Win10 PC, Dateien durch "id-36EDA2E5.[btc2017@india.com].cesar" Trojaner verschlüsselt

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-08-2017
durchgeführt von Marcus (22-08-2017 10:16:26)
Gestartet von C:\Users\Marcus\Desktop
Windows 10 Pro Version 1703 (X64) (2017-04-11 20:53:25)
Start-Modus: Safe Mode (with Networking)
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3662077352-612492827-2609421022-500 - Administrator - Disabled)
Backup (S-1-5-21-3662077352-612492827-2609421022-1004 - Administrator - Enabled) => C:\Users\Backup
DefaultAccount (S-1-5-21-3662077352-612492827-2609421022-503 - Limited - Disabled)
Gast (S-1-5-21-3662077352-612492827-2609421022-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3662077352-612492827-2609421022-1003 - Limited - Enabled)
Marcus (S-1-5-21-3662077352-612492827-2609421022-1000 - Administrator - Enabled) => C:\Users\Marcus

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

64 Bit HP CIO Components Installer (HKLM\...\{13DA9C7C-EBFB-40D0-94A1-55B42883DF21}) (Version: 21.2.1 - HP Inc.) Hidden
Adobe Acrobat X Standard - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-BA7E-000000000005}) (Version: 10.1.16 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 26.0.0.118 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 4.1.1.202 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Production Premium (HKLM-x32\...\{045D4EDF-8DC1-43D7-BAFC-7AAEF99C7168}) (Version: 6 - Adobe Systems Incorporated)
Adobe Flash Player 26 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.10.1 - Adobe Systems Incorporated)
Adobe Photoshop CC 2017 (HKLM-x32\...\PHSP_18_1_1) (Version: 18.1.1 - Adobe Systems Incorporated)
AGFEO TK-Suite Client elements (HKLM-x32\...\AGFEO TK-Suite Client elements) (Version: 1.2.8 - AGFEO GmbH & Co. KG)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 2.04.01 - ASUSTeK Computer Inc.)
ANT Drivers Installer x64 (HKLM\...\{1B6B17C2-176C-433C-93F3-640D12825426}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.6.9.5 - RedFox)
Apple Application Support (32-Bit) (HKLM-x32\...\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{BB109E24-EE90-485B-A28B-ADDEFB40540B}) (Version: 5.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.12.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
bl (HKLM-x32\...\{2A075BB4-E976-4278-BF3F-E5C6945D84C0}) (Version: 1.0.0 - Your Company Name) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
ColorNavigator 6 (HKLM\...\{207AD5A9-A797-4C4B-B8C5-1CB8B54972C8}_is1) (Version: 6.4.7 - EIZO Corporation)
Core Temp 1.7 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.7 - ALCPU)
CPUID CPU-Z 1.80.1 (HKLM\...\CPUID CPU-Z_is1) (Version: 1.80.1 - )
Dropbox (HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\Dropbox) (Version: 32.4.23 - Dropbox, Inc.)
DVR-Compress 2 (HKLM-x32\...\{ACCB1A09-8A57-455B-A77C-FA09581DB304}) (Version: 1.0.0 - Haenlein-Software)
DVR-Studio HD 3 (HKLM-x32\...\DVR-Studio HD 3) (Version: 3.19 - Haenlein-Software)
DVR-Studio HD 4 (HKLM-x32\...\DVR-Studio HD 4) (Version: 4.11 - Haenlein-Software)
Elevated Installer (HKLM-x32\...\{BA007E03-72AE-4D2D-8A73-FA4B935D4015}) (Version: 5.4.1.0 - Garmin Ltd or its subsidiaries) Hidden
Exifer (HKLM-x32\...\Exifer_is1) (Version:  - Friedemann Schmidt)
Garmin Express (HKLM-x32\...\{2f694ffe-66ec-4674-a32d-ec690281ca57}) (Version: 5.4.1.0 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{BCEE507D-8D49-40FF-B437-70E3B9C2D51C}) (Version: 5.4.1.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (HKLM-x32\...\{198E262D-8C4F-4131-91C7-1F81FB8688F1}) (Version: 5.4.1.0 - Garmin Ltd or its subsidiaries) Hidden
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
GoPro Studio 2.5.2 (HKLM-x32\...\GoPro Studio) (Version: 2.5.2 - GoPro, Inc.)
HP LJ300-400 color MFP M375-M475 (HKLM-x32\...\{9D1DE902-8058-4555-A16A-FBFAA49587DB}) (Version: 15.0.16078.1402 - Hewlett-Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
hpbDSService (HKLM-x32\...\{9767CBB5-2A81-427D-8F05-497737D56AA0}) (Version: 001.001.05133 - Hewlett-Packard) Hidden
hpbM375M475DSService (HKLM-x32\...\{3E64C460-0FAA-4450-99CE-783B0F662B8F}) (Version: 001.001.05164 - Hewlett-Packard) Hidden
HPLaserJet300-400ColorM375-M475Series_HelpLearnCenter_SI (HKLM-x32\...\{72A474E0-5AA3-4EDD-8FAA-D87CB2FD0654}) (Version: 1.01.0000 - Hewlett-Packard)
HPLJDXPHelper (HKLM-x32\...\{010788AB-706E-4604-A46B-6785EAB64B5E}) (Version: 140.069.007 - HP) Hidden
HPLJUTCore (HKLM-x32\...\{06C9D648-CFC6-48CC-A11B-C4A21BEDDAF1}) (Version: 018.000.0001 - HP) Hidden
HPLJUTM375-M475 (HKLM-x32\...\{FA1B7AB4-9FE9-47A8-9A2F-C9FCB2F03A26}) (Version: 1.02.0013 - HP) Hidden
hppFaxDrvM375M475 (HKLM-x32\...\{5145BEFE-84A6-4198-84C7-C8FBC919FE96}) (Version: 004.000.00001 - Hewlett-Packard) Hidden
hppFaxDrvM375M475 (HKLM-x32\...\{B361ED10-259E-4B76-B35E-E47BB6DDDD74}) (Version: 003.000.00002 - Hewlett-Packard) Hidden
hppLaserJetService (HKLM-x32\...\{0C4C3664-157A-4D69-B474-31EBF2EE1AE3}) (Version: 009.033.00926 - Hewlett-Packard) Hidden
hppM375_M475LaserJetService (HKLM-x32\...\{CAB2848F-4E7D-4D64-B071-C1539E345C1C}) (Version: 005.021.00132 - Hewlett-Packard) Hidden
hppSendFaxM375M475 (HKLM-x32\...\{430DEBC5-40AA-4F2C-AB54-A95E6FA8325A}) (Version: 004.000.00001 - Hewlett-Packard) Hidden
hppSendFaxM375M475 (HKLM-x32\...\{C3E833FD-AAF9-45E2-B2CA-091C4D04203F}) (Version: 003.000.00002 - Hewlett-Packard) Hidden
hppToolboxProxyM375 (HKLM-x32\...\{3BEA857F-D027-4759-87D2-28688D508DDE}) (Version: 020.021.004 - HP) Hidden
hpStatusAlerts (HKLM-x32\...\{32DE03E8-D0B3-4D13-A885-D3EDFC959EEC}) (Version: 180.040.00267 - HP Development Company, L.P.) Hidden
hpStatusAlertsM375_M475 (HKLM-x32\...\{21DFECF3-4E16-4B14-9CF1-6D6928BB4BEA}) (Version: 020.023.01805 - Hewlett-Packard) Hidden
hpStatusAlertsM375_M475 (HKLM-x32\...\{22A9EE88-99F1-48B1-8A0C-AB8E65F6C4EB}) (Version: 050.034.0131 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{C510BB61-AE0B-4420-87AF-9CF646E86364}) (Version: 6.2.3.17 - Apple Inc.)
InstanceFinder (HKLM-x32\...\{32C0FD10-8FB4-427E-A16F-ED57C9343CF0}) (Version: 020.021.004 - HP) Hidden
Intel(R) Network Connections 18.1.59.0 (HKLM\...\PROSetDX) (Version: 18.1.59.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{02F95875-9527-49CC-B32F-970ADAEBD1EF}) (Version: 12.6.2.20 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
LJDXPHelperUI (HKLM-x32\...\{DEB23FB1-04FF-44AC-98B5-EEB243D65A28}) (Version: 140.069.007 - HP) Hidden
LRTimelapse 3.4.1 (HKLM-x32\...\{7413A137-4748-4073-BD2D-F87716D37D6C}_is1) (Version: 3.4.1 - Gunther Wegner)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.2.0.1014 - Marvell)
Marvell MV-91xx Windows Driver (HKLM-x32\...\Marvell MV-91xx Windows Driver) (Version: 3.0.2012.08 - ) <==== ACHTUNG
Marvell Storage Utility V4 (HKLM-x32\...\mvMSU) (Version: 4.1.0.2013 - Marvell)
Mercedes-Benz - Download Manager (HKLM-x32\...\{D5E7C657-B9A4-DD11-23F9-0F2C72D77E9E}) (Version: 1.0.24 - Mercedes-Benz Accessories GmbH) Hidden
Mercedes-Benz - Download Manager (HKLM-x32\...\com.daimler.downloadManager) (Version: 1.0.24 - Mercedes-Benz Accessories GmbH)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.8326.2073 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\OneDriveSetup.exe) (Version: 17.3.6943.0625 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
MLNX_CIMProvider (HKLM\...\{9B715172-C304-48A3-BC91-4CC789B08DEB}) (Version: 5.35.12978 - Mellanox Technologies)
MLNX_VPI (HKLM\...\{4986D353-357D-4518-AFFE-4A56D7D67417}) (Version: 5.35.53000 - Mellanox Technologies)
Mocha TN5250 for Windows 7 (HKLM-x32\...\{1B6FE3E2-5A3D-4349-ACBE-2605200B55A5}) (Version: 2.4.0 - MochaSoft)
Mozilla Firefox 54.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 54.0.1 (x86 de)) (Version: 54.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 54.0.1.6388 - Mozilla)
Mp3tag v2.65a (HKLM-x32\...\Mp3tag) (Version: v2.65a - Florian Heidenreich)
NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.00.0000 - Nikon)
NetObjects Fusion 12.0 (HKLM-x32\...\{051F9CB0-1499-4A0E-A861-CB19A5AAA906}) (Version: 12.00.5000.5041 - NetObjects) Hidden
NetObjects Fusion 12.0 (HKLM-x32\...\{44BE1A17-5B51-4CA6-B623-356E83C041A9}) (Version: 12 German - NetObjects)
NetObjects Fusion 12.0 (HKLM-x32\...\{B962E962-6369-4F66-AF35-79CB39270D12}) (Version: 12.00.5000.5041 - NetObjects) Hidden
Nik Collection (HKLM-x32\...\Nik Collection) (Version: 1.2.11 - Google)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
Nuance Power PDF Advanced (HKLM\...\{C9142562-A702-4A8B-A7C0-C6B80A0F77B2}) (Version: 1.10.8424 - Nuance Communications, Inc.)
Nuance Power PDF Hotfix-14219.939.14269 (HKLM-x32\...\{8632BFB7-6317-494E-A017-8A71BC53F7FD}) (Version: 1.00.14269 - Nuance Communications, Inc.)
Nuance Power PDF Hotfix-14219.939.14357 (HKLM-x32\...\{E462B5A4-C4A8-4128-BC3B-14885102B95A}) (Version: 1.00.14357 - Nuance Communications, Inc.)
NVIDIA 3D Vision Controller-Treiber 344.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.46 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 376.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 376.54 - NVIDIA Corporation)
NVIDIA Grafiktreiber 376.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.54 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.17 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8326.2073 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2073 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2073 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.8326.2073 - Microsoft Corporation) Hidden
PDF Settings CS6 (HKLM-x32\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
ph (HKLM-x32\...\{185F9795-9663-4F13-9EF9-307A282ADB5A}) (Version: 1.0.0 - Your Company Name) Hidden
PhotoSync (HKLM\...\{CECDB976-FC3E-49E1-8A47-DF447D8B4DBC}) (Version: 3.0.7 - touchbyte GmbH)
PTGui Pro 10.0.12 (HKLM-x32\...\PTGui) (Version:  - New House Internet Services B.V.)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
RAPID Mode (HKLM\...\{4B94C023-022A-4271-A1D6-744ABE74D220}) (Version: 1.0.0.97 - Samsung Electronics Co., Ltd.) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 5.1.0.1120 - Samsung Electronics)
Spyder4Driver (HKLM-x32\...\Spyder4Driver) (Version:  - )
SurveillancePlugin (HKLM-x32\...\{8A11C74E-2977-4A8E-A3B2-61BDC0CA7C09}) (Version: 1.0.0.973 - Synology)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
Synology Cloud Station (remove only) (HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\Synology CloudStation) (Version:  - )
Synology Cloud Station Drive (HKLM-x32\...\{A08DEA90-1C8D-4776-8063-ADEC202290AC}) (Version: 4.0.4207 - Synology)
Synology Photo Station Uploader (remove only) (HKLM-x32\...\Photo Station Uploader) (Version: 1.4.0.080 - Synology)
Synology Surveillance Station Client (HKLM\...\Synology Surveillance Station Client) (Version: 1.0.4.0231 - Synology)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
TntMPD (HKLM-x32\...\{B0CDA8B2-C397-445F-BADD-97918E3118BE}) (Version: 2.1.16.0 - TntWare) Hidden
TntMPD (HKLM-x32\...\TntMPD) (Version: 2.1.16.0 - TntWare)
ToolboxProxy (HKLM-x32\...\{55757576-28B2-4552-AAF6-340F9FFBA9FA}) (Version: 020.023.005 - HP) Hidden
TreeSize Free V4.0.3 (HKLM-x32\...\TreeSize Free_is1) (Version: 4.0.3 - JAM Software)
VC_CRT_x64 (HKLM\...\{54F2237F-018C-483B-8884-9FC0D88840C3}) (Version: 1.02.0000 - Intel Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Web Components (HKLM-x32\...\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1) (Version:  - )
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17384 - Microsoft Corporation)
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices  (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012  - GoPro)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - FTDI CDM Driver Package (07/12/2010 2.08.02) (HKLM\...\498B9978CE49397903524B0761200F43EC650044) (Version: 07/12/2010 2.08.02 - FTDI)
Windows-Treiberpaket - FTDI CDM Driver Package (07/12/2010 2.08.02) (HKLM\...\67170FB0228B69BCCBEF8CE14A76953A5505D8EA) (Version: 07/12/2010 2.08.02 - FTDI)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version:  - )
Wireshark 2.4.0 64-bit (HKLM-x32\...\Wireshark) (Version: 2.4.0 - The Wireshark developer community, hxxps://www.wireshark.org)
WOW Slider (HKLM-x32\...\WOW Slider_is1) (Version:  - )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => Keine Datei
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-924F63C5AF7D}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{2C4A5D61-009C-4561-9A33-6AFD542FD237}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\ContextMenu.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{472CE1AD-5D53-4BCF-A1FB-3982A5F55138}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll (TODO: <Company name>)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{48AB5ADA-36B1-4137-99C9-2BD97F8788AB}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll (TODO: <Company name>)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{A433C3E0-8B24-40EB-93C3-4B10D9959F58}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll (TODO: <Company name>)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{AEB16659-2125-4ADA-A4AB-45EE21E86469}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll (TODO: <Company name>)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{C701AD67-3DF0-47C9-89CB-DFA6207BE229}\InprocServer32 -> C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll (TODO: <Company name>)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Marcus\AppData\Local\Microsoft\OneDrive\17.3.6943.0625\amd64\FileSyncApi64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3662077352-612492827-2609421022-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   01UnsuppModule] -> {AEB16659-2125-4ADA-A4AB-45EE21E86469} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll [2017-05-23] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [   02SyncingModule] -> {48AB5ADA-36B1-4137-99C9-2BD97F8788AB} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll [2017-05-23] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [   03SyncedModule] -> {472CE1AD-5D53-4BCF-A1FB-3982A5F55138} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll [2017-05-23] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [   04ReadOnlyModule] -> {A433C3E0-8B24-40EB-93C3-4B10D9959F58} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll [2017-05-23] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [   05NoPermModule] -> {C701AD67-3DF0-47C9-89CB-DFA6207BE229} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\iconOverlay.dll [2017-05-23] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] ()
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\..\Acrobat Elements\ContextMenu64.dll -> Keine Datei
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll -> Keine Datei
ContextMenuHandlers1: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll -> Keine Datei
ContextMenuHandlers1: [NPDF.ShellExtension] -> {03DDC0E5-AF08-40a2-85B9-FEDF1F4A780C} => C:\Program Files (x86)\Nuance\Power PDF\ShellExt.dll -> Keine Datei
ContextMenuHandlers1: [Nuance.SMFCDirectShellExt] -> {B080A0B4-C3ED-4E09-B92C-66D5829AA764} => C:\Program Files (x86)\Nuance\Power PDF\bin\SDirectShellExt.dll -> Keine Datei
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-07-14] (Apple Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll -> Keine Datei
ContextMenuHandlers2: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll -> Keine Datei
ContextMenuHandlers4: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll -> Keine Datei
ContextMenuHandlers4: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll -> Keine Datei
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> Keine Datei
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2016-12-29] (NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] ()
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\..\Acrobat Elements\ContextMenu64.dll -> Keine Datei
ContextMenuHandlers6-x32: [ContMenu] -> {FCF608CF-5716-47C3-A1A8-991D873AF72B} => C:\PROGRA~2\Exifer\EXIFER~1.DLL -> Keine Datei
ContextMenuHandlers6-x32: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll -> Keine Datei
ContextMenuHandlers1_S-1-5-21-3662077352-612492827-2609421022-1000: [CloudStation.SyncFolderContextMenu] -> {2C4A5D61-009C-4561-9A33-6AFD542FD237} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\ContextMenu.dll -> Keine Datei
ContextMenuHandlers1_S-1-5-21-3662077352-612492827-2609421022-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ContextMenuHandlers4_S-1-5-21-3662077352-612492827-2609421022-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ContextMenuHandlers5_S-1-5-21-3662077352-612492827-2609421022-1000: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Users\Marcus\AppData\Roaming\Dropbox\bin\DropboxExt64.18.0.dll [2017-08-10] (Dropbox, Inc.)
ContextMenuHandlers6_S-1-5-21-3662077352-612492827-2609421022-1000: [CloudStation.SyncFolderContextMenu] -> {2C4A5D61-009C-4561-9A33-6AFD542FD237} => C:\Users\Marcus\AppData\Local\CloudStation\CloudStation.app\icon-overlay\18\x64\ContextMenu.dll -> Keine Datei

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {007777A6-68BB-4E47-94F6-DCC889E490C7} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe
Task: {01E2D54C-E5A3-4548-B281-718168F80FA4} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe
Task: {0530CD5E-C914-4F8F-B958-FE655D6FBD0C} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0A0F7BBD-45AD-4A6C-94EE-340D66AAAC5B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {0E7E68E1-2C62-444A-A9A1-65D76628DD6A} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {198A1115-EAA1-4A92-B323-6443F9392C6A} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {20D11AA6-FFAF-4B45-9F0B-2498DAD336D8} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {23BDFA5A-F6DD-4BA5-8F03-75ADA42CBA1C} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe
Task: {25B894C3-6174-4864-95BB-5CC76E176844} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {25BACC02-7C05-4568-BFE1-EE0F67F50BAC} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {27F6060A-957E-4212-81A8-2C6D98DB4F52} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {298CD20B-6C36-4046-B8E9-13C7B75B2541} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {2BCEBA4C-00B8-475E-B7FC-4D718CAB95E7} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
Task: {3415B250-ED0B-45FE-B5E0-48997533B8E9} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {382550D8-5E33-491C-85A5-273A6EF61249} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {3B2F3BC5-96E8-4134-AE16-1C48EB5E9318} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {3D215812-8B9D-44E0-BE7E-7796B8568C6C} - System32\Tasks\S-1-5-21-3662077352-612492827-2609421022-1000\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2017-03-18] (Microsoft Corporation)
Task: {3FA2D3FF-BC6A-4C0F-9BA4-1977CF579F83} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {47674EA2-AE74-42BA-BE93-E8CF42B09E19} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {4AA9703C-9D2F-4859-972A-2B7F7F33B7E4} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> Keine Datei <==== ACHTUNG
Task: {54C6965F-83AE-4A10-8718-6EEA34783E69} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Keine Datei <==== ACHTUNG
Task: {5D755341-4D88-4BE4-88DB-FFD23A6E1E2E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {66BCB4CA-1E3F-4356-B4E4-CEA569C66CB9} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> Keine Datei <==== ACHTUNG
Task: {676F0AFA-0E02-4FAA-9545-0826AB78A574} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {68F757D3-8578-4587-956F-4D7386258AF8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Task: {6C8A8839-C90A-4A1D-A318-C303B9F48124} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {6F970500-D1B2-48D1-9F9D-4FBF310DE340} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe
Task: {7D0B4DDE-6BF0-4BEC-A2CC-18F6FE2AA9AF} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {845B6146-6412-41BB-8D3F-F761CBAD54CB} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {8B16B648-8CC7-4190-802F-8F47FB971E28} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> Keine Datei <==== ACHTUNG
Task: {8B5DF26F-4CA9-4B3E-BF3C-F8E84688A349} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {8B6527C3-DD6E-495F-BFE2-E5BC7C4D5EBA} - System32\Tasks\HPLJCustParticipation => C:\Program Files (x86)\HP\HPLJUT\HPLJUTSCH.exe
Task: {8D7CCEC0-DF13-4F0E-8D8C-17EE8DC69FB1} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8ECABF73-9B88-4FDA-9D8D-F2A4205E1C90} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {92322850-5A13-47EF-92E5-528E6576E8E3} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {92828FC7-FAB6-4CFE-9E12-F89E0A997936} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {98A0CB51-33F9-42ED-A771-597EF9475C2C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3662077352-612492827-2609421022-1000Core1d23aa3615c3b8f => C:\Users\Marcus\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: {98D361D7-87D0-4D21-8AC8-4BE7B270C914} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe [2017-05-19] (Samsung Electronics Co. Ltd.)
Task: {9D89C342-FD33-41CE-B101-59BFB3910CDA} - System32\Tasks\ASUS\ASUS DigiPowerControl Help => C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe [2013-01-14] (ASUSTeK Computer Inc.)
Task: {9E81016F-A1B2-4454-AD8F-4B7C447C1C85} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {A0134792-ECEA-4B89-AC41-F1E852B12ADD} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A2EDBF14-3077-4AA1-A132-67D4716D4D51} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {A36973B0-1413-4D3B-92AE-1A37D6889E4F} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {A851387A-CD2B-4262-B53A-5F421F992697} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3662077352-612492827-2609421022-1000 => C:\Users\Marcus\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {ABD1298F-1414-4ED4-A0A8-5E2C93D1F025} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {B0B22CD5-8C2E-42FA-B77D-A15FC6A588B4} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BE1163E2-ACF5-49BD-892C-D9B10D7E2AFA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
Task: {C37196C9-50A2-4A4F-8668-CF4524184E7A} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3662077352-612492827-2609421022-1000UA1d23aa36161fd10 => C:\Users\Marcus\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: {C3F5412B-2546-430A-9645-B4199F6FC451} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {C8810147-4C47-4889-81F7-94A04E07B18D} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {CBDA16A6-4F48-41DC-9425-20AFA126387D} - System32\Tasks\ASUS\Easy Update => C:\Program Files (x86)\ASUS\AI Suite II\EasyUpdate\EzUpdt.exe [2013-10-18] ()
Task: {CDD21938-B719-4D9D-A363-B0678EDD2759} - System32\Tasks\AdobeAAMUpdater-1.0-Marcus-PChome-Marcus => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
Task: {CE4A9298-5BD2-41EC-8E3F-68E6B5AB0EA1} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {D2C75E7A-1D05-4CCB-BBA3-DF3024DB8154} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {DA477E0C-8158-4D50-A9E2-69A6594A5E51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {DF358E55-A6AC-44E3-AEEB-4E073547D666} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {E0EA1E23-9433-41D3-8A4E-8212F33BD0A6} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\Marcus\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {E2456BD6-3FBA-4B44-8824-11614A7F9113} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {E8788B92-EA6D-4F2D-AEDA-FAE8CFA30A3B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {EC36F9DD-BF9F-4497-8A23-AA8F5ED1397C} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F13F7EF6-B75A-4CEE-9339-D7DBB49659CB} - \CCleanerSkipUAC -> Keine Datei <==== ACHTUNG
Task: {F3A5A938-AFCC-4C1C-8671-62BE8D11CF92} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {F40500F3-7B31-45A3-8BC9-5659D00223DE} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {FB1BAA51-F0CA-49A1-B3E3-176FBDFDAE36} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {FBC0A7CA-E0D2-4DDD-93C3-C5B2AA85B786} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-08-12] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-3662077352-612492827-2609421022-1000Core1d23aa3615c3b8f.job => C:\Users\Marcus\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-3662077352-612492827-2609421022-1000UA1d23aa36161fd10.job => C:\Users\Marcus\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen & WMI ========================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)


==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2017-05-26 03:18 - 2017-05-26 03:18 - 000492112 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2017-03-18 22:58 - 2017-03-18 22:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 22:59 - 2017-03-20 06:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\TEMP:054203E4 [302]
AlternateDataStreams: C:\ProgramData\TEMP:F9CFE070 [760]
AlternateDataStreams: C:\Users\Marcus\Cookies:RTJ227mZkrwhigDB4NOZ [2076]
AlternateDataStreams: C:\Users\Marcus\AppData\Local\U7MLjjEyZ:tGzlJdHwsawT5FhlEl33RK2Hrfm [1848]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
iver"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3662077352-612492827-2609421022-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 192.168.123.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall ist deaktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GoPro Importer.lnk => C:\Windows\pss\GoPro Importer.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Marcus^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ColorNavigator 6.lnk => C:\Windows\pss\ColorNavigator 6.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Marcus^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TK-Suite Client elements.lnk => C:\Windows\pss\TK-Suite Client elements.lnk.Startup
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AnyDVD => "C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe"
MSCONFIG\startupreg: GarminExpressTrayApp => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
MSCONFIG\startupreg: HP LJ300-400 color MFP M375-M475 Series Fax => C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe "HP LJ300-400 color MFP M375-M475 Series Fax"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: IAStorIcon => "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: ISUSPM => "C:\ProgramData\FLEXnet\Connect\11\isuspm.exe" -scheduler
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Nuance Power PDF Advanced-reminder => "C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\Power PDF Advanced\Ereg\Ereg.ini"
MSCONFIG\startupreg: NuanPowerPdf1NPDFLM => "C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe"
MSCONFIG\startupreg: PowerPDF Registry Controller => "C:\Program Files (x86)\Nuance\Power PDF\RegistryController.exe"
MSCONFIG\startupreg: PowerPDFInboxMonitor => "C:\Program Files (x86)\Nuance\Power PDF\InboxMonitor.exe" /run
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: StatusAlerts => "C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "ISUSPM"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "PowerPDF Registry Controller"
HKLM\...\StartupApproved\Run32: => "MSUTray"
HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\StartupApproved\Run: => "AnyDVD"
HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\StartupApproved\Run: => "Dropbox Update"
HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\StartupApproved\Run: => "GarminExpressTrayApp"
HKU\S-1-5-21-3662077352-612492827-2609421022-1000\...\StartupApproved\Run: => "OneDrive"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{41BD4878-9CC4-4347-8021-181BD6A29925}] => (Allow) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
FirewallRules: [{CBD5233E-AE24-43E0-AECD-4C43BEC03561}] => (Allow) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
FirewallRules: [UDP Query User{7E4CF629-AB84-435B-8C1F-9A2C53C8ECC8}C:\program files (x86)\marvell\storage\apache2\bin\httpd.exe] => (Allow) C:\program files (x86)\marvell\storage\apache2\bin\httpd.exe
FirewallRules: [TCP Query User{65CB59BE-2D8F-4FF3-A2CD-2FE05A446E3C}C:\program files (x86)\marvell\storage\apache2\bin\httpd.exe] => (Allow) C:\program files (x86)\marvell\storage\apache2\bin\httpd.exe
FirewallRules: [UDP Query User{2E474D06-4C35-48F6-9983-6F9A95EFA668}C:\program files (x86)\dvr-studio hd 4\dvr-studio hd.exe] => (Allow) C:\program files (x86)\dvr-studio hd 4\dvr-studio hd.exe
FirewallRules: [TCP Query User{B2085467-C4DF-4DA1-9A07-44D7EC26D034}C:\program files (x86)\dvr-studio hd 4\dvr-studio hd.exe] => (Allow) C:\program files (x86)\dvr-studio hd 4\dvr-studio hd.exe
FirewallRules: [UDP Query User{E841AFFA-038B-4A55-9E16-77F28CF310AD}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => (Allow) C:\program files (x86)\synology\photo station uploader\mediauploader.exe
FirewallRules: [TCP Query User{E6477677-BA84-4B27-9A1A-37BE527266DA}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => (Allow) C:\program files (x86)\synology\photo station uploader\mediauploader.exe
FirewallRules: [{470837EA-BFD0-4D70-A952-CABDA25ED4E4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9A99084A-A251-40FF-9288-73E97FFBBB77}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F548F4E0-0572-40C4-89A4-FE9123C063C0}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{94401F5C-1670-4831-8958-439280CAC238}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{B6653AD7-19F3-4BA8-9F33-3463ABF97FDB}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{9E6F07F2-C448-4754-A285-76D8A6E92064}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{4DEBFE76-3D3B-4F1B-8BDE-601C64E4D1FD}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{42882F9B-B029-4331-9E9C-D3CC0EE731ED}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{997276CB-ABBC-4924-A839-2BE29BA25C13}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{2FD88D6A-FCB0-4FA8-AA95-0A4E00EC810D}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{E9130E93-7C65-4ABA-B93F-3DC64ADC724E}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{BD4FF90B-9440-4B90-AAB1-77ECA88A86A6}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{36D6D1F5-7972-4146-8997-4C410226D8A7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{F3334AB8-ABFD-4A7F-BBB3-7083D8E46CB1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9D6FE764-CE2A-46C9-879E-8E324945D6DF}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{52E1DCB5-DF8B-42FB-8E4F-3B0C453F2788}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{171333D6-6095-4712-9EDD-21103928C614}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{5193F0D7-3718-4F23-AC09-7E7917D7F041}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{E591B2AC-4E7A-4073-BFE4-6920892AE83D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{E6AA020E-15E1-4988-A6C7-78E72796AC5D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [UDP Query User{709904B0-B365-49FC-9DCA-63B8F55E2857}C:\program files (x86)\dvr-studio hd 3\dvr-studio hd.exe] => (Allow) C:\program files (x86)\dvr-studio hd 3\dvr-studio hd.exe
FirewallRules: [TCP Query User{2EFC24C4-B5D5-49DD-AB90-6D825C4A1BBA}C:\program files (x86)\dvr-studio hd 3\dvr-studio hd.exe] => (Allow) C:\program files (x86)\dvr-studio hd 3\dvr-studio hd.exe
FirewallRules: [{DEBDDA75-C919-40FB-B7FB-5A24F3DCD5ED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D0C5BDFB-0932-4935-8929-FB140E0A1E39}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{14A444B5-9489-4F99-AC7F-B88573B1D75A}C:\users\marcus\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\marcus\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{4AE25357-3EB8-4B5B-8DEF-527FFEEE8A30}C:\users\marcus\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\marcus\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{08D1D960-74B3-4EE0-8D1E-A34C6C2ACBDB}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Allow) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{907EEEE4-EA09-43C8-B21A-15E295E16163}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Allow) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [{C84C84D8-BB40-4CEE-83BB-E53E969D8983}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\9D1DE902-8058-4555-A16A-FBFAA49587DB\Installer\hpbcsiInstaller.exe
FirewallRules: [{4F5FDB1C-8B7F-4B2C-93E4-F6EBB65C7C98}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\9D1DE902-8058-4555-A16A-FBFAA49587DB\Installer\hpbcsiInstaller.exe
FirewallRules: [{2CC04E8E-C889-478D-A8B4-2029F1527991}] => (Allow) LPort=35722
FirewallRules: [UDP Query User{921E345F-37BF-4D68-90BC-BE9AE4466D42}C:\program files\eizo\colornavigator 6\core\cn6_eacore.exe] => (Allow) C:\program files\eizo\colornavigator 6\core\cn6_eacore.exe
FirewallRules: [TCP Query User{94AE5847-26C4-4702-89DE-0B23AC9FC3B0}C:\program files\eizo\colornavigator 6\core\cn6_eacore.exe] => (Allow) C:\program files\eizo\colornavigator 6\core\cn6_eacore.exe
FirewallRules: [{E5CFEBF5-EC30-4651-89E3-315EF939B9FC}] => (Allow) C:\Users\Marcus\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C4F51B56-AF70-482C-AF23-E169668A84D1}] => (Allow) C:\Users\Marcus\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{9FB8D4A6-3EF8-40B6-BE40-D90CC0A90336}] => (Allow) C:\Program Files\EIZO\ColorNavigator 6\core\cn6_eacore.exe
FirewallRules: [{8A76C87B-420C-4E65-94E7-8DECC4C39052}] => (Allow) C:\Program Files\EIZO\ColorNavigator 6\core\cn6_eacore.exe
FirewallRules: [TCP Query User{EB8C9C05-7D50-4A1A-8B45-BEBC696D6B98}C:\users\marcus\appdata\local\cloudstation\cloudstation.app\bin\cloud-drive-ui.exe] => (Allow) C:\users\marcus\appdata\local\cloudstation\cloudstation.app\bin\cloud-drive-ui.exe
FirewallRules: [UDP Query User{FDFF442F-B6A7-4F48-B11A-6316D4474692}C:\users\marcus\appdata\local\cloudstation\cloudstation.app\bin\cloud-drive-ui.exe] => (Allow) C:\users\marcus\appdata\local\cloudstation\cloudstation.app\bin\cloud-drive-ui.exe
FirewallRules: [TCP Query User{FD917EF7-DC10-4AF2-B49E-BFA6ABF41E6C}C:\program files (x86)\hp\hp lj300-400 color mfp m375-m475\bin\faxapplications.exe] => (Allow) C:\program files (x86)\hp\hp lj300-400 color mfp m375-m475\bin\faxapplications.exe
FirewallRules: [UDP Query User{4D190F8D-A44F-4E83-90AD-861BB3903EDD}C:\program files (x86)\hp\hp lj300-400 color mfp m375-m475\bin\faxapplications.exe] => (Allow) C:\program files (x86)\hp\hp lj300-400 color mfp m375-m475\bin\faxapplications.exe
FirewallRules: [TCP Query User{B67A2C5D-ACB9-4775-B596-0917465FD0F6}C:\program files\synology\surveillancestationclient\bin\svsclient.exe] => (Allow) C:\program files\synology\surveillancestationclient\bin\svsclient.exe
FirewallRules: [UDP Query User{C1819C52-D4FF-4AFC-B363-4E8164BAC3E3}C:\program files\synology\surveillancestationclient\bin\svsclient.exe] => (Allow) C:\program files\synology\surveillancestationclient\bin\svsclient.exe
FirewallRules: [{B8EEA47F-03DA-49AA-BDD6-E79469A21B84}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{DBBAB46D-B4E6-4FB0-8B8D-401611C3EDF4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{D32F1616-0E06-4BB0-9325-CC4BD98F16F1}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

==================== Wiederherstellungspunkte =========================


==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Mellanox ConnectX EN (MT26448) - PCIe 2.0 5GT/s, 10GigE Ethernet Adapter
Description: Mellanox ConnectX EN (MT26448) - PCIe 2.0 5GT/s, 10GigE Ethernet Adapter
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Mellanox Technologies Ltd.
Service: mlx4_bus
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 

Name: Wireless Device
Description: Wireless Device
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/22/2017 10:13:09 AM) (Source: Apache Service) (EventID: 3299) (User: )
Description: The Apache service named  reported the following error:
>>> httpd.exe: Could not open configuration file C:/Program Files (x86)/Marvell/storage/Apache2/conf/httpd.conf: Das System kann die angegebene Datei nicht finden.     .

Error: (08/22/2017 01:28:06 AM) (Source: Apache Service) (EventID: 3299) (User: )
Description: The Apache service named  reported the following error:
>>> httpd.exe: Could not open configuration file C:/Program Files (x86)/Marvell/storage/Apache2/conf/httpd.conf: Das System kann die angegebene Datei nicht finden.     .

Error: (08/22/2017 01:27:15 AM) (Source: Apache Service) (EventID: 3299) (User: )
Description: The Apache service named  reported the following error:
>>> httpd.exe: Could not open configuration file C:/Program Files (x86)/Marvell/storage/Apache2/conf/httpd.conf: Das System kann die angegebene Datei nicht finden.     .

Error: (08/17/2017 09:02:57 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Fehler beim Laden des Protokollhandlers Mapi16. Fehlerbeschreibung: Das angegebene Modul wurde nicht gefunden.  (HRESULT : 0x8007007e).

Error: (08/17/2017 09:02:25 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Die Liste der eingeschlossenen und ausgeschlossenen Adressen konnte vvon Windows Search nicht verarbeitet werden. Fehler: <30, 0x80040d07, "iehistory://{S-1-5-21-3662077352-612492827-2609421022-1000}/">.

Error: (08/17/2017 09:01:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.15063.0, Zeitstempel: 0x58ccbd2e
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 10.0.15063.540, Zeitstempel: 0xd330c8c8
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000004434af
ID des fehlerhaften Prozesses: 0x4344
Startzeit der fehlerhaften Anwendung: 0x01d3178b3a046771
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\Windows.UI.Xaml.dll
Berichtskennung: 0cb25c1c-031d-444d-a937-4dc833dd0dc9
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (08/17/2017 09:01:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.15063.0, Zeitstempel: 0x58ccbd2e
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 10.0.15063.540, Zeitstempel: 0xd330c8c8
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000004434af
ID des fehlerhaften Prozesses: 0x136c
Startzeit der fehlerhaften Anwendung: 0x01d3178b3836d692
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\Windows.UI.Xaml.dll
Berichtskennung: ac8ea406-f149-4c08-845a-db6671f2e72d
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (08/17/2017 09:01:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.15063.0, Zeitstempel: 0x58ccbd2e
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 10.0.15063.540, Zeitstempel: 0xd330c8c8
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000004434af
ID des fehlerhaften Prozesses: 0x11b4
Startzeit der fehlerhaften Anwendung: 0x01d3178b366c62e2
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\Windows.UI.Xaml.dll
Berichtskennung: bd2fcd5a-8a1b-48bf-a03e-23cb1c6b34fc
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (08/17/2017 09:01:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.15063.0, Zeitstempel: 0x58ccbd2e
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 10.0.15063.540, Zeitstempel: 0xd330c8c8
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000004434af
ID des fehlerhaften Prozesses: 0x343c
Startzeit der fehlerhaften Anwendung: 0x01d3178b34a2cd66
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\Windows.UI.Xaml.dll
Berichtskennung: 12cdd96d-a6c8-4a59-8284-e2e2ae21bc72
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (08/17/2017 09:01:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.15063.0, Zeitstempel: 0x58ccbd2e
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 10.0.15063.540, Zeitstempel: 0xd330c8c8
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000004434af
ID des fehlerhaften Prozesses: 0x4304
Startzeit der fehlerhaften Anwendung: 0x01d3178b328adea3
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\Windows.UI.Xaml.dll
Berichtskennung: 21e3ae79-306b-4541-8de7-32703331393a
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App


Systemfehler:
=============
Error: (08/22/2017 10:16:27 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:27 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:27 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:27 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:25 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (08/22/2017 10:16:08 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (08/22/2017 10:16:07 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:07 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (08/22/2017 10:16:02 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (08/22/2017 10:15:40 AM) (Source: DCOM) (EventID: 10005) (User: MARCUS-PCHOME)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}


CodeIntegrity:
===================================
  Date: 2017-08-17 20:55:00.607
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-17 20:55:00.605
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-17 19:04:14.834
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-17 19:04:14.832
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-17 18:50:27.069
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-17 18:50:27.067
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-13 13:40:19.821
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-13 13:40:19.819
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-12 15:10:47.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-08-12 15:10:47.390
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-3960X CPU @ 3.30GHz
Prozentuale Nutzung des RAM: 7%
Installierter physikalischer RAM: 16325.58 MB
Verfügbarer physikalischer RAM: 15031.44 MB
Summe virtueller Speicher: 32709.58 MB
Verfügbarer virtueller Speicher: 31558.05 MB

==================== Laufwerke ================================

Drive b: (Bilder) (Fixed) (Total:931.39 GB) (Free:931.01 GB) NTFS
Drive c: (Win7) (Fixed) (Total:476.28 GB) (Free:335.51 GB) NTFS
Drive d: (ESD-USB) (Removable) (Total:14.42 GB) (Free:8.51 GB) FAT32
Drive f: (Disc) (CDROM) (Total:1.27 GB) (Free:0 GB) UDF

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: F1879C26)

Partition: GPT.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 14.4 GB) (Disk ID: C9454440)
Partition 1: (Active) - (Size=14.4 GB) - (Type=0C)

==================== Ende von Addition.txt ============================
         

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 22.08.17
Scan-Zeit: 10:27
Protokolldatei: log malwarebytes.txt
Administrator: Ja

-Softwaredaten-
Version: 3.1.2.1733
Komponentenversion: 1.0.139
Version des Aktualisierungspakets: 1.0.2635
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: MARCUS-PCHOME\Marcus

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 468294
Erkannte Bedrohungen: 10
In die Quarantäne verschobene Bedrohungen: 10
Abgelaufene Zeit: 0 Min., 44 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 3
Trojan.MalPack, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|btc2017-india_2017-08-17_09-21.exe, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, HKU\S-1-5-21-3662077352-612492827-2609421022-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|btc2017-india_2017-08-17_09-21.exe, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, HKU\S-1-5-21-3662077352-612492827-2609421022-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|btc2017-india_2017-08-17_09-21.exe, Löschen bei Neustart, [41], [426579],1.0.2635

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 7
Trojan.MalPack, C:\WINDOWS\SYSTEM32\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\USERS\BACKUP\APPDATA\ROAMING\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\USERS\MARCUS\APPDATA\ROAMING\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\USERS\BACKUP\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\USERS\MARCUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635
Trojan.MalPack, C:\USERS\BACKUP\DOCUMENTS\BTC2017-INDIA_2017-08-17_09-21.EXE, Löschen bei Neustart, [41], [426579],1.0.2635

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)