9B88-4AE4-B081-FBE960AA3549}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe
FirewallRules: [{3A5494C5-7217-4BF1-9392-7FCBC4E0E531}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe
FirewallRules: [{4913A94E-E7D6-44BA-B43A-FE6C18919E6F}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe
FirewallRules: [{D969A19D-876F-4AE0-93C2-18664506F224}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [{B3EA7F35-3BD3-4A36-A3DA-1C062959F3A8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [{9B265BCF-57FC-422C-8AC8-8210A337CCC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{10263AF4-0008-482F-BA52-B11A11AE316F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{8DAF5D97-54C7-44F6-8149-2E5C59BCC74D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{07B37C9D-B0F7-44F1-B561-EFF4BF52ECDC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{F47DA584-5FAF-46D0-A6F2-C9DD7FE46CCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{E1CE8C4A-CF7F-48C5-A431-A58CE3A20369}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{FC043CAD-6570-4735-95C2-A6A8EBD386EF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{B71DCE3B-979A-46CC-91DF-AD9DB0E99BF7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{04541444-B126-47C2-8129-671161B4F556}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{61E6DE09-832C-4314-AFF1-A2B158ECBACD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{791E8295-5C47-42F2-B8DF-2328326D1940}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{5232F96F-30D6-461A-8293-2BCD60F3C5E6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{ECC008BE-0869-4D4B-B061-317B78357B0A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{02EE56AF-6310-4C98-9213-0B86A78D797D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{BBA4F0F7-407D-463F-8BF7-D291B70C2448}C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe
FirewallRules: [UDP Query User{9ABBB686-7D07-4D99-B9F2-3456AC6A2639}C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe
FirewallRules: [TCP Query User{E0FC610A-126F-432D-BF04-6F5B31025BF7}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [UDP Query User{97620BF1-A87D-402B-BCA4-7F4FD64E95D8}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{2F667D07-4697-4042-8DCB-CEFFB14F331F}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{F0ED56D5-D75A-4D04-A9C0-46CBF30F4DEB}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [{24160981-25F6-4375-83A2-8026D019C1B4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4DBEC5CC-6DAF-4971-9131-73EB37E8D8DD}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{2FF15D75-690A-4A6B-A8C5-5B67881C0CE1}C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe] => (Allow) C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe
FirewallRules: [UDP Query User{3E513F30-AEC9-48F5-A51D-FBE1CBD98B7F}C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe] => (Allow) C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe
FirewallRules: [TCP Query User{78952483-E209-415D-BBBB-CAF931856EDD}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{65D33F94-02ED-44C7-91EF-A7E4DA546550}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [{3E8BCEDD-8433-4ACC-8798-153FCC999FC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [{DFC42FB1-5EFE-4FD6-B477-6F82A444086F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [TCP Query User{8CC6407C-FA04-45B1-93DA-EC7979C7834C}C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe] => (Allow) C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe
FirewallRules: [UDP Query User{E5561885-209B-40CF-8D89-E035C3E98B64}C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe] => (Allow) C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe
FirewallRules: [TCP Query User{B541F368-4B23-41B2-9717-66860EC2AA95}C:\program files\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\java.exe
FirewallRules: [UDP Query User{B8E00C8A-B9C0-4A9C-93CB-FB52A36EF26A}C:\program files\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\java.exe
FirewallRules: [{B724F1DA-08E9-4B48-B066-84FD065C139A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{A1E9CE77-A3D4-4D5C-B49B-3AC62937A05C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{B63B4704-CC4F-49E7-BBEC-7E2DE87D36F0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{35EDA891-F279-4772-9685-DC159A812ACF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{37E47C13-C7B8-494A-92E8-2EDB916E3371}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2017\Soccer Manager 2017.exe
FirewallRules: [{C41C16FF-1269-4CB2-B10C-E041A845CE28}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2017\Soccer Manager 2017.exe
FirewallRules: [{FB34F607-5A7C-40F2-821B-0596D02AFD0F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Wiederherstellungspunkte =========================

07-05-2017 15:10:36 Geplanter Prüfpunkt
11-05-2017 12:23:26 Windows Update
19-05-2017 12:34:56 Geplanter Prüfpunkt
22-05-2017 23:20:30 Camtasia Studio 8 wird entfernt

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (05/23/2017 01:31:15 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (05/23/2017 01:46:53 AM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Benachrichtigungen für Volume C:\ sind nicht aktiv. 

Kontext: Windows Anwendung

Details:
	Nicht genügend Quoten, um den angeforderten Dienst auszuführen.  (HRESULT : 0x800705ad) (0x800705ad)

Error: (05/23/2017 12:11:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FreeStudioManager.exe, Version: 6.6.1.119, Zeitstempel: 0x569d8a0d
Name des fehlerhaften Moduls: icuin55.dll, Version: 6.2.9200.17581, Zeitstempel: 0x5644f0df
Ausnahmecode: 0xc0000135
Fehleroffset: 0x00078dd2
ID des fehlerhaften Prozesses: 0x19c0
Startzeit der fehlerhaften Anwendung: 0x01d2d3484deb126a
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Common Files\DVDVideoSoft\FreeStudioManager.exe
Pfad des fehlerhaften Moduls: icuin55.dll
Berichtskennung: 8d4e183c-3f3b-11e7-bf9d-902b34d40f30
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
__________________
Alt 23.05.2017, 13:01   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Warum postest du die Logs unvollstöndig (oben abgeschnitten), was soll das bringen?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.05.2017, 13:06   #5
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


huch Schuldigung.

FRST.txt

Code:
ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2017
durchgeführt von Tonyw_000 (Administrator) auf JASON-PC (23-05-2017 13:55:11)
Gestartet von C:\Users\Tonyw_000\Downloads
Geladene Profile: Tonyw_000 (Verfügbare Profile: Jason & Tonyw_000)
Platform: Windows 8 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 10 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Amazon Inc.) C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavSvc.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BHipsSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\bavhm.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Comfort Software Group) C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(SPEEDLINK) C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Monitor.EXE
(Baidu, Inc.) C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\ipmgui.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [R.A.T.TE] => C:\Program Files\Mad Catz\R.A.T.TE\RAT_TE_Profiler.exe
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-05-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [61944 2017-04-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [912768 2017-04-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [67168 2017-04-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SL-6397 Gaming Mouse] => "C:\Program Files (x86)\SPEEDLINK\DECUS Gaming Mouse\Monitor.exe"
HKLM-x32\...\Run: [DECUS RESPEC Gaming Mouse Driver] => C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Monitor.exe [3588096 2016-10-18] (SPEEDLINK)
HKLM-x32\...\Run: [Baidu Antivirus] => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe [1998832 2017-05-15] (Baidu, Inc.)
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\Run: [FreeCT] => C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe [4126624 2015-12-16] (Comfort Software Group)
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\MountPoints2: {cab30463-bb96-11e5-be6e-902b34d40f30} - "E:\HTC_Sync_Manager_PC.exe" 
HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\MountPoints2: {eba7f596-118a-11e7-bf92-902b34d40f30} - "E:\Setup.exe" 
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavShx64.dll [2017-05-15] (Baidu, Inc.)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Tonyw_000\AppData\Local\MEGAsync\ShellExtX32.dll -> Keine Datei
Startup: C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-01-22]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Tonyw_000\AppData\Local\MEGAsync\MEGAsync.exe (Keine Datei)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1702902E-D0B6-443F-9E8B-1B65F4213177}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.hao123.com/?tn=sdks_inner_hp_01_hao123_de&guid=3156d7f234391dbee56064a6360d5b41
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.hao123.com/?tn=sdks_inner_hp_01_hao123_de&guid=3156d7f234391dbee56064a6360d5b41
HKU\S-1-5-21-534249407-474532976-2470648924-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com
HKU\S-1-5-21-534249407-474532976-2470648924-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-534249407-474532976-2470648924-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.hyrican.de
SearchScopes: HKU\S-1-5-21-534249407-474532976-2470648924-1003 -> DefaultScope {76162016-F5BA-48ED-ADF8-2D6F5AD17632} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-04-22] (Oracle Corporation)
BHO: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll [2015-06-26] (Symantec Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-22] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-22] (Oracle Corporation)
BHO-x32: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\coIEPlg.dll [2015-06-26] (Symantec Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-22] (Oracle Corporation)
Toolbar: HKLM - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll [2015-06-26] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\coIEPlg.dll [2015-06-26] (Symantec Corporation)

FireFox:
========
FF DefaultProfile: wvobzg7e.default
FF ProfilePath: C:\Users\Tonyw_000\AppData\Roaming\Mozilla\Firefox\Profiles\wvobzg7e.default [2017-05-21]
FF Homepage: Mozilla\Firefox\Profiles\wvobzg7e.default -> hxxp://de.4yendex.com/?utm_source=sdks&utm_medium=de02&utm_campaign=3156d7f234391dbee56064a6360d5b41
FF Extension: (Amazon Assistant for Firefox) - C:\Users\Tonyw_000\AppData\Roaming\Mozilla\Firefox\Profiles\wvobzg7e.default\Extensions\abb@amazon.com.xpi [2017-02-23]
FF Extension: (Firefox Hotfix) - C:\Users\Tonyw_000\AppData\Roaming\Mozilla\Firefox\Profiles\wvobzg7e.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-09-28]
FF HKLM-x32\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.11.42\coFFPlgn
FF Extension: (Norton Identity Safe Toolbar) - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.11.42\coFFPlgn [2017-05-23]
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-03-22] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-03-22] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)

Chrome: 
=======
CHR HomePage: Default -> start.bvb.de
CHR NewTab: Default ->  Not-active:"chrome-extension://khjilmcjipkeokomeekfnhkpbnhmgaje/html/newtab.html", Active:"chrome-extension://dkfmhaejojhbiclnpdgaadhfaocpgdko/redirect.html"
CHR DefaultSearchURL: Default -> hxxps://search.avira.net/#web/result?source=omnibar&q={searchTerms}
CHR DefaultSearchKeyword: Default -> Avira
CHR DefaultSuggestURL: Default -> hxxps://search.avira.net/suggestions?q={searchTerms}&li=ff&hl=en
CHR Profile: C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default [2017-05-23]
CHR Extension: (Google Präsentationen) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-03]
CHR Extension: (Google Docs) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-03]
CHR Extension: (Google Drive) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-03]
CHR Extension: (YouTube) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-03]
CHR Extension: (Google-Suche) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-03]
CHR Extension: (BVB-Home) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkfmhaejojhbiclnpdgaadhfaocpgdko [2016-02-03]
CHR Extension: (Google Tabellen) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-03]
CHR Extension: (Avira Browserschutz) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-09-20]
CHR Extension: (Google Docs Offline) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Avira SafeSearch Plus) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjilmcjipkeokomeekfnhkpbnhmgaje [2016-12-16]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Google Mail) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-03]
CHR Extension: (Chrome Media Router) - C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-13]
CHR Profile: C:\Users\Tonyw_000\AppData\Local\Google\Chrome\User Data\System Profile [2017-05-04]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\Exts\Chrome.crx [2016-05-15]
CHR HKU\S-1-5-21-534249407-474532976-2470648924-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pbjikboenpfhbbejgkoklgkhjpfogcam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\Exts\Chrome.crx [2016-05-15]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Amazon 1Button App Service; C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe [460472 2016-12-12] (Amazon Inc.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1119712 2017-04-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [488920 2017-04-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [488920 2017-04-27] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1520680 2017-04-27] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\WINDOWS\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350120 2017-04-11] (Avira Operations GmbH & Co. KG)
R2 BavSvc; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavSvc.exe [2791312 2017-05-15] (Baidu, Inc.)
S3 BdSandboxSrv; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdSandboxSrv64.exe [490528 2015-03-05] (Baidu, Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-03-13] ()
R2 BHipsSvc; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BHipsSvc.exe [531232 2017-05-15] (Baidu, Inc.)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [388968 2016-01-19] (Digital Wave Ltd.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-05-02] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-05] (Intel Corporation)
R2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe [131144 2015-03-05] (Symantec Corporation)
S3 npggsvc; C:\WINDOWS\SysWOW64\GameMon.des [4362656 2016-02-24] (INCA Internet Co., Ltd.) [Datei ist nicht signiert]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-05-02] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-05-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-05-02] (NVIDIA Corporation)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1326408 2017-05-14] (Overwolf LTD)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-09-23] ()
R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [129168 2015-11-13] (Razer Inc.)
R2 SpeedupService; C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe [74800 2017-04-07] (Avira Operations GmbH & Co. KG)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [161824 2017-03-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [163976 2017-03-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [44488 2017-03-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [88488 2017-03-02] (Avira Operations GmbH & Co. KG)
S3 BdApiUtil; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdApiUtil64.sys [116968 2017-05-15] (Baidu, Inc.)
R3 bdark64; C:\WINDOWS\system32\drivers\bdark64.sys [78792 2015-05-28] ()
S3 BdCameraProtect; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdCameraProtect64.sys [25032 2017-05-15] (Baidu, Inc.)
S3 BdSandbox; C:\WINDOWS\System32\drivers\BdSandbox.sys [236920 2015-03-05] (Baidu, Inc.)
R1 Bfilter; C:\WINDOWS\System32\drivers\Bfilter.sys [61896 2017-05-15] (Baidu, Inc.)
R1 Bfmon; C:\WINDOWS\System32\drivers\Bfmon.sys [38344 2017-05-15] (Baidu, Inc.)
R0 Bhbase; C:\WINDOWS\System32\drivers\Bhbase.sys [83144 2017-05-15] (Baidu, Inc.)
R1 Bnbase; C:\WINDOWS\System32\drivers\bnbasex64.sys [62792 2017-05-15] (Baidu, Inc.)
R1 Bndef; C:\WINDOWS\System32\drivers\bndef64.sys [485672 2017-05-15] (Baidu, Inc.)
R3 Bnmon; C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\Bnmon64.sys [82376 2017-05-15] (Baidu, Inc.)
R1 Bprotect; C:\WINDOWS\System32\drivers\Bprotect.sys [262088 2017-05-15] (Baidu, Inc.)
R1 ccSet_NST; C:\WINDOWS\system32\drivers\NSTx64\7DE070B0.02A\ccSetx64.sys [162392 2013-09-27] (Symantec Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 Hamachi; C:\WINDOWS\system32\DRIVERS\Hamdrv.sys [45680 2016-08-31] (LogMeIn Inc.)
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [52832 2014-03-19] (hxxp://libusb-win32.sourceforge.net)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R2 rzpmgrk; C:\WINDOWS\system32\drivers\rzpmgrk.sys [37184 2015-09-23] (Razer, Inc.)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)
S3 xb1usb; C:\WINDOWS\System32\drivers\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation)
U3 aswbdisk; kein ImagePath
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-05-23 00:43 - 2017-05-23 00:43 - 00017376 _____ C:\Users\Tonyw_000\Desktop\Trojan Board.txt
2017-05-22 23:15 - 2017-05-23 13:55 - 00025643 _____ C:\Users\Tonyw_000\Downloads\FRST.txt
2017-05-22 23:15 - 2017-05-23 13:55 - 00000000 ____D C:\FRST
2017-05-22 23:15 - 2017-05-22 23:15 - 02429952 _____ (Farbar) C:\Users\Tonyw_000\Downloads\FRST64.exe
2017-05-22 22:47 - 2017-05-22 22:47 - 00017367 _____ C:\asd.txt
2017-05-22 12:26 - 2017-05-22 12:26 - 00107648 _____ C:\trojaner-board.txt
2017-05-22 00:24 - 2017-05-23 00:12 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-05-22 00:24 - 2017-05-22 00:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2017-05-22 00:24 - 2017-05-22 00:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2017-05-22 00:24 - 2017-05-22 00:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-22 00:24 - 2017-05-22 00:24 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2017-05-22 00:24 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2017-05-22 00:24 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2017-05-22 00:24 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-05-22 00:21 - 2017-05-22 00:21 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\AVAST Software
2017-05-22 00:13 - 2017-05-22 01:23 - 00000000 ____D C:\Program Files\AVAST Software
2017-05-22 00:13 - 2017-05-22 00:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-05-21 23:05 - 2017-05-21 23:05 - 00004323 _____ C:\Users\Tonyw_000\Downloads\Ihr Kundenkonto wurde aus Sicherheitsgründen eingeschränkt.html
2017-05-21 23:04 - 2017-05-21 23:04 - 00007689 _____ C:\Users\Tonyw_000\Downloads\Nachricht von Ihrem Amazon Kundenservice.html
2017-05-15 18:24 - 2015-03-05 07:12 - 00421784 _____ (Baidu, Inc.) C:\WINDOWS\system32\BdSandboxDll64.dll
2017-05-15 18:24 - 2015-03-05 07:12 - 00332320 _____ (Baidu, Inc.) C:\WINDOWS\SysWOW64\BdSandboxDll32.dll
2017-05-15 18:24 - 2015-03-05 07:12 - 00236920 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\BdSandbox.sys
2017-05-15 18:23 - 2015-05-28 13:45 - 00078792 _____ C:\WINDOWS\system32\Drivers\bdark64.sys
2017-05-15 17:54 - 2017-05-21 23:49 - 00000000 ____D C:\ProgramData\BavSvc_exe
2017-05-15 15:32 - 2017-05-15 15:32 - 00485672 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\bndef64.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00262088 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\Bprotect.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00083144 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\Bhbase.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00075248 _____ (Baidu, Inc.) C:\WINDOWS\system32\bdhookx64.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00062792 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\bnbasex64.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00061896 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\Bfilter.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00038344 _____ (Baidu, Inc.) C:\WINDOWS\system32\Drivers\Bfmon.sys
2017-05-15 15:32 - 2017-05-15 15:32 - 00032752 _____ (Baidu, Inc.) C:\WINDOWS\SysWOW64\bdhookx86.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00003544 _____ C:\WINDOWS\System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633
2017-05-15 15:32 - 2017-05-15 15:32 - 00003462 _____ C:\WINDOWS\System32\Tasks\Baidu Antivirus Update
2017-05-15 15:32 - 2017-05-15 15:32 - 00001002 _____ C:\Users\Public\Desktop\Baidu Antivirus.lnk
2017-05-15 15:32 - 2017-05-15 15:32 - 00000000 ____D C:\Users\Tonyw_000\AppData\LocalLow\BAVData
2017-05-15 15:32 - 2017-05-15 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus
2017-05-15 15:32 - 2017-05-15 15:32 - 00000000 ____D C:\ProgramData\Baidu Security
2017-05-15 15:32 - 2017-05-15 15:32 - 00000000 ____D C:\Program Files (x86)\Baidu Security
2017-05-15 15:31 - 2017-05-15 15:31 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\BavMini
2017-05-15 15:31 - 2017-05-15 15:31 - 00000000 ____D C:\ProgramData\Baidu
2017-05-13 10:14 - 2017-05-13 10:14 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\Google
2017-05-05 16:52 - 2017-05-05 16:52 - 00001139 _____ C:\Users\Public\Desktop\Avira Connect.lnk
2017-04-25 21:01 - 2017-05-23 13:31 - 00000000 ____D C:\Users\Public\Speedup Sessions
2017-04-25 21:01 - 2017-04-25 21:01 - 00003660 _____ C:\WINDOWS\System32\Tasks\AviraSystemSpeedupUpdate

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-05-23 13:35 - 2016-02-05 21:15 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-534249407-474532976-2470648924-1003
2017-05-23 13:35 - 2012-07-26 12:27 - 00752930 _____ C:\WINDOWS\system32\perfh007.dat
2017-05-23 13:35 - 2012-07-26 12:27 - 00156156 _____ C:\WINDOWS\system32\perfc007.dat
2017-05-23 13:35 - 2012-07-26 09:28 - 01748838 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-05-23 13:35 - 2012-07-26 07:37 - 00000000 ____D C:\WINDOWS\Inf
2017-05-23 13:32 - 2016-12-24 13:21 - 00004614 _____ C:\WINDOWS\System32\Tasks\DistromaticSearchProtect-hourly
2017-05-23 13:28 - 2013-01-07 11:36 - 00000000 ____D C:\ProgramData\NVIDIA
2017-05-23 13:28 - 2012-07-26 09:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-05-23 00:11 - 2016-02-05 23:26 - 00000000 ____D C:\Users\Tonyw_000\AppData\Local\CrashDumps
2017-05-22 23:45 - 2013-01-07 19:11 - 00000000 ____D C:\Hyrican_Installation
2017-05-22 23:40 - 2016-02-13 02:58 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\DVDVideoSoft
2017-05-22 23:40 - 2016-01-20 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2017-05-22 23:40 - 2016-01-20 01:04 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2017-05-22 23:32 - 2016-01-29 21:19 - 00000000 ____D C:\Program Files (x86)\Steam
2017-05-22 23:32 - 2016-01-17 02:22 - 00000000 ____D C:\Program Files\OBS
2017-05-22 23:32 - 2016-01-17 02:22 - 00000000 ____D C:\Program Files (x86)\OBS
2017-05-22 23:29 - 2016-12-26 17:08 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\YGOPro DevPro Launcher
2017-05-22 23:23 - 2016-01-16 01:49 - 00000000 ____D C:\Fraps
2017-05-22 23:22 - 2016-02-03 18:14 - 00000000 ____D C:\Users\Tonyw_000
2017-05-22 23:22 - 2016-01-22 12:53 - 00000000 ____D C:\Program Files (x86)\QuickTime
2017-05-22 21:23 - 2016-02-02 19:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverWhiz
2017-05-22 01:23 - 2016-01-17 17:40 - 00000000 ____D C:\Program Files\Common Files\AV
2017-05-22 01:23 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\tracing
2017-05-20 18:48 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-05-18 00:12 - 2012-07-26 10:12 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-18 00:12 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2017-05-15 22:55 - 2016-01-15 16:55 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-05-15 15:53 - 2012-07-26 10:12 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-05-15 15:53 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-05-12 19:32 - 2016-01-15 17:23 - 00002194 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-11 12:27 - 2016-01-17 17:53 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-05-11 12:24 - 2013-01-07 11:43 - 156335152 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-05-06 00:11 - 2016-02-03 18:23 - 00000000 ____D C:\Users\Tonyw_000\AppData\Roaming\TS3Client
2017-05-05 22:47 - 2016-09-06 20:34 - 00000000 ____D C:\Users\Tonyw_000\AppData\Local\Overwolf
2017-05-05 16:52 - 2016-02-03 18:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-05-05 16:51 - 2016-01-31 12:58 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-28 00:26 - 2016-01-15 17:23 - 00003542 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-28 00:26 - 2016-01-15 17:23 - 00003414 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-25 21:01 - 2017-03-07 22:24 - 00001150 _____ C:\Users\Public\Desktop\Avira System Speedup.lnk
2017-04-25 21:00 - 2016-02-03 18:01 - 00000000 ____D C:\Program Files (x86)\Avira

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-05-28 17:16 - 2016-05-28 17:16 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

Einige Dateien in TEMP:
====================
2016-02-03 18:11 - 2016-02-03 18:11 - 0000000 ____D () C:\Users\Jason\AppData\Local\Temp\avgnt.exe
2015-10-31 10:16 - 2015-10-31 10:16 - 0211576 _____ (383 Media, Inc.) C:\Users\Jason\AppData\Local\Temp\DRHelper_installFinish.exe
2015-10-31 10:16 - 2015-10-31 10:16 - 0211576 _____ (383 Media, Inc.) C:\Users\Jason\AppData\Local\Temp\DRHelper_installStart.exe
2016-02-02 19:48 - 2016-02-02 19:48 - 9175968 _____ (383 Media, Inc.) C:\Users\Jason\AppData\Local\Temp\Driverwhiz_de.exe
2015-11-26 09:53 - 2015-11-26 09:53 - 0902304 _____ () C:\Users\Jason\AppData\Local\Temp\InstallHelper.exe
2012-12-29 03:55 - 2012-12-29 03:55 - 1028800 _____ (NVIDIA Corporation) C:\Users\Jason\AppData\Local\Temp\nvSCPAPI.dll
2012-12-29 03:56 - 2012-12-29 03:56 - 1204424 _____ (NVIDIA Corporation) C:\Users\Jason\AppData\Local\Temp\nvSCPAPI64.dll
2012-12-29 03:54 - 2012-12-29 03:54 - 0710072 _____ (NVIDIA Corporation) C:\Users\Jason\AppData\Local\Temp\nvStInst.exe
2016-02-03 18:18 - 2016-02-03 18:18 - 0000000 ____D () C:\Users\Tonyw_000\AppData\Local\Temp\avgnt.exe
2015-10-31 10:16 - 2015-10-31 10:16 - 0211576 _____ (383 Media, Inc.) C:\Users\Tonyw_000\AppData\Local\Temp\DRHelper_uninstallComplete.exe

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-05-22 14:09

==================== Ende von FRST.txt ============================
Addition.txt

Code:
ATTFilter
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 22-05-2017
durchgeführt von Tonyw_000 (23-05-2017 13:56:11)
Gestartet von C:\Users\Tonyw_000\Downloads
Windows 8 (X64) (2016-01-15 14:48:30)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-534249407-474532976-2470648924-500 - Administrator - Disabled)
Gast (S-1-5-21-534249407-474532976-2470648924-501 - Limited - Disabled)
Jason (S-1-5-21-534249407-474532976-2470648924-1002 - Administrator - Enabled) => C:\Users\Jason
Tonyw_000 (S-1-5-21-534249407-474532976-2470648924-1003 - Administrator - Enabled) => C:\Users\Tonyw_000

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Baidu Antivirus (Enabled - Up to date) {0B023102-4312-4570-585A-1BAAA3570E16}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Baidu Antivirus (Enabled - Up to date) {B063D0E6-6528-4AFE-62EA-20D8D8D044AB}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Age of Empires II: HD Edition (HKLM\...\Steam App 221380) (Version:  - Skybox Labs)
Amazon 1Button App (HKLM-x32\...\{FA378CD1-F32D-4610-9884-3902DF8AF826}) (Version: 2.3.8 - Amazon) <==== ACHTUNG
Amazon Assistant (HKLM-x32\...\Amazon Assistant) (Version: 2.3.4 - Amazon) <==== ACHTUNG
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ARK: Survival Evolved (HKLM\...\Steam App 346110) (Version:  - Studio Wildcard)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)
Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM\...\Steam App 224580) (Version:  - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM-x32\...\Steam App 224580) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.26.48 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{0b46d918-af4f-4612-8076-5c0ae67cb2aa}) (Version: 1.2.81.41506 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{897e4d08-9554-48e9-ba07-ce6040867fa3}) (Version: 1.2.83.46341 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.83.46341 - Avira Operations GmbH & Co. KG) Hidden
Baidu Antivirus (HKLM-x32\...\Baidu Antivirus) (Version: 5.4.3.148966 - Baidu, Inc.)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Clicker Heroes (HKLM\...\Steam App 363970) (Version:  - Playsaurus)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4427.02 - CyberLink Corp.)
DayZ Commander (HKLM-x32\...\{668B7711-6DAF-465F-9BE2-F3C07C962131}) (Version: 0.92.117 - Dotjosh Studios)
Dead Island Riptide (HKLM-x32\...\Steam App 216250) (Version:  - Techland)
DECUS Gaming Mouse (HKLM-x32\...\{B62CC42A-D1D9-4E91-BEDE-8614DE2AD943}) (Version: 1.0 - SPEEDLINK)
DECUS RESPEC Gaming Mouse Driver (HKLM-x32\...\{CF88BB19-254D-4063-88C3-F0DF688ED577}) (Version: 1.2 - Joellenbeck GmbH)
DiRT Showdown (HKLM-x32\...\Steam App 201700) (Version:  - Codemasters Racing Studio)
Epic Games Launcher (HKLM-x32\...\{2DE76AAC-8061-4D9B-B7BA-A7CFBE0F8048}) (Version: 1.1.86.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
GDMO (HKLM-x32\...\DMO_GSP) (Version:  - Movegames)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 58.0.3029.110 - Google Inc.)
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
GRID 2 (HKLM-x32\...\Steam App 44350) (Version:  - Codemasters Racing)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version:  - Daybreak Games)
H1Z1: Just Survive (HKLM\...\Steam App 295110) (Version:  - Daybreak Game Company)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.0.1013 - Intel Corporation)
Java 8 Update 91 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Xbox One Controller for Windows (HKLM\...\{DC2CB48C-FD96-48EB-A36A-7D995BB587EB}) (Version: 1.0.2 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 48.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 48.0.2 (x86 de)) (Version: 48.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 48.0.2.6079 - Mozilla)
Norton Identity Safe (HKLM-x32\...\NST) (Version: 2014.7.11.42 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 364.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 364.44 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 364.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 364.72 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.3.6 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.3.6 - NVIDIA Corporation)
NVIDIA Grafiktreiber 364.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 364.72 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OSC Third Party Libraries (Version: 1.1 - NVIDIA Corporation) Hidden
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.104.210.0 - Overwolf Ltd.)
Pokémon Trading Card Game Online (HKLM-x32\...\{3E41FC3F-4A7E-41AA-8713-2973A8EE4E9F}) (Version: 2.34.1 - The Pokémon Company International)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
R.A.T.TE (HKLM\...\{A8AFFB99-8FC9-4B2E-99A1-C3D5D391ADAE}) (Version: 7.0.43.0 - Mad Catz Inc)
R.A.T.TE Game Profiles (HKLM-x32\...\{85CC37AC-5734-4C2F-9779-D6BB5D6CF92C}) (Version: 1.0.0.0 - Mad Catz Inc)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.3.6 - NVIDIA Corporation) Hidden
Skype™ 7.31 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.31.104 - Skype Technologies S.A.)
Soccer Manager 2017 (HKLM\...\Steam App 510630) (Version:  - Soccer Manager Ltd)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
TERA (HKLM\...\Steam App 212740) (Version:  - Bluehole, Inc.)
The Binding of Isaac (HKLM\...\Steam App 113200) (Version:  - Edmund McMillen and Florian Himsl)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version:  - Nicalis, Inc.)
The Culling (HKLM\...\Steam App 437220) (Version:  - Xaviant)
Trials Fusion (HKLM-x32\...\Uplay Install 297) (Version:  - Ubisoft)
Trove (HKLM\...\Steam App 304050) (Version:  - Trion Worlds)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.353 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.353 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.353 - TuneUp Software) Hidden
UE4 Prerequisites (x64) (x32 Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 15.0 - Ubisoft)
Vulkan Run Time Libraries 1.0.5.1 (HKLM\...\VulkanRT1.0.5.1) (Version: 1.0.5.1 - LunarG, Inc.)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Worms Ultimate Mayhem (HKLM-x32\...\Steam App 70600) (Version:  - Team17 Digital Ltd)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {10F312F8-B2C3-41D6-BD20-7A5417CD6ABC} - System32\Tasks\DistromaticSearchProtect-logon => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {1B5B21A0-2E09-4821-B9A5-0D17E17EDC9A} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe [2016-06-25] (Microsoft Corporation)
Task: {294258B9-52F2-4FD2-AB1D-54A3836FB755} - System32\Tasks\AviraSystemSpeedupUpdate => C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe [2017-04-25] (Avira Operations GmbH & Co. KG                              )
Task: {302D5225-D895-4924-BC90-F3C730B446AB} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [2017-04-07] (Avira Operations GmbH & Co. KG)
Task: {590D79AB-9505-4853-A10E-9D3A0A7D3EB6} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Baidu Security\Duplicaterecord.js"
Task: {5E802B47-F25A-449E-8A56-C35B763659D4} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-05-11] (Microsoft Corporation)
Task: {63260AA1-491D-4248-81CB-D2350694E87F} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2015-07-27] (Symantec Corporation)
Task: {640654D0-51B5-4AE4-8DD8-F6C0FBB3D64E} - System32\Tasks\Baidu Antivirus Update => C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavUpdater.exe [2017-05-15] (Baidu, Inc.)
Task: {93BB90CC-A71E-40D2-8A38-2E5F318DEF8E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-15] (Google Inc.)
Task: {9FB6625A-1D1F-4074-8C65-DD7ADE3342D7} - System32\Tasks\DistromaticUpdater-logon => C:\Program Files (x86)\Amazon Browser Settings\updater.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {AEAC088E-4047-4730-939A-56784FAE6DA4} - System32\Tasks\Avira\System Speedup\SpeedupSysTray => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe [2017-04-07] (Avira Operations GmbH & Co. KG)
Task: {B086D6BC-B437-4286-9A5D-3D7C0EFE959C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-15] (Google Inc.)
Task: {B876DA0D-7094-49F6-8567-D1D50A233282} - System32\Tasks\DistromaticSearchProtect-hourly => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {C5DAC656-A661-4B88-AE74-5DB911620E4B} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2015-06-25] (TuneUp Software)
Task: {C94C333A-C6A8-4132-ABB8-6BE48DFEC550} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {E5DDE1A4-C381-4EE9-973F-93306C89F8CE} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {EE9D1547-6ABE-49D7-8A21-D5A2297DA79B} - System32\Tasks\DistromaticUpdater-periodic => C:\Program Files (x86)\Amazon Browser Settings\updater.exe [2016-04-22] (Distromatic) <==== ACHTUNG
Task: {F72657F9-094D-4E27-BC9F-760C437CA9A6} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-05-14] (Overwolf LTD)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

ShortcutWithArgument: C:\Users\Tonyw_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MoveGames\DMO_GSP\GameKing.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://dmo.gameking.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-01-07 11:36 - 2016-03-22 04:25 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2015-09-23 23:41 - 2015-09-23 23:41 - 00188072 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2015-06-25 08:53 - 2015-06-25 08:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-02-22 16:33 - 2016-05-02 20:31 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-04-15 00:42 - 2016-05-02 20:31 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-04-15 00:42 - 2016-05-02 20:31 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2017-05-12 19:32 - 2017-05-09 11:13 - 03767640 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libglesv2.dll
2017-05-12 19:32 - 2017-05-09 11:13 - 00100696 _____ () C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\libegl.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00297968 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\HipsLogger.dll
2017-05-15 15:32 - 2015-05-28 13:44 - 00198128 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\dark.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00540656 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\sqlite.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00110952 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00253800 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\collector.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00295272 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\stat.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00104296 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00020328 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2016-01-20 01:04 - 2016-01-19 05:02 - 00044392 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2016-08-23 15:05 - 2016-08-23 15:05 - 00048304 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2016-01-31 12:58 - 2016-05-02 20:31 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2017-02-01 18:53 - 2016-11-02 15:24 - 00036864 _____ () C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\Lang.dll
2017-02-01 18:53 - 2016-09-30 17:45 - 00045056 _____ () C:\Program Files (x86)\SPEEDLINK\DECUS RESPEC Gaming Mouse\hiddriver.dll
2017-05-15 15:32 - 2017-05-15 15:32 - 00277488 _____ () C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.4.3.148966.0\Pulgin_Dark_DeleteFileTip.dll
2016-07-18 14:12 - 2016-07-18 14:12 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\f5b642de6be876f5fa7f4866d2828cd9\PSIClient.ni.dll
2013-01-07 11:33 - 2012-07-18 12:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BavSvc => "Service"=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BavSvc => "Service"=""

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\amazon.de -> hxxps://amazon.de
IE trusted site: HKU\S-1-5-21-534249407-474532976-2470648924-1003\...\amazon.de -> hxxps://amazon.de

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2012-07-26 07:26 - 2016-01-22 12:55 - 00001472 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-534249407-474532976-2470648924-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Tonyw_000\Desktop\Pokemon\311.gif
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{46858A86-D064-4826-AA66-443A1027ADB1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{A82B7522-CE49-4FC8-AC8E-51F83B66C750}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{001B69CF-B1FA-46EE-8F98-FFEE7185A785}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{4133509A-59EC-4A16-B2F1-F51CC3B0EADE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F8B1A1D4-CA59-4BAC-8D3E-CA305585CFC0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{29BA8BC0-ED8E-4C1D-802D-9017648641D1}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{FA399862-F17A-413A-BD76-EC64BE288E5F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [{47D0DB0E-A9D7-490B-846D-975116315F02}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\LaunchPad.exe
FirewallRules: [{2297D08C-C736-48BF-8727-0680BA138571}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\diriptide\DeadIslandGame_x86_rwdi.exe
FirewallRules: [{2518073A-2C08-4477-BB5B-A35FF91A34F1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\diriptide\DeadIslandGame_x86_rwdi.exe
FirewallRules: [TCP Query User{8CD3622B-1E42-49C3-80F5-22B03678FE5F}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{6AB7ABB3-7615-4682-9627-3A8DE846790F}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [{B705949E-B7F2-4C7F-BDC9-4B3DBBBC7799}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{25469F66-8785-4CC4-992A-C96DA8622F10}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4F3622B2-0730-4F36-8830-BC79A8FD3718}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{79686481-0AA7-4C2C-BEC5-A54E179B7845}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B8849157-FB20-41B0-8437-7EE1708F1428}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{35A98026-DDA7-45B2-92AE-7D847CFF3865}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2\arma2.exe
FirewallRules: [{F4A5E3E4-0CE1-4351-A947-4CCBB8D69D2B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA_BE.exe
FirewallRules: [{49BA131F-3626-4B18-9241-8774975BACB7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA_BE.exe
FirewallRules: [{E973C639-8BD7-4916-BBEC-B351557630A6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe
FirewallRules: [{AD58340A-51D7-47BB-94F4-CA3D5519BC4A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe
FirewallRules: [{A4ADEC89-E428-4ACE-BEF5-B98B7E0CFD2D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{F9E5F561-AFE9-4B9A-AB7E-4CF3CDC6169B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Outlast\OutlastLauncher.exe
FirewallRules: [{F4A9E164-127E-4640-BC36-E09AA0402D00}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{9FC71DCE-B003-494D-8B33-666ACCCC2349}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{B6DF9E17-3855-4129-A9B6-D1FBB2B51248}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2C15B935-CE92-4D0B-9BBA-3AF13B9D26BF}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{4112F64D-C27E-409B-A0A5-35C35F878167}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5E3E33F3-EB4A-42AC-9791-6428E634FB49}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E96E71BF-9EEA-4FD7-AFF7-5BA1928E455C}] => (Allow) C:\Users\Jason\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{357E2CAA-A745-49BA-8B65-5F9A8EB63D43}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{4492AEFE-68AD-4A9B-BCD4-0E497E2964D8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E0260E04-DC11-4A88-83AC-757328078CED}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{BB76987C-9CE4-465E-8BFB-2552D5C26151}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{D08E0F51-5ADC-4B20-B06A-B63E545732BA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{E536CCF7-D2F7-4D53-9AE5-14F01A9094DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{0481A621-BBD3-481C-9713-1A404F1A10B8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{F78B87F8-3860-4C01-88AD-4BF8FBE46215}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{7258FC1D-A111-4C55-B9D7-1CD0DA423B13}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{ACE44ECB-1D32-43C5-8216-8D3B62208094}] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{E7B20D28-D000-43E0-B5A1-898BA74C47D4}] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{E079FCAE-FA1E-4985-9221-F7EEBE6DCC62}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{A048EF29-0ABB-428B-8D9C-A97901D763EE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{CFA3A303-6341-4F0C-9C8F-E27E395B79B9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\BAF\datacachepreprocessor.exe
FirewallRules: [{5F9E7A21-5ADD-4F26-ABC0-90E0F82AA3EF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\BAF\datacachepreprocessor.exe
FirewallRules: [{E9BC865B-A083-495D-89AA-B96B26A4CB2A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{E8CE3D04-CC44-48C0-BDB3-B7EA94BBB7EC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{3865CFC0-DAE0-4383-B76D-62E7F7A06B95}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\grid 2\grid2.exe
FirewallRules: [{EB2EDCC0-03FB-4B75-AAFB-078092F8F5E3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\grid 2\grid2.exe
FirewallRules: [{E4C4C725-21C4-4B42-BAC9-9E7F85C355CF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DiRT Showdown\showdown.exe
FirewallRules: [{58BDACC5-82DB-4F23-81A5-598734C6E3A3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DiRT Showdown\showdown.exe
FirewallRules: [TCP Query User{FE295201-AADA-4AFE-B017-292AD8CE571B}C:\users\tonyw_000\desktop\lavanda2-client\python23.dll] => (Allow) C:\users\tonyw_000\desktop\lavanda2-client\python23.dll
FirewallRules: [UDP Query User{5CB54BBC-A184-436B-85DB-23365B8A1A75}C:\users\tonyw_000\desktop\lavanda2-client\python23.dll] => (Allow) C:\users\tonyw_000\desktop\lavanda2-client\python23.dll
FirewallRules: [TCP Query User{27F192B4-4158-4BB7-94D1-22B39419677C}C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe
FirewallRules: [UDP Query User{45E4636D-FE65-48DD-9BE3-DF3C54D49D2F}C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\trials fusion\datapack\trials_fusion.exe
FirewallRules: [TCP Query User{B96F7E12-2827-4C29-B3AD-4F285F05FD55}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [UDP Query User{742FA5F2-C572-41BE-801E-4E8AB68C621A}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [{228C1ABF-9764-4FEC-917C-B7AA538EEF06}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{6A36D50C-5AEF-4985-B227-FE60084E25D6}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{D2F46D21-7FA5-47E3-B24D-1E90D900CC77}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{80F2847A-3649-4519-91B5-1937D90394A0}] => (Allow) C:\Users\Tonyw_000\Desktop\Planetpokemon\Planet Pokemon.exe
FirewallRules: [{7A33823D-22DC-4409-841F-03D4B9238DB2}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DEB49BC1-CDA3-46A8-9B01-599F8C217C55}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C3DEBEF6-53A5-46CF-875C-DAF265F1B4BB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [{E06079A6-FE49-4A01-A2C4-07ADFB3AF241}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Binding Of Isaac\Isaac.exe
FirewallRules: [TCP Query User{44D63482-E5A9-4959-93DD-6018732E5116}C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe
FirewallRules: [UDP Query User{35FAA5B8-8C1D-4F5A-A136-E5DABF90427E}C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\ark\shootergame\binaries\win64\shootergameserver.exe
FirewallRules: [TCP Query User{D4D9AEE3-C00C-47C0-B4E4-58F5BFD7CF55}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [UDP Query User{EF1BDFEA-F4B9-4729-A9FC-7D932BC73D7D}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [{960461CF-495B-4B69-B2EA-B855D170B550}] => (Allow) C:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{371D66DB-11B3-4D0C-A867-B3D05511D32D}] => (Allow) C:\Games\World_of_Warships\WoWSLauncher.exe
FirewallRules: [{C99EA2A2-D998-4306-B725-C73560540265}] => (Allow) C:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [{40E26472-A9D8-4E7E-95A6-51C6347030E2}] => (Allow) C:\Games\World_of_Warships\worldofwarships.exe
FirewallRules: [TCP Query User{81CC7C8D-1426-4268-AE7C-F764C724BC97}C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe
FirewallRules: [UDP Query User{D79D000B-C869-4E4D-9DAF-F260ED97CDE5}C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\steamcabal\launcher\launcher.exe
FirewallRules: [TCP Query User{D3D437FD-A443-49B2-8187-0BCF608A2B56}C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe
FirewallRules: [UDP Query User{D2EB3B6C-E56B-48F5-B5D8-D38BC3DDFFC5}C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1 king of the kill\h1z1.exe
FirewallRules: [{23BFA62F-3B16-4B5B-90DE-74BFB70CE9D0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{16B5FC6D-052C-443E-94DF-DB2B0D12C65C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{923F0A12-6BFB-48EA-8922-11301DD62EE4}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [UDP Query User{54199F32-A02A-4900-AA1E-7B1390AAE3AE}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe
FirewallRules: [TCP Query User{421DDC1B-9DD1-4DF4-8776-0F16DA5811C7}C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe
FirewallRules: [UDP Query User{6CBEA069-186D-40DA-97A8-99BD768A39AD}C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dead by daylight\deadbydaylight\binaries\win64\deadbydaylight-win64-shipping.exe
FirewallRules: [TCP Query User{059EFE8B-D910-43F1-A029-0829699AAB42}C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe
FirewallRules: [UDP Query User{668158FC-8973-40E2-ADD4-4364D0F8DBB6}C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\riders of icarus\bin64\launcher.exe
FirewallRules: [{11EDB929-6A53-4DD9-9E85-6A0ADC85A120}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe
FirewallRules: [{D6D74056-9B88-4AE4-B081-FBE960AA3549}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe
FirewallRules: [{3A5494C5-7217-4BF1-9392-7FCBC4E0E531}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe
FirewallRules: [{4913A94E-E7D6-44BA-B43A-FE6C18919E6F}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe
FirewallRules: [{D969A19D-876F-4AE0-93C2-18664506F224}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [{B3EA7F35-3BD3-4A36-A3DA-1C062959F3A8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Clicker Heroes\Clicker Heroes.exe
FirewallRules: [{9B265BCF-57FC-422C-8AC8-8210A337CCC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{10263AF4-0008-482F-BA52-B11A11AE316F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{8DAF5D97-54C7-44F6-8149-2E5C59BCC74D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{07B37C9D-B0F7-44F1-B561-EFF4BF52ECDC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{F47DA584-5FAF-46D0-A6F2-C9DD7FE46CCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{E1CE8C4A-CF7F-48C5-A431-A58CE3A20369}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{FC043CAD-6570-4735-95C2-A6A8EBD386EF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{B71DCE3B-979A-46CC-91DF-AD9DB0E99BF7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{04541444-B126-47C2-8129-671161B4F556}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{61E6DE09-832C-4314-AFF1-A2B158ECBACD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{791E8295-5C47-42F2-B8DF-2328326D1940}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{5232F96F-30D6-461A-8293-2BCD60F3C5E6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{ECC008BE-0869-4D4B-B061-317B78357B0A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{02EE56AF-6310-4C98-9213-0B86A78D797D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{BBA4F0F7-407D-463F-8BF7-D291B70C2448}C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe
FirewallRules: [UDP Query User{9ABBB686-7D07-4D99-B9F2-3456AC6A2639}C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\theculling\victory\binaries\win64\victory.exe
FirewallRules: [TCP Query User{E0FC610A-126F-432D-BF04-6F5B31025BF7}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [UDP Query User{97620BF1-A87D-402B-BCA4-7F4FD64E95D8}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{2F667D07-4697-4042-8DCB-CEFFB14F331F}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{F0ED56D5-D75A-4D04-A9C0-46CBF30F4DEB}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [{24160981-25F6-4375-83A2-8026D019C1B4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4DBEC5CC-6DAF-4971-9131-73EB37E8D8DD}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [TCP Query User{2FF15D75-690A-4A6B-A8C5-5B67881C0CE1}C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe] => (Allow) C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe
FirewallRules: [UDP Query User{3E513F30-AEC9-48F5-A51D-FBE1CBD98B7F}C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe] => (Allow) C:\users\tonyw_000\appdata\roaming\ygopro devpro launcher\ygopro.exe
FirewallRules: [TCP Query User{78952483-E209-415D-BBBB-CAF931856EDD}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{65D33F94-02ED-44C7-91EF-A7E4DA546550}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [{3E8BCEDD-8433-4ACC-8798-153FCC999FC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [{DFC42FB1-5EFE-4FD6-B477-6F82A444086F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trove\GlyphClient.exe
FirewallRules: [TCP Query User{8CC6407C-FA04-45B1-93DA-EC7979C7834C}C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe] => (Allow) C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe
FirewallRules: [UDP Query User{E5561885-209B-40CF-8D89-E035C3E98B64}C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe] => (Allow) C:\program files (x86)\speedlink gaming mouse\gaming mouse.exe
FirewallRules: [TCP Query User{B541F368-4B23-41B2-9717-66860EC2AA95}C:\program files\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\java.exe
FirewallRules: [UDP Query User{B8E00C8A-B9C0-4A9C-93CB-FB52A36EF26A}C:\program files\java\jre1.8.0_91\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\java.exe
FirewallRules: [{B724F1DA-08E9-4B48-B066-84FD065C139A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{A1E9CE77-A3D4-4D5C-B49B-3AC62937A05C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{B63B4704-CC4F-49E7-BBEC-7E2DE87D36F0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{35EDA891-F279-4772-9685-DC159A812ACF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{37E47C13-C7B8-494A-92E8-2EDB916E3371}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2017\Soccer Manager 2017.exe
FirewallRules: [{C41C16FF-1269-4CB2-B10C-E041A845CE28}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soccer Manager 2017\Soccer Manager 2017.exe
FirewallRules: [{FB34F607-5A7C-40F2-821B-0596D02AFD0F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Wiederherstellungspunkte =========================

07-05-2017 15:10:36 Geplanter Prüfpunkt
11-05-2017 12:23:26 Windows Update
19-05-2017 12:34:56 Geplanter Prüfpunkt
22-05-2017 23:20:30 Camtasia Studio 8 wird entfernt

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (05/23/2017 01:31:15 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (05/23/2017 01:46:53 AM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Benachrichtigungen für Volume C:\ sind nicht aktiv. 

Kontext: Windows Anwendung

Details:
	Nicht genügend Quoten, um den angeforderten Dienst auszuführen.  (HRESULT : 0x800705ad) (0x800705ad)

Error: (05/23/2017 12:11:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FreeStudioManager.exe, Version: 6.6.1.119, Zeitstempel: 0x569d8a0d
Name des fehlerhaften Moduls: icuin55.dll, Version: 6.2.9200.17581, Zeitstempel: 0x5644f0df
Ausnahmecode: 0xc0000135
Fehleroffset: 0x00078dd2
ID des fehlerhaften Prozesses: 0x19c0
Startzeit der fehlerhaften Anwendung: 0x01d2d3484deb126a
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Common Files\DVDVideoSoft\FreeStudioManager.exe
Pfad des fehlerhaften Moduls: icuin55.dll
Berichtskennung: 8d4e183c-3f3b-11e7-bf9d-902b34d40f30
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (05/22/2017 11:40:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FreeStudioManager.exe, Version: 6.6.1.119, Zeitstempel: 0x569d8a0d
Name des fehlerhaften Moduls: icuin55.dll, Version: 6.2.9200.17581, Zeitstempel: 0x5644f0df
Ausnahmecode: 0xc0000135
Fehleroffset: 0x00078dd2
ID des fehlerhaften Prozesses: 0xaf8
Startzeit der fehlerhaften Anwendung: 0x01d2d3440bd51701
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Common Files\DVDVideoSoft\FreeStudioManager.exe
Pfad des fehlerhaften Moduls: icuin55.dll
Berichtskennung: 4b4d4b12-3f37-11e7-bf9c-902b34d40f30
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (05/22/2017 11:23:35 PM) (Source: MsiInstaller) (EventID: 11606) (User: JASON-PC)
Description: Produkt: Pokémon Trading Card Game Online -- Fehler 1606. Zugriff auf die Netzwerkadresse Property.USER_PROFILE war nicht möglich.

Error: (05/22/2017 11:23:34 PM) (Source: MsiInstaller) (EventID: 11606) (User: JASON-PC)
Description: Produkt: Pokémon Trading Card Game Online -- Fehler 1606. Zugriff auf die Netzwerkadresse Property.USER_PROFILE war nicht möglich.

Error: (05/22/2017 02:09:38 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (05/22/2017 01:29:11 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (05/22/2017 12:36:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AvastSvc.exe, Version: 17.4.3482.0, Zeitstempel: 0x5902f182
Name des fehlerhaften Moduls: ucrtbase.DLL, Version: 10.0.10586.212, Zeitstempel: 0x56fa10f1
Ausnahmecode: 0xc0000409
Fehleroffset: 0x0008468b
ID des fehlerhaften Prozesses: 0xbd4
Startzeit der fehlerhaften Anwendung: 0x01d2d28074056210
Pfad der fehlerhaften Anwendung: C:\Program Files\AVAST Software\Avast\AvastSvc.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\WinSxS\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\ucrtbase.DLL
Berichtskennung: e5c554e1-3e75-11e7-bf99-902b34d40f30
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (05/22/2017 12:25:28 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm AvastUI.exe, Version 17.4.3482.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1f3c

Startzeit: 01d2d28078c37e07

Endzeit: 31352

Anwendungspfad: C:\Program Files\AVAST Software\Avast\AvastUI.exe

Berichts-ID: 4f815391-3e74-11e7-bf99-902b34d40f30

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (05/23/2017 01:28:20 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (05/23/2017 01:28:36 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎23.‎05.‎2017 um 01:27:44 unerwartet heruntergefahren.

Error: (05/23/2017 12:07:25 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (05/22/2017 12:14:36 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (05/22/2017 12:14:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎22.‎05.‎2017 um 02:06:33 unerwartet heruntergefahren.

Error: (05/22/2017 01:26:13 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (05/22/2017 01:26:33 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎22.‎05.‎2017 um 01:23:30 unerwartet heruntergefahren.

Error: (05/22/2017 01:23:09 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (05/22/2017 01:22:31 AM) (Source: DCOM) (EventID: 10010) (User: JASON-PC)
Description: Der Server "{9BA05972-F6A8-11CF-A442-00A0C90A8F39}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (05/21/2017 12:32:22 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: 
Zugriff verweigert


CodeIntegrity:
===================================
  Date: 2017-04-23 23:58:34.258
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SysWOW64\WWAHost.exe) attempted to load \Device\HarddiskVolume4\Program Files\WindowsApps\CyberLinkCorpPDVD.CyberLinkPowerDVDBE_1.0.903.10740_x86__av5vf9vzy3bgp\AggregationContent.winmd with signing level Unsigned while the system requires signing level 6 or better to load.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i5-3330 CPU @ 3.00GHz
Prozentuale Nutzung des RAM: 26%
Installierter physikalischer RAM: 8135.67 MB
Verfügbarer physikalischer RAM: 5974.49 MB
Summe virtueller Speicher: 9351.67 MB
Verfügbarer virtueller Speicher: 6535.27 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:915.91 GB) (Free:431.48 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 72264242)

Partition: GPT.

==================== Ende von Addition.txt ============================


Alt 23.05.2017, 13:10   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Zitat:
Platform: Windows 8 (X64) Sprache: Deutsch (Deutschland)
Was ist denn da passiert?!

Du hast hier noch die Urversion von Windows 8 drauf, obwohl Version 8.1 für alle kostenlos verfügbar ist...

Warum bist du nicht schon längst auf Windows 10?
__________________
--> Windows 8 Phishing Links angeklickt

Alt 23.05.2017, 13:12   #7
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Kann daran liegen das ich den Pc von meinem neffen übernommen hab und er daran nichts geupdatet hat oder sonstiges.^^ deswegen gibt es auch 2 verschiedene benutzer.

Alt 23.05.2017, 13:17   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Von deinem Neffen?

Das würde auch auch erklären warum du da unzähliche Spiele installiert hast, die du wahrscheinlich garnicht willst.

Schmeiß mal diese depperten unnötigen Virenscanner vom System.


Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Avira Antivirus

    Avira Connect

    Baidu Antivirus

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.05.2017, 13:30   #9
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Hab ich gemacht. soll allerdings den pc neustarten damit die restlichen dateien auch gelöscht werden.
Ist das richtig so?

Alt 23.05.2017, 13:31   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


ja neu starten, dann mit mBAR weitermachen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.05.2017, 14:05   #11
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


MBAR
Musste bzw konnte nicht cleanup betätigen da nix gefunden wurde an Malware.
Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.05.23.05
  rootkit: v2017.04.02.01

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.17607
Tonyw_000 :: JASON-PC [administrator]

23.05.2017 14:36:15
mbar-log-2017-05-23 (14-36-15).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 344460
Time elapsed: 27 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Alt 23.05.2017, 15:20   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Dann mach mal jetzt ein Upgrade auf Windows 10. Da dir das kostenlose Upgrade wohl so nicht mehr angeboten wird würde ich so vorgehen:

1. Windows 10 ISO-Abbild runterladen --> zb von https://www.deskmodder.de/blog/2017/...stehen-bereit/

2. ISO in ein virtuelles Laufwerk bereitstellen oder entpacken

3. setup.exe ausführen und Anweisungen ausführen
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.05.2017, 16:30   #13
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Sorry für die späte Rückmeldung musste ebend Einkaufen.
Ist das nicht eigentlich Illegal? o.O
Und konnte man anhand der Sachen erkennen ob ich mir einen etwas schlimmeren virus eingefangen habe?
und vorallem muss ich dazu nich meinen kompletten Pc Neustarten , also leer machen?

Alt 23.05.2017, 18:51   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Eigentlich gibt es ja keine doofen Fragen, aber die ist schon ziemlich naiv

1. Windows 10 wurde von Microsoft verschenkt. Wie kann man das nicht mitbekommen haben?

2. es lässt sich immer noch legal upgraden wenn man W7 oder W8 hat

3. Microsoft bietet selbst die ISO-Abbilder zum Download an
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.05.2017, 19:42   #15
Ix3Paradise
 
Windows 8 Phishing Links angeklickt - Standard

Windows 8 Phishing Links angeklickt


Ja habs dann auch gelesen lade es grade runter sollte.

Meine frage ist jetze ob ich alle apps und persönlichen Daten löschen soll oder behalten soll?

Antwort
Seite 1 von 3 1 23

Themen zu Windows 8 Phishing Links angeklickt
.com, anti-malware, appdata, bho, blockiert, explorer, firefox, folge, funktioniert, internet, internet explorer, links, malwarebytes, microsoft, mozilla, phishing, roaming, services, software, system32, temp, tool, trojaner, websites, windows


« Malware nach VLC Updater | zip-Anhang von Fake-Mahnungsmail geöffnet »


Ähnliche Themen: Windows 8 Phishing Links angeklickt


  1. Gefälschte o2-Phishing-Mail angeklickt [BSI-Warnung]
    Plagegeister aller Art und deren Bekämpfung - 14.02.2017 (11)
  2. Phishing Mail - links angeklickt
    Plagegeister aller Art und deren Bekämpfung - 27.03.2016 (12)
  3. Phishing SMS iPhone Link angeklickt
    Alles rund um Mac OSX & Linux - 04.11.2015 (1)
  4. Phishing SMS iPhone Link angeklickt
    Smartphone, Tablet & Handy Security - 04.11.2015 (6)
  5. Phishing Mail DHL Link angeklickt
    Log-Analyse und Auswertung - 26.03.2015 (13)
  6. DHL Phishing Mail Link angeklickt
    Plagegeister aller Art und deren Bekämpfung - 15.03.2015 (7)
  7. Amazon Phishing Link angeklickt...
    Plagegeister aller Art und deren Bekämpfung - 08.02.2015 (6)
  8. Phishing-Mail-Link angeklickt (Paypal-Phishing-Mail)
    Plagegeister aller Art und deren Bekämpfung - 29.11.2014 (9)
  9. Phishing-Mail von rund-ums-baby.de angeklickt
    Log-Analyse und Auswertung - 20.09.2014 (3)
  10. Amazon Phishing Mail Link angeklickt
    Plagegeister aller Art und deren Bekämpfung - 24.06.2014 (11)
  11. WINDOWS 7: Phishing-Mail von Bank angeklickt
    Log-Analyse und Auswertung - 12.06.2014 (9)
  12. Phishing Link angeklickt TNT Delivery (Logfile)
    Log-Analyse und Auswertung - 14.03.2014 (5)
  13. Phishing Link angeklickt TNT Delivery
    Smartphone, Tablet & Handy Security - 13.03.2014 (6)
  14. Windows 7: Amazon Phishing-Mail Link angeklickt
    Log-Analyse und Auswertung - 16.02.2014 (11)
  15. Phishing-Link von Paypal angeklickt
    Plagegeister aller Art und deren Bekämpfung - 07.10.2013 (11)
  16. Phishing Mail von WoW Link angeklickt!
    Plagegeister aller Art und deren Bekämpfung - 07.07.2013 (4)
  17. In Phishing-Mail den Link angeklickt :( Panik
    Plagegeister aller Art und deren Bekämpfung - 19.02.2013 (34)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 8 Phishing Links angeklickt - Schönen guten Tag. Ich habe folgendes Problem. Mein Kumpel hat am 21.05.2017 Zwei Phishing links angeklickt wobei der eine nicht funktioniert hat und der andere Blockiert wurde von Avira. Allerdings - Windows 8 Phishing Links angeklickt...
Archiv
Du betrachtest: Windows 8 Phishing Links angeklickt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131