Defender-Meldung: "Virus:VBS/Bomgen.J" in "file: \Device\HarddiskVolumeShadowCopy2\swapfile.sys"

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04.03.2018
durchgeführt von XXXXX (06-03-2018 21:51:50)
Gestartet von C:\Users\XXXXX\Desktop
Windows 10 Pro Version 1709 16299.248 (X64) (2017-11-17 06:52:01)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

admin (S-1-5-21-3125194556-1101341665-2740144569-1008 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3125194556-1101341665-2740144569-500 - Administrator - Disabled)
XXXXX (S-1-5-21-3125194556-1101341665-2740144569-1001 - Administrator - Enabled) => C:\Users\XXXXX
DefaultAccount (S-1-5-21-3125194556-1101341665-2740144569-503 - Limited - Disabled)
Gast (S-1-5-21-3125194556-1101341665-2740144569-501 - Limited - Disabled)
YYYYYY (S-1-5-21-3125194556-1101341665-2740144569-1002 - Limited - Enabled)
WDAGUtilityAccount (S-1-5-21-3125194556-1101341665-2740144569-504 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
A1-Faktura 1.504 (HKU\S-1-5-21-3125194556-1101341665-2740144569-1001\...\A1-Faktura_is1) (Version:  - A1-Faktura)
Adobe Flash Player 28 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 28.0.0.161 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.23) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.23 - Adobe Systems Incorporated)
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version:  3.0 - Adobe Systems, Inc.)
Audacity 2.1.3 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.3 - Audacity Team)
AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite DCP-7030 (HKLM-x32\...\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}) (Version: 2.0.0.0 - Brother Industries, Ltd.)
CameraHelperMsi (HKLM-x32\...\{15634701-BACE-4449-8B25-1567DA8C9FD3}) (Version: 13.51.815.0 - Logitech) Hidden
CamSpy V.5.1.4 (HKLM-x32\...\CamSpy_is1) (Version:  - (c.) XXXXX Münsterberg)
Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC) (Version: 8.10.4.24 - Canon Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6623 - CDBurnerXP)
CDex - Digital Audio CD Extractor and Converter (HKLM-x32\...\CDex) (Version: 1.82.0.2016 - CDex.mu)
CGM PRAXISTIMER 4.13.2218.0 (HKLM-x32\...\PraxisTimer) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel Applications (HKLM-x32\...\Corel Applications) (Version:  - )
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CrystalDiskInfo 7.0.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.0.0 - Crystal Dew World)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
DAISY (HKLM-x32\...\{5A628D5E-C03C-4AB4-963E-E67AF46FAB2C}) (Version: 14.11.19 - DAISY Akademie + Verlag GmbH)
DivX 4.02 Codec (HKLM-x32\...\DivXCodec) (Version:  - )
dreamboxEDIT -- The one and only settings editor for your Dreambox (HKLM-x32\...\dreamboxEDIT) (Version:  - )
DVD Decrypter (Remove Only) (HKLM-x32\...\DVD Decrypter) (Version:  - )
erLT (HKLM-x32\...\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.119 - Etron Technology) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.119 - Etron Technology)
Exact Audio Copy 1.3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.3 - Andre Wiethoff)
FileZilla Client 3.27.0.1 (HKLM-x32\...\FileZilla Client) (Version: 3.27.0.1 - Tim Kosse)
foobar2000 v1.3.17 (HKLM-x32\...\foobar2000) (Version: 1.3.17 - Peter Pawlowski)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 9.0.1.1049 - Foxit Software Inc.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
GDR 4042 für SQL Server 2008 R2 (KB3045313) (64-bit) (HKLM\...\KB3045313) (Version: 10.52.4042.0 - Microsoft Corporation)
Gigaset QuickSync (HKLM\...\{5fb724d8-ca49-4cdd-9249-916f1dc7b0c7}) (Version: 8.6.0875.3 - Gigaset Communications GmbH)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.19) (Version: 9.19 - Artifex Software Inc.)
HL-3152CDW (HKLM-x32\...\{C6580DE1-F539-4700-ADD2-3185121E51A8}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}.KB947789) (Version: 1 - Microsoft Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1158 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (HKLM-x32\...\{619e726e-d2b4-4e28-9568-c964fd81ee6c}) (Version: 10.1.1.14 - Intel(R) Corporation) Hidden
Java 8 Update 161 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lexware buchhalter 2017 (HKLM-x32\...\{4AFD4B62-4876-480D-BA39-8230CE09A19E}) (Version: 22.05.00.0337 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware buchhalter plus 2017 (HKLM-x32\...\{0b556709-4120-4040-8577-050039856e8a}) (Version: 22.5.0.239 - Haufe-Lexware GmbH & Co.KG)
Lexware EasyArchive 2017 (HKLM-x32\...\{C0C53938-408C-4CFB-BE8E-C95AC7E1BAA8}) (Version: 1.00.00.0007 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Elster (HKLM-x32\...\{A8877DD0-6474-4AA3-8998-64F83844622E}) (Version: 17.03.00.0307 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Elster 2017 (HKLM-x32\...\{c2bd713f-8377-4bac-8e60-fcf27567e0fe}) (Version: 17.3.0.208 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM-x32\...\{73681446-EE9F-47DF-9185-4BB6B985F743}) (Version: 17.00.00.0028 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (HKLM-x32\...\{3E7D13DE-D424-4AF6-A2DD-2E28506844E7}) (Version: 5.03.00.0048 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (HKLM-x32\...\{2A594C9D-3011-4628-A524-1D5B7181C0A9}) (Version: 24.01.00.0124 - Haufe-Lexware GmbH & Co.KG)
Lexware PDF-Export 5 (HKLM-x32\...\{D6604FDD-E71F-40CA-9764-98649EC969DD}) (Version: 5.50.01.0011 - Haufe-Lexware GmbH & Co.KG) Hidden
Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Malwarebytes Version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
MergeModule_x64 (HKLM\...\{12DCC5A7-0100-4433-B4FF-217A3C5DC83B}) (Version: 9.3.00 - Sony Corporation) Hidden
MergeModule_x86 (HKLM-x32\...\{42251A8D-C4AE-4D3B-8A50-948CB98A0969}) (Version: 10.5.00 - Sony Corporation) Hidden
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.9029.2167 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3125194556-1101341665-2740144569-1001\...\OneDriveSetup.exe) (Version: 17.3.7294.0108 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3125194556-1101341665-2740144569-1008\...\OneDriveSetup.exe) (Version: 17.3.6966.0824 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 SP1 (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 (KB971119)) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008 SP1 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 R2 (64-bit) (HKLM\...\Microsoft SQL Server 2008 R2) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{49860BCD-24D6-44C1-922E-AC12FE32234E}) (Version: 10.52.4042.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Setup (English) (HKLM\...\{B2213E4E-F502-4D36-BE95-9293C866EF3F}) (Version: 10.52.4042.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2-Richtlinien (HKLM-x32\...\{78033A38-50E2-4A65-823F-C1B34DF9FE41}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server Browser (HKLM-x32\...\{8DD113A8-811A-404E-A4D7-443D014946AC}) (Version: 10.52.4000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 Query Tools DEU (HKLM-x32\...\{3888A22E-1A9E-4DBE-A93B-42385141F37D}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FBBA9369-3A6B-4EE3-9C53-DA0D29C2FC95}) (Version: 10.52.4000.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2017 RC Redistributable (x86) - 14.10.24728 (HKLM-x32\...\{38602f72-a7f8-456b-84e5-6e200dc99917}) (Version: 14.10.24728.0 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{4ECF4BDC-8387-329A-ABE9-CF5798F84BB2}) (Version: 9.0.35191 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8343C2D8-09DF-38B3-9D1A-A26148918E45}) (Version: 9.0.35191 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 56.0.2 (x64 de) (HKLM\...\Mozilla Firefox 56.0.2 (x64 de)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 56.0.2 - Mozilla)
Mozilla Thunderbird 52.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.6.0 (x86 de)) (Version: 52.6.0 - Mozilla)
Mp3tag v2.81 (HKLM-x32\...\Mp3tag) (Version: 2.81 - Florian Heidenreich)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.2.1 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.10.0.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.10.0.95 - NVIDIA Corporation)
NVIDIA Grafiktreiber 342.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.9029.2167 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2167 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2167 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.9029.2167 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 5.1.30 (HKLM\...\{2F7790B1-72FA-426F-91B3-EBEAA30B1ABA}) (Version: 5.1.30 - Oracle Corporation)
PlayMemories Home (HKLM-x32\...\{D3981248-DBE7-4050-B666-A7FE5AFFC62C}) (Version: 5.5.00.09202 - Sony Corporation)
PMB_ModeEditor (HKLM-x32\...\{E95982CA-945F-41F2-B156-A603897AB242}) (Version: 10.3.00 - Sony Corporation) Hidden
PMB_ServiceUploader (HKLM-x32\...\{7D3A0097-9E0E-4073-801C-295BBDAEAED8}) (Version: 10.5.00 - Sony Corporation) Hidden
posterXXL Designer 5.3 (HKLM-x32\...\posterXXL Designer_is1) (Version:  - )
PowerChute Personal Edition 3.0.2 (HKLM-x32\...\{8ED262EE-FC73-47A9-BB86-D92223246881}) (Version: 3.0.2 - Schneider Electric)
PureSync (HKLM-x32\...\{ACD3899B-E2DD-4A18-A19E-E655132DFB92}) (Version: 4.6.2 - Jumping Bytes)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd)
SafeZone Stable 1.48.2066.114 (HKLM-x32\...\SafeZone 1.48.2066.114) (Version: 1.48.2066.114 - Avast Software) Hidden
SafeZone Stable 1.51.2220.47 (HKLM-x32\...\SafeZone 1.51.2220.47) (Version: 1.51.2220.47 - Avast Software) Hidden
Service Pack 2 für SQL Server 2008 R2 (KB2630458) (64-bit) (HKLM\...\KB2630458) (Version: 10.52.4000.0 - Microsoft Corporation)
SiI3132 SATA 3G PCIe/ExpressCard (HKLM-x32\...\SiI3132 SATA 3G PCIe/ExpressCard) (Version: 2.0.2013.03 - ) <==== ACHTUNG
Sirona SIDEXIS XG (HKLM-x32\...\{D1962349-06E7-46FD-A3A9-43AB34C50A39}) (Version: 2.6.1.0 - Sirona Dental Systems GmbH)
SQL Server 2008 R2 SP2 Common Files (HKLM\...\{0B4D413C-9E19-4087-AA21-D7BD1A9B3075}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Common Files (HKLM\...\{36F70DEE-1EBF-4707-AFA2-E035EEAEBAA1}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Services (HKLM\...\{440668AA-7524-40DB-966A-60BE535E1B3F}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Services (HKLM\...\{89DF2F55-6625-49D7-BC0D-326FE62DD98E}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Services (HKLM\...\{9FFAE13C-6160-4DD0-A67A-DAC5994F81BD}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Services (HKLM\...\{FBD367D1-642F-47CF-B79B-9BE48FB34007}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Shared (HKLM\...\{45D7270A-B929-4D67-B176-ABC81161B8ED}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Shared (HKLM\...\{A2122A9C-A699-4365-ADF8-68FEAC125D61}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Management Studio (HKLM\...\{72AB7E6F-BC24-481E-8C45-1AB5B3DD795D}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Management Studio (HKLM\...\{D49B01F1-79D6-4448-916E-152832EC3B64}) (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (HKLM\...\{F31183CF-E10F-4DE1-BB59-6C0FF38E481E}) (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
StarMoney (HKLM-x32\...\{1190E270-E5A3-4195-BA74-9086E4198EC3}) (Version: 5.0.1.83 - StarFinanz) Hidden
StarMoney (HKLM-x32\...\{71ECFFB5-4190-4C58-9A3E-3DA7C3A601DF}) (Version: 5.0.1.83 - StarFinanz) Hidden
StarMoney 10 S-Edition (HKLM-x32\...\{F303DAD3-268D-4ECB-8757-2CD345A7106D}) (Version: 10 - Star Finanz GmbH)
TAXMAN 2016 (HKLM-x32\...\{E4F52EC2-63AA-402B-A849-F3771F9CE142}) (Version: 21.36.103 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2017 (HKLM-x32\...\{BBF23ABC-E31E-4DAA-B2AA-8B660C5A6D45}) (Version: 22.34.85 - Haufe-Lexware GmbH & Co.KG)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.80697 - TeamViewer)
The Playa (HKLM-x32\...\ThePlaya) (Version:  - )
TomTom HOME (HKLM-x32\...\{0E778C56-3A87-497E-BEF0-EF0D3EE4871C}) (Version: 2.10.2 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows-Treiberpaket - FTDI CDM Driver Package - Bus/D2XX Driver (08/26/2014 2.12.00) (HKLM\...\705E68198CF680B29D08A3D99A38DD6800FA3ED6) (Version: 08/26/2014 2.12.00 - FTDI)
Windows-Treiberpaket - FTDI CDM Driver Package - VCP Driver (08/26/2014 2.12.00) (HKLM\...\35942942AC9822AE32C956444EF22BB146DF6368) (Version: 08/26/2014 2.12.00 - FTDI)
Winmail Reader 1.2.15 (HKLM-x32\...\Winmail Reader_is1) (Version:  - Kopf)
XnViewMP 0.87 (HKLM-x32\...\XnViewMP_is1) (Version: 0.87 - Gougelet Pierre-e)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2016-11-20] ()
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\ConvertToPDFShellExtension_x64.dll [2017-12-11] (Foxit Software Inc.)
ContextMenuHandlers1: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll [2017-02-17] (Florian Heidenreich)
ContextMenuHandlers2: [1&1 SmartDrive] -> {62DF97A2-3635-4412-AE30-80B164BC88AD} => C:\Program Files (x86)\1&1\1&1 Upload-Manager\SHNDLERS64.DLL [2011-11-21] (1&1 Internet AG)
ContextMenuHandlers2: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll [2017-02-17] (Florian Heidenreich)
ContextMenuHandlers3: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ContextMenuHandlers3: [1&1 SmartDrive] -> {62DF97A2-3635-4412-AE30-80B164BC88AD} => C:\Program Files (x86)\1&1\1&1 Upload-Manager\SHNDLERS64.DLL [2011-11-21] (1&1 Internet AG)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers4: [Mp3tagShell] -> {6351E20C-35FA-4BE3-98FB-4CABF1363E12} => C:\Program Files (x86)\Mp3tag\Mp3tagShell64.dll [2017-02-17] (Florian Heidenreich)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2017-03-09] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2016-11-14] (NVIDIA Corporation)
ContextMenuHandlers6: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\ConvertToPDFShellExtension_x64.dll [2017-12-11] (Foxit Software Inc.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {11B95648-DE18-45D1-BC94-974AB93A8C19} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-03-04] (Microsoft Corporation)
Task: {2337C850-021A-4061-8C03-0C044E9F423A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-03-04] (Microsoft Corporation)
Task: {23BD62E2-75D0-474B-8CA7-29ACE37EBB4A} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-02-22] (Microsoft Corporation)
Task: {263C861C-8902-4626-BDC0-E37BD2C506AE} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-04] (Microsoft Corporation)
Task: {410C5B9E-997C-4BD9-BCBB-03B21AE618E5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-01] (Microsoft Corporation)
Task: {433E02CD-6CAF-4D9D-80EC-08A1A1D711F0} - System32\Tasks\JumpingBytes\PureSyncVSS => C:\Program Files (x86)\Jumping Bytes\PureSync\PureSyncVSSStart.exe [2016-06-16] (Jumping Bytes)
Task: {43C88C76-3AE4-4CB7-AA84-4A310643B06D} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-10-11] (NVIDIA Corporation)
Task: {4AADCD67-6FC8-48B4-A9BC-E68ACA1D96DA} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {503A4FC3-E538-45C6-9F39-9C0B9A89261D} - \Microsoft\Windows\UNP\RunCampaignManager -> Keine Datei <==== ACHTUNG
Task: {563C890F-B7F1-428B-AB77-2CDBEE0B8D6B} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-10-11] (NVIDIA Corporation)
Task: {62FCB8A9-9978-4FE7-862A-8C4B757885D3} - System32\Tasks\SafeZone scheduled Autoupdate 1467930979 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
Task: {66B19A03-4CC6-4EB9-AA43-15B31DB5E18C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-01] (Microsoft Corporation)
Task: {A46662A3-1E20-410F-8B49-E6C097FCFDF9} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-02-06] (Adobe Systems Incorporated)
Task: {A8CB2C6B-17C9-4E3D-8856-88CAE12F921E} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {A8DF1D4D-3399-4283-BE7B-CE7F1B84AF96} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-01] (Microsoft Corporation)
Task: {A9D4C210-2DF2-4C21-B4F2-315D9F78027C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-02-22] (Microsoft Corporation)
Task: {BA4C58E3-3DB5-42B8-A935-789ACC6D01BE} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-10-11] (NVIDIA Corporation)
Task: {C5980DEA-11F8-49C6-9E64-CBEDA893B5EE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-01] (Microsoft Corporation)
Task: {CE0B76F7-6090-48DE-A6EF-186A712F5E8D} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)
Task: {E5C3E33D-EC3F-4267-853A-5E6FBA730C6E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {E898370E-842C-4BAB-A94A-A81C6CF08180} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-10-11] (NVIDIA Corporation)
Task: {E9E8E896-6964-4C02-97E1-BA8C86687836} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2018-03-04] (Microsoft Corporation)
Task: {F54D55CB-F7B5-4103-8D04-055B03843354} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-04] (Microsoft Corporation)
Task: {F8A2FA77-74FB-434B-B512-AF39F31E8A20} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-10-11] (NVIDIA Corporation)
Task: {FF226374-41BD-4547-B4FC-1B26775B1AD7} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-10-11] (NVIDIA Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Verknüpfungen & WMI ========================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)


Shortcut: C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Meine Websites auf MSN\target.lnk -> hxxp://www.msnusers.co

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2017-09-29 14:41 - 2017-09-29 14:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-06-16 15:39 - 2016-11-14 12:15 - 000135224 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-07-10 10:54 - 2006-02-23 10:35 - 000020480 _____ () C:\WINDOWS\System32\FritzColorPort64.dll
2016-07-10 10:54 - 2006-02-22 09:39 - 000020480 _____ () C:\WINDOWS\System32\FritzPort64.dll
2016-11-18 22:48 - 2012-06-21 07:25 - 000113152 _____ () C:\WINDOWS\System32\redmon64.dll
2016-11-02 22:16 - 2016-11-02 22:16 - 000041984 _____ () C:\Program Files (x86)\ForensiT\AppX Management Service\ForensiTAppxService.exe
2016-10-31 23:24 - 2017-10-11 02:05 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-11-20 22:47 - 2016-11-20 22:47 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2017-07-19 17:18 - 2017-07-19 17:18 - 000076456 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2018-02-14 18:28 - 2018-02-10 05:39 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-02-14 18:28 - 2018-02-10 05:36 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-02-27 10:14 - 2018-02-27 10:14 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-02-27 10:14 - 2018-02-27 10:14 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-02-27 10:14 - 2018-02-27 10:14 - 021824000 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-02-27 10:14 - 2018-02-27 10:14 - 002529792 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\skypert.dll
2017-03-09 01:16 - 2017-03-09 01:16 - 000112264 _____ () C:\Windows\System32\IccLibDll_x64.dll
2016-07-07 23:44 - 2012-09-25 10:26 - 001163264 _____ () C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
2012-09-12 23:38 - 2012-09-12 23:38 - 000264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2016-12-14 00:29 - 2016-01-28 15:33 - 001058624 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\libxml2.dll
2016-12-14 00:29 - 2011-01-13 10:44 - 000232800 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\PATCHW32.dll
2016-10-31 23:24 - 2017-10-11 02:05 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-07-07 23:44 - 2009-02-27 15:38 - 000139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 002144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 007955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 000341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 000028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 000127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-12 23:39 - 2012-09-12 23:39 - 000336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2016-08-25 15:45 - 2016-08-25 15:45 - 000174560 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Logging.Targets.Etw.dll
2016-08-25 15:45 - 2016-08-25 15:45 - 000041440 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Etw.dll
2017-09-20 17:22 - 2017-09-20 17:22 - 000696240 _____ () C:\Program Files (x86)\Sony\PlayMemories Home\XMPCore.dll
2017-09-20 17:22 - 2017-09-20 17:22 - 000747952 _____ () C:\Program Files (x86)\Sony\PlayMemories Home\XMPFiles.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-3125194556-1101341665-2740144569-1001\...\sharepoint.com -> hxxps://theokochschule-files.sharepoint.com

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2015-10-30 08:24 - 2017-11-01 23:39 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3125194556-1101341665-2740144569-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-3125194556-1101341665-2740144569-1008\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{96B63E64-00F6-42C7-B1AE-C3AA07931EF7}C:\program files (x86)\fritz!\frifax32.exe] => (Allow) C:\program files (x86)\fritz!\frifax32.exe
FirewallRules: [UDP Query User{FC7023A3-6825-47EE-8938-C63C53104757}C:\program files (x86)\fritz!\frifax32.exe] => (Allow) C:\program files (x86)\fritz!\frifax32.exe
FirewallRules: [{BE70713A-6616-40CE-AF99-9203399014F8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{5B0E7CF9-AD3C-4ABF-9361-276503AAA55A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{28CC70BB-F8BB-4A14-96AD-25E247C29B00}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{405F294D-66B2-4A70-97A9-065F5C02984F}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [TCP Query User{8B6A64C1-C37C-4B95-A05D-FA2D22209362}C:\program files (x86)\foobar2000\foobar2000.exe] => (Allow) C:\program files (x86)\foobar2000\foobar2000.exe
FirewallRules: [UDP Query User{D6C6E4BA-2D6C-4708-88EF-4EB31E4112B4}C:\program files (x86)\foobar2000\foobar2000.exe] => (Allow) C:\program files (x86)\foobar2000\foobar2000.exe
FirewallRules: [{D7E8AB98-25A4-48F4-9C86-7F0C840EA764}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{BA25E316-6B32-4046-A6AB-DC1A955D181B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5F2FF20B-0D7F-4F1B-95D0-58BD0C56BCA3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{18CFB1F3-5EC7-4D46-B4B0-6F7A62E95E38}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5BF6C22A-067E-4F1D-A0EA-6DB760DA2767}] => (Allow) LPort=1434
FirewallRules: [{F604805D-E87C-4DE0-8AA4-AE33A437E8B0}] => (Allow) C:\Program Files\Microsoft SQL Server\MSSQL10_50.PDATA_SQLEXPRESS\MSSQL\Binn\sqlservr.exe
FirewallRules: [{6DC51A2A-6FB8-49E8-A484-CC993A621B02}] => (Allow) C:\Program Files\Microsoft SQL Server\MSSQL10_50.PDATA_SQLEXPRESS\MSSQL\Binn\sqlservr.exe
FirewallRules: [{B8E9BD11-A08D-4DBF-AE8D-38B6591C943F}] => (Allow) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
FirewallRules: [{60ED3C6C-305F-4B29-88EA-3F57B59DBFE1}] => (Allow) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
FirewallRules: [{316F03A2-C789-4B3B-9EE2-EDC2AF094A6D}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [TCP Query User{FEA96EB6-895C-4FA0-9161-085FE63FF7CD}G:\gemeinsame dateien\downloads\fritzbox\avm_capi_test.exe] => (Allow) G:\gemeinsame dateien\downloads\fritzbox\avm_capi_test.exe
FirewallRules: [UDP Query User{EE8A6547-545A-4EA5-AD2A-DECF8F07E16A}G:\gemeinsame dateien\downloads\fritzbox\avm_capi_test.exe] => (Allow) G:\gemeinsame dateien\downloads\fritzbox\avm_capi_test.exe
FirewallRules: [TCP Query User{BE7D1C15-CC23-4C95-8E02-4C9013458678}C:\program files (x86)\fritz!\frifax32.exe] => (Block) C:\program files (x86)\fritz!\frifax32.exe
FirewallRules: [UDP Query User{8A21BA11-472D-4FCA-B0C5-4DD66402A157}C:\program files (x86)\fritz!\frifax32.exe] => (Block) C:\program files (x86)\fritz!\frifax32.exe
FirewallRules: [TCP Query User{CF8D9F2A-43D5-4DEF-A449-5BB3834296EC}G:\eigene dateien - XXXXX\alt\downloads-mo\isdn-test\acocapi.exe] => (Allow) G:\eigene dateien - XXXXX\alt\downloads-mo\isdn-test\acocapi.exe
FirewallRules: [UDP Query User{F61C3E6A-DDD8-4439-884C-EE234FE0D077}G:\eigene dateien - XXXXX\alt\downloads-mo\isdn-test\acocapi.exe] => (Allow) G:\eigene dateien - XXXXX\alt\downloads-mo\isdn-test\acocapi.exe

==================== Wiederherstellungspunkte =========================

16-02-2018 17:38:23 Installed PureSync
23-02-2018 19:32:44 Geplanter Prüfpunkt
05-03-2018 00:31:43 Geplanter Prüfpunkt

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/05/2018 08:09:02 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2018/03/05 08:09:02.859]: [00009988]: lperrcode->api = 3 , lperrcode->code = 21

Error: (03/04/2018 07:00:01 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsort "H:\" nicht abgeschlossen. Fehler: Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006).

Error: (03/04/2018 04:34:13 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2018/03/04 16:34:13.561]: [00009988]: lperrcode->api = 1 , lperrcode->code = 2

Error: (03/04/2018 04:34:12 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2018/03/04 16:34:12.036]: [00009988]: lperrcode->api = 1 , lperrcode->code = 2

Error: (03/03/2018 12:39:33 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2018/03/03 00:39:33.492]: [00009988]: lperrcode->api = 3 , lperrcode->code = 31

Error: (03/02/2018 09:17:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\Audacity\audacity.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd.manifest.

Error: (03/02/2018 09:17:46 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile  1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (03/02/2018 01:13:04 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2018/03/02 13:13:04.066]: [00009988]: lperrcode->api = 1 , lperrcode->code = 2


Systemfehler:
=============
Error: (03/06/2018 07:05:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (03/06/2018 07:05:19 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\ANDR~2\AppData\Local\Temp\ehdrv.sys

Error: (03/06/2018 07:05:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (03/06/2018 07:05:18 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\ANDR~2\AppData\Local\Temp\ehdrv.sys

Error: (03/06/2018 07:05:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (03/06/2018 07:05:18 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\ANDR~2\AppData\Local\Temp\ehdrv.sys

Error: (03/06/2018 07:05:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (03/06/2018 07:05:18 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\ANDR~2\AppData\Local\Temp\ehdrv.sys


Windows Defender:
===================================
Date: 2018-03-06 19:08:06.782
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Bitrep.A&threatid=2147723097&enterprise=0
Name: Trojan:Win32/Bitrep.A
ID: 2147723097
Schweregrad: Schwerwiegend
Kategorie: Trojaner
Pfad: file:_C:\A1-Faktura - Kopie vor Update\Update_A1-Faktura.exe
Erkennungsursprung: Lokaler Computer
Erkennungstyp: FastPath
Erkennungsquelle: System
Benutzer: NT-AUTORITÄT\SYSTEM
Prozessname: Unknown
Signaturversion: AV: 1.263.227.0, AS: 1.263.227.0, NIS: 118.2.0.0
Modulversion: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-06 13:52:27.096
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {583D673B-620D-4DDE-884A-821B7E25DA3F}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2018-03-06 12:57:23.189
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {52776C73-4002-4C7D-86D1-EC12F8291914}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2018-03-06 12:42:20.786
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {C1340810-BCB9-4CA4-8BAB-2D5CA56C966C}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2018-03-03 00:32:25.268
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {6F4414F1-AAB4-48EA-AF88-657BBE38FB6B}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2018-02-16 09:55:56.254
Description: 
Das Windows Defender Antivirus-Modul wurde aufgrund eines unerwarteten Fehlers beendet.
Fehlertyp: Absturz
Ausnahmecode: 0xc0000006
Ressource: file:C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.245_none_16ec1d963212a637\TiWorker.exe

CodeIntegrity:
===================================

Date: 2018-03-06 21:44:40.849
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:44:40.848
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:39:33.252
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:39:33.251
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:38:21.188
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:38:21.187
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:08:21.187
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-03-06 21:08:21.185
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i5-2500 CPU @ 3.30GHz
Prozentuale Nutzung des RAM: 22%
Installierter physikalischer RAM: 24493.11 MB
Verfügbarer physikalischer RAM: 18973.28 MB
Summe virtueller Speicher: 28077.11 MB
Verfügbarer virtueller Speicher: 22125.79 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:223.13 GB) (Free:131.63 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive d: (Volume) (Fixed) (Total:300 GB) (Free:132.17 GB) NTFS
Drive f: (System) (Fixed) (Total:200.01 GB) (Free:78.57 GB) NTFS
Drive g: (Volume) (Fixed) (Total:1363.01 GB) (Free:855.55 GB) NTFS

\\?\Volume{2802a4d5-0000-0000-0000-40c837000000}\ () (Fixed) (Total:0.44 GB) (Free:0.05 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: 2802A4D5)
Partition 1: (Active) - (Size=223.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: BE5B1914)
Partition 1: (Active) - (Size=200 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1363 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=300 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================