Google Chrome Reset & Packed.VMProtect.ABD Trojaner

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 09-12-2017
durchgeführt von ***** (Administrator) auf CINEGRAFFIX (10-12-2017 11:21:26)
Gestartet von C:\Users\*****\Desktop
Geladene Profile: ***** (Verfügbare Profile: ***** & **********)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
() C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Palm) C:\Program Files (x86)\HP webOS\SDK\bin\novacomd\x86\novacomd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
() C:\Program Files (x86)\HP webOS\PDK\tcprelay.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297272 2017-12-05] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2407008 2017-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1871344 2017-11-04] (Adobe Systems Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKU\S-1-5-21-3458773745-2075050605-1070322646-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-3458773745-2075050605-1070322646-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-10-19] (Apple Inc.)
HKU\S-1-5-21-3458773745-2075050605-1070322646-1000\...\MountPoints2: {91b1dfe8-5664-11e2-aba1-806e6f6e6963} - Q:\.\Bin\ASSETUP.exe
HKU\S-1-5-18\...\Run: [] => [X]
IFEO\notepad.exe: [Debugger] "C:\Program Files\Notepad2\Notepad2.exe" /z
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk [2017-12-08]
ShortcutTarget: Logitech . Produktregistrierung.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{69E4630D-1A01-4998-9122-EA1A5F5F3EE2}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{A973FD47-15DE-4114-A081-07B68A57139E}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{DE9129D6-95DB-449C-AB17-40463F338A0D}: [DhcpNameServer] 172.20.10.1

Internet Explorer:
==================
HKU\S-1-5-21-3458773745-2075050605-1070322646-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131505218575769462&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131505218575769462&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3458773745-2075050605-1070322646-1000 -> {ACAE303C-0F75-40B0-82B0-0105200A98AF} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-11-17] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-08-06] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-11-09] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-06] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-23] (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\ssv.dll [2017-08-06] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-12-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-06] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-23] (Hewlett-Packard Co.)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-3458773745-2075050605-1070322646-1000 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://files.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://files.creative.com/Web/softwareupdate/ocx/150323/CTPID.cab
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-01] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-01] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-01] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-12-01] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 -  Keine Datei
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: k741u5pw.default-1497732525045
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\k741u5pw.default-1497732525045 [2017-12-10]
FF Homepage: Mozilla\Firefox\Profiles\k741u5pw.default-1497732525045 -> hxxps://www.google.de/
FF Extension: (Avira Browserschutz) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\k741u5pw.default-1497732525045\Extensions\abs@avira.com.xpi [2017-12-08]
FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2017-11-27]
FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com => nicht gefunden
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2017-02-09] [Lagacy] [ist nicht signiert]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF HKU\S-1-5-21-3458773745-2075050605-1070322646-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-17] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2013-09-17] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-06] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.1 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [Keine Datei]
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2017-09-20] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [Keine Datei]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-17] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll [2013-06-26] (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-04-15] (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2013-09-17] (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2013-10-28] (DivX, LLC)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-06] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-06] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-29] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-07-18] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-07-18] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-09] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-09] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.1 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [Keine Datei]
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2017-11-04] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2017-09-20] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-3458773745-2075050605-1070322646-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\*****\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-3458773745-2075050605-1070322646-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [Keine Datei]

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxps://www.google.de/"
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default [2017-12-10]
CHR Extension: (ProxFlow) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2017-12-02]
CHR Extension: (Adobe Acrobat) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-09]
CHR Extension: (Avira Browserschutz) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2017-10-01]
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-12-08]
CHR Extension: (TinEye Reverse Image Search) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2017-07-28]
CHR Extension: (Adobe Edge Inspect CC) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijoeapleklopieoejahbpdnhkjjgddem [2014-09-19]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-29]
CHR Extension: (Click&Clean App) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2017-12-08]
CHR Extension: (Chrome Media Router) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-08]
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\System Profile [2017-12-08]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [817760 2017-09-20] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2257016 2017-08-23] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-11-27] (Apple Inc.)
R2 Asset Management Daemon; C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe [118784 2009-06-26] () [Datei ist nicht signiert]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8063664 2017-11-22] (Microsoft Corporation)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [233328 2012-01-23] (DTS, Inc)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe [69632 2009-06-26] () [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-11] (Seiko Epson Corporation)
S4 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-23] (Hewlett-Packard Co.) [Datei ist nicht signiert]
S4 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [Datei ist nicht signiert]
S4 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-23] (Hewlett-Packard Co.) [Datei ist nicht signiert]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
S4 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [49664 2013-10-08] (Haufe-Lexware GmbH & Co. KG) [Datei ist nicht signiert]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [Datei ist nicht signiert]
R2 NovacomD; C:\Program Files (x86)\HP webOS\SDK\bin\novacomd\x86\novacomd.exe [61440 2011-09-19] (Palm) [Datei ist nicht signiert]
S3 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495040 2017-07-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495040 2017-07-19] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462968 2017-07-18] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-07-19] (NVIDIA Corporation)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2119688 2016-12-13] (Electronic Arts)
S4 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2180624 2016-12-13] (Electronic Arts)
R2 Palm_TCP_Relay; C:\Program Files (x86)\HP webOS\PDK\tcprelay.exe [11776 2011-12-21] () [Datei ist nicht signiert]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [Datei ist nicht signiert]
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2016-12-13] ()
S4 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-12-30] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.229\WsAppService.exe [493280 2017-08-21] (Wondershare)
S3 AfterFLICS v3; C:\Program Files (x86)\AFLICS\AfterFLICS.exe [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S1 acedrv05; C:\Windows\system32\drivers\acedrv05.sys [136192 2016-04-05] () [Datei ist nicht signiert]
S3 DJM-2000Audio; C:\Windows\System32\drivers\DJM-2000Audio64.sys [60280 2010-05-21] (Pioneer Corporation.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-10-13] ()
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [192952 2017-10-13] (Malwarebytes)
S3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2017-10-13] (Malwarebytes)
S3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [45504 2017-10-13] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [252232 2017-12-09] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2017-10-14] (Malwarebytes)
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2014-08-23] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [48064 2017-07-19] (NVIDIA Corporation)
R3 PdiPorts; C:\Windows\System32\DRIVERS\PdiPorts.sys [20520 2009-05-27] (Portrait Displays, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-05-20] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2014-05-20] (Acronis)
S3 V0610Vid; C:\Windows\System32\DRIVERS\V0610Vid.sys [323136 2011-09-02] (Creative Technology Ltd.)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-05-20] (Acronis International GmbH)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WacHidRouter; system32\DRIVERS\wachidrouter.sys [X]
S3 wacomrouterfilter; system32\DRIVERS\wacomrouterfilter.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-12-10 11:21 - 2017-12-10 11:23 - 000028025 _____ C:\Users\*****\Desktop\FRST.txt
2017-12-10 11:21 - 2017-12-10 11:21 - 000000000 ____D C:\FRST
2017-12-10 11:19 - 2017-12-10 11:19 - 000002258 _____ C:\Users\*****\Desktop\eset.txt
2017-12-09 20:41 - 2017-12-09 20:41 - 000001751 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-12-09 20:41 - 2017-12-09 20:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-12-09 20:41 - 2017-12-09 20:41 - 000000000 ____D C:\Program Files\iTunes
2017-12-09 20:41 - 2017-12-09 20:41 - 000000000 ____D C:\Program Files\iPod
2017-12-09 13:38 - 2017-12-09 13:38 - 002390528 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2017-12-09 13:29 - 2017-12-09 13:29 - 000000000 ____D C:\Program Files (x86)\ESET
2017-12-09 13:28 - 2017-12-09 13:28 - 002870984 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe
2017-12-09 13:12 - 2017-12-09 13:12 - 000000000 ____D C:\Users\*****\AppData\Local\ElevatedDiagnostics
2017-12-09 13:01 - 2017-12-09 13:01 - 008187336 _____ (Malwarebytes) C:\Users\*****\Downloads\AdwCleaner_7.0.5.0 (1).exe
2017-12-09 12:50 - 2017-12-09 12:50 - 008172032 _____ (Malwarebytes) C:\Users\*****\Downloads\adwcleaner_7.0.5.0(1).exe
2017-12-09 10:08 - 2017-12-09 10:08 - 000001094 _____ C:\Users\*****\Desktop\MSI Afterburner.lnk
2017-12-09 10:06 - 2017-12-09 10:07 - 039234032 _____ C:\Users\*****\Downloads\MSIAfterburnerSetup.zip
2017-12-08 22:09 - 2017-12-09 13:26 - 000000000 ____D C:\AdwCleaner
2017-12-08 22:09 - 2017-12-08 22:09 - 008187336 _____ (Malwarebytes) C:\Users\*****\Downloads\adwcleaner_7.0.5.0.exe
2017-12-08 20:38 - 2017-12-09 23:32 - 000000000 ____D C:\Users\*****\AppData\Roaming\obs-studio
2017-12-08 20:37 - 2017-12-08 20:37 - 000001206 _____ C:\Users\Public\Desktop\OBS Studio.lnk
2017-12-08 20:37 - 2017-12-08 20:37 - 000000000 ____D C:\Program Files (x86)\obs-studio
2017-12-08 20:35 - 2017-12-08 20:36 - 102779800 _____ (obsproject.com) C:\Users\*****\Downloads\OBS-Studio-20.1.3-Full-Installer (2).exe
2017-12-08 20:22 - 2017-12-08 20:22 - 000000000 ____D C:\Users\*****\AppData\Local\Logitech® Webcam-Software
2017-12-08 20:20 - 2017-12-08 20:20 - 000000000 ____D C:\ProgramData\LogiShrd
2017-12-08 20:19 - 2017-12-08 20:19 - 000001628 _____ C:\Users\Public\Desktop\Logitech Webcam Software  .lnk
2017-12-08 20:19 - 2017-12-08 20:19 - 000000000 ____D C:\Users\*****\AppData\Roaming\Leadertech
2017-12-08 20:19 - 2017-12-08 20:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2017-12-08 20:19 - 2017-12-08 20:19 - 000000000 ____D C:\ProgramData\Logitech
2017-12-08 20:19 - 2017-12-08 20:19 - 000000000 ____D C:\Program Files (x86)\Logitech
2017-12-08 20:11 - 2017-12-08 20:12 - 102779800 _____ (obsproject.com) C:\Users\*****\Downloads\OBS-Studio-20.1.3-Full-Installer (1).exe
2017-12-08 19:59 - 2017-12-08 19:59 - 000000000 ____D C:\ProgramData\Intel Telemetry
2017-12-08 19:58 - 2017-12-08 19:59 - 000000000 ____D C:\ProgramData\Intel
2017-12-08 19:56 - 2017-12-08 19:57 - 102779800 _____ (obsproject.com) C:\Users\*****\Downloads\OBS-Studio-20.1.3-Full-Installer.exe
2017-12-08 19:49 - 2017-12-08 20:19 - 000000000 ____D C:\Program Files\Common Files\logishrd

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-12-10 11:21 - 2013-10-11 11:03 - 000024202 _____ C:\Users\*****\AppData\Roaming\Notepad2.ini
2017-12-10 09:01 - 2009-07-14 05:45 - 000021840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-12-10 09:01 - 2009-07-14 05:45 - 000021840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-12-10 02:00 - 2013-03-30 16:42 - 000000000 ____D C:\Users\*****\AppData\Local\Adobe
2017-12-09 20:51 - 2017-10-01 13:35 - 000003044 _____ C:\Windows\System32\Tasks\MSIAfterburner
2017-12-09 20:51 - 2013-05-29 11:02 - 000000000 ____D C:\ProgramData\NVIDIA
2017-12-09 20:47 - 2017-10-13 19:48 - 000252232 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2017-12-09 20:47 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-12-09 13:12 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\system32\NDF
2017-12-09 13:06 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2017-12-09 13:02 - 2009-07-14 05:45 - 010442296 _____ C:\Windows\system32\FNTCACHE.DAT
2017-12-09 13:01 - 2013-03-30 13:29 - 000169256 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2017-12-09 12:56 - 2013-03-30 16:15 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-12-09 12:55 - 2016-12-22 16:59 - 000000000 ____D C:\Users\*****\AppData\Roaming\Yahoo!
2017-12-09 12:49 - 2017-05-07 13:28 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-12-09 12:49 - 2017-04-28 09:19 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Mozilla
2017-12-09 12:49 - 2013-03-30 16:15 - 000000000 ____D C:\Users\*****\AppData\Roaming\Mozilla
2017-12-09 12:45 - 2013-03-30 16:01 - 000003542 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-12-09 12:45 - 2013-03-30 16:01 - 000003414 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-12-09 10:17 - 2014-11-14 19:49 - 000000000 ____D C:\Program Files (x86)\RivaTuner Statistics Server
2017-12-09 10:08 - 2013-12-22 21:18 - 000000000 ____D C:\Program Files (x86)\MSI Afterburner
2017-12-09 10:08 - 2013-11-21 21:46 - 000000000 ____D C:\Windows\SysWOW64\directx
2017-12-09 10:01 - 2017-10-01 15:31 - 000000000 ____D C:\Program Files (x86)\Avira
2017-12-08 23:00 - 2013-05-29 10:35 - 000000000 ____D C:\Windows\Minidump
2017-12-08 23:00 - 2013-05-10 15:18 - 000000000 ____D C:\Program Files (x86)\Steam
2017-12-08 22:25 - 2014-11-18 13:54 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Unity
2017-12-08 22:25 - 2014-11-18 13:54 - 000000000 ____D C:\Users\*****\AppData\Local\Unity
2017-12-08 22:23 - 2017-05-12 13:49 - 000000000 ____D C:\Users\*****\Desktop\Diverse2
2017-12-08 22:22 - 2015-08-17 09:11 - 000000000 ____D C:\Program Files (x86)\Grundschule Lernspass mit Hexe Lilli
2017-12-08 22:22 - 2015-08-17 09:10 - 000000000 ___HD C:\Users\Public\Documents\Silag_prefs
2017-12-08 22:22 - 2013-10-14 17:00 - 000000000 ____D C:\Users\*****\AppData\Roaming\IrfanView
2017-12-08 22:20 - 2015-06-03 10:31 - 000000000 ____D C:\Program Files (x86)\FreeCodecPack
2017-12-08 22:20 - 2013-04-08 17:57 - 000000000 ____D C:\Users\*****\AppData\Roaming\DVDVideoSoft
2017-12-08 22:17 - 2013-09-18 15:36 - 000000000 ____D C:\ProgramData\Package Cache
2017-12-08 22:13 - 2015-05-31 20:18 - 000000000 ____D C:\Users\*****\Desktop\Diverse 2015
2017-12-08 22:06 - 2017-09-13 19:02 - 000000000 ____D C:\Users\**********\AppData\Roaming\Wondershare
2017-12-08 22:06 - 2017-09-13 19:02 - 000000000 ____D C:\Users\**********\.android
2017-12-08 22:06 - 2017-09-13 19:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2017-12-08 22:06 - 2015-10-31 20:58 - 000000000 ____D C:\ProgramData\Wondershare
2017-12-08 22:06 - 2015-10-31 20:58 - 000000000 ____D C:\Program Files (x86)\Wondershare
2017-12-08 22:05 - 2017-10-14 11:34 - 000000000 ____D C:\Users\*****\AppData\Roaming\Wondershare
2017-12-08 20:49 - 2015-05-13 09:37 - 000003442 _____ C:\Windows\System32\Tasks\Apple Diagnostics
2017-12-08 18:47 - 2015-08-02 11:12 - 000787388 _____ C:\Windows\system32\perfh00A.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000785430 _____ C:\Windows\system32\perfh013.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000766532 _____ C:\Windows\system32\perfh019.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000725686 _____ C:\Windows\system32\perfh00E.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000710772 _____ C:\Windows\system32\perfh005.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000705652 _____ C:\Windows\system32\perfh01D.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000648920 _____ C:\Windows\system32\perfh008.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000536446 _____ C:\Windows\system32\perfh014.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000523434 _____ C:\Windows\system32\perfh00B.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000470356 _____ C:\Windows\system32\perfh012.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000434276 _____ C:\Windows\system32\perfh00D.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000186250 _____ C:\Windows\system32\perfc00E.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000173450 _____ C:\Windows\system32\perfc00A.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000168078 _____ C:\Windows\system32\perfc013.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000165818 _____ C:\Windows\system32\perfc019.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000157450 _____ C:\Windows\system32\perfc01D.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000156402 _____ C:\Windows\system32\perfc005.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000135360 _____ C:\Windows\system32\perfc012.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000126104 _____ C:\Windows\system32\perfc008.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000116496 _____ C:\Windows\system32\perfc00B.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000110380 _____ C:\Windows\system32\perfc014.dat
2017-12-08 18:47 - 2015-08-02 11:12 - 000099734 _____ C:\Windows\system32\perfc00D.dat
2017-12-08 18:47 - 2015-08-01 18:56 - 000781978 _____ C:\Windows\system32\perfh010.dat
2017-12-08 18:47 - 2015-08-01 18:56 - 000161822 _____ C:\Windows\system32\perfc010.dat
2017-12-08 18:47 - 2015-08-01 18:50 - 000787648 _____ C:\Windows\system32\perfh00C.dat
2017-12-08 18:47 - 2015-08-01 18:50 - 000520946 _____ C:\Windows\system32\perfh001.dat
2017-12-08 18:47 - 2015-08-01 18:50 - 000164556 _____ C:\Windows\system32\perfc00C.dat
2017-12-08 18:47 - 2015-08-01 18:50 - 000109748 _____ C:\Windows\system32\perfc001.dat
2017-12-08 18:47 - 2011-04-12 08:43 - 000779920 _____ C:\Windows\system32\perfh007.dat
2017-12-08 18:47 - 2011-04-12 08:43 - 000174028 _____ C:\Windows\system32\perfc007.dat
2017-12-08 18:47 - 2009-07-14 06:13 - 013028800 _____ C:\Windows\system32\PerfStringBackup.INI
2017-12-08 14:10 - 2013-03-30 15:22 - 000000000 ____D C:\Users\*****\Documents\Daten Meinolf
2017-12-01 21:56 - 2013-03-30 14:17 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-12-01 21:54 - 2013-03-30 14:17 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-12-01 21:26 - 2015-04-20 13:00 - 000002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2017-11-18 14:22 - 2013-03-31 09:52 - 000000000 ____D C:\Users\*****\Documents\Outlook-Dateien
2017-11-18 14:20 - 2013-03-30 13:12 - 013114734 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-11-17 15:48 - 2013-03-30 23:40 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-11-17 15:48 - 2013-03-30 23:40 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-17 15:48 - 2013-03-30 23:40 - 000004366 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-11-17 15:48 - 2013-03-30 23:40 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-11-17 15:48 - 2013-03-30 23:40 - 000000000 ____D C:\Windows\system32\Macromed
2017-11-17 15:30 - 2014-12-24 12:39 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-11-17 15:29 - 2015-04-20 13:00 - 000002041 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk
2017-11-13 20:38 - 2015-07-31 10:07 - 000000000 ____D C:\Users\**********\Documents\Outlook-Dateien
2017-11-13 19:05 - 2009-07-14 06:32 - 000000000 ____D C:\Windows\system32\FxsTmp

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2010-11-23 23:27 - 2010-11-25 15:14 - 000018724 _____ () C:\Program Files (x86)\mbsuite20.log
2010-11-25 10:41 - 2010-11-25 15:15 - 000006704 _____ () C:\Program Files (x86)\mbsuite21.log
2003-09-08 09:09 - 2002-01-05 03:40 - 000487424 _____ (Microsoft Corporation) C:\Program Files (x86)\msvcp70.dll
2004-04-23 17:06 - 2003-11-03 17:07 - 000499712 _____ (Microsoft Corporation) C:\Program Files (x86)\msvcp71.dll
2003-09-08 09:09 - 2003-05-30 09:22 - 000344064 ____R (Microsoft Corporation) C:\Program Files (x86)\msvcr70.dll
2004-04-23 17:06 - 2003-11-03 17:07 - 000348160 _____ (Microsoft Corporation) C:\Program Files (x86)\msvcr71.dll
2010-11-23 23:43 - 2010-11-23 23:43 - 000036868 _____ () C:\Program Files (x86)\uninst-Lux.exe
2013-07-18 17:49 - 2014-05-22 12:07 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe GIF Format CC Prefs
2013-04-06 16:17 - 2013-06-18 14:07 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe GIF Format CS6 Prefs
2013-12-03 15:52 - 2013-12-03 15:52 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe IllExport Filter CC Prefs
2013-06-07 16:34 - 2013-06-07 16:34 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2013-11-28 21:04 - 2014-02-28 20:33 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe OpenEXR Format CC Prefs
2013-06-20 10:13 - 2017-04-28 10:22 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe PNG Format CC Prefs
2013-04-10 13:06 - 2014-07-15 11:48 - 000000132 _____ () C:\Users\*****\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-06-30 19:58 - 2017-08-08 18:51 - 000000034 _____ () C:\Users\*****\AppData\Roaming\AdobeWLCMCache.dat
2017-01-24 20:23 - 2017-01-24 20:34 - 000000899 _____ () C:\Users\*****\AppData\Roaming\buttrc
2013-09-27 12:38 - 2013-09-27 12:38 - 000000268 ___RH () C:\Users\*****\AppData\Roaming\Documentation
2013-09-27 12:38 - 2013-09-27 12:38 - 000000268 ___RH () C:\Users\*****\AppData\Roaming\Documents
2013-09-27 12:38 - 2013-09-27 12:38 - 000000268 ___RH () C:\Users\*****\AppData\Roaming\Drum Kits
2015-03-15 11:48 - 2015-10-31 20:23 - 000000083 _____ () C:\Users\*****\AppData\Roaming\mbam.context.scan
2013-10-11 11:03 - 2017-12-10 11:21 - 000024202 _____ () C:\Users\*****\AppData\Roaming\Notepad2.ini
2015-10-31 21:06 - 2015-10-31 21:06 - 000000105 _____ () C:\Users\*****\AppData\Roaming\settings.xml
2013-06-14 16:48 - 2013-06-20 09:41 - 000000005 _____ () C:\Users\*****\AppData\Roaming\WBPU-TTL.DAT
2015-10-09 14:51 - 2016-01-11 22:29 - 000001456 _____ () C:\Users\*****\AppData\Local\Adobe Save for Web 13.0 Prefs
2013-06-04 18:12 - 2017-08-12 14:12 - 000008704 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-04-01 19:24 - 2013-12-06 13:27 - 000007641 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg

Einige Dateien in TEMP:
====================
2016-08-03 23:30 - 2016-08-03 23:30 - 000838688 _____ (NCH Software) C:\Users\**********\AppData\Local\Temp\burnsetup.exe
2017-04-12 19:31 - 2017-04-12 19:31 - 034587552 _____ (Digital Wave Ltd                                            ) C:\Users\**********\AppData\Local\Temp\FreeYouTubeToMP3Converter.exe
2016-08-03 23:23 - 2016-08-03 23:23 - 001088680 _____ (NCH Software) C:\Users\**********\AppData\Local\Temp\wpsetup.exe
2017-12-08 22:22 - 2013-10-14 17:00 - 000037984 _____ (Irfan Skiljan, IrfanView) C:\Users\*****\AppData\Local\Temp\iv_uninstall.exe
2017-12-08 19:50 - 2017-12-08 20:16 - 007060456 _____ (Logitech, Inc.) C:\Users\*****\AppData\Local\Temp\qc_e3f0f3ef_27e6_4ca8_8a7c_a3d761aa54bb_64.exe

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-12-09 11:01

==================== Ende von FRST.txt ============================