Windows 7 - Win32/NoonLight.B Wurm über infizierten USB-Stick eingefangen

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 10-08-2019
durchgeführt von Step (Administrator) auf DUBAI-NB (LENOVO 2349DS1) (13-08-2019 20:04:08)
Gestartet von C:\Users\Step\Desktop
Geladene Profile: Step (Verfügbare Profile: Step)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(AuthenTec, Inc. -> Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Broadcom Corporation -> Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> ) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(Data Perceptions -> Data Perceptions / PowerProgrammer) C:\Windows\SysWOW64\WebUpdateSvc4.exe
(Dolby Laboratories, Inc. -> Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Dominik Reichl) [Datei ist nicht signiert] \\Router\nas\TRANSCEND\Scans\KeePass-2.15\KeePass.exe
(Ericsson AB -> Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(ESET, spol. s r.o. -> ) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
(Huawei Technologies Co., Ltd. -> ) C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd. -> Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) [Datei ist nicht signiert] C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation-Wireless Connectivity Solutions -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation-Wireless Connectivity Solutions -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation-Wireless Connectivity Solutions -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel(R) Corporation) [Datei ist nicht signiert] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO (UNITED STATES) INC. -> Lenovo) C:\Users\Step\AppData\Local\Apps\2.0\RVH64KGA.374\CK578G65.2KO\lsb...tion_2d7b41b05b24775e_0001.0006_3b0a905c8de4f74a\LSB.exe
(Lenovo -> ) C:\Program Files (x86)\Lenovo\System Update\SUService.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(LENOVO -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Lenovo -> Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo -> Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Lenovo -> Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Lenovo -> Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Lenovo(Japan)Ltd. -> Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Macheen Inc. -> Lenovo) C:\Program Files (x86)\Lenovo\MobileAccess\MobileAccess.exe
(Macheen Inc. -> Macheen) C:\Program Files (x86)\Lenovo\MobileAccess\MacheenService.exe
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Protexis Inc. -> Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Ricoh co.,Ltd.) [Datei ist nicht signiert] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(shbox.de) [Datei ist nicht signiert] C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Shrew Soft Inc -> ) C:\Program Files\ShrewSoft\VPN Client\iked.exe
(Shrew Soft Inc -> ) C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
(Sierra Wireless Inc. -> Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Gobi\QDLService\GobiQDLService.exe
(StorageCraft Technology Corporation -> StorageCraft Technology Corporation) C:\Program Files (x86)\StorageCraft\ShadowProtect\vsnapvss.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(troubadix) [Datei ist nicht signiert] C:\Program Files\TPFanControl\TPFanControl.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [296664 2017-05-12] (Lenovo -> Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] => C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281448 2010-12-17] (Lenovo(Japan)Ltd. -> Lenovo Group Limited)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [70760 2017-03-17] (Lenovo -> Lenovo)
HKLM\...\Run: [TPFanControl] => C:\Program Files\TPFanControl\TPFanControl.exe [157696 2015-01-05] (troubadix) [Datei ist nicht signiert]
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2925096 2018-11-21] (Synaptics Incorporated -> Synaptics Incorporated)
HKLM-x32\...\Run: [PWMTRV] => C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [6420264 2018-05-16] (Lenovo -> Lenovo Group Limited)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-07-18] (Intel Corporation -> Intel Corporation)
HKLM-x32\...\Run: [MobileAccess] => C:\Program Files (x86)\Lenovo\MobileAccess\MobileAccess.exe [155424 2012-07-10] (Macheen Inc. -> Lenovo)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-16] (Intel Corporation - Software and Firmware Products -> Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-02] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [66560 2013-06-17] (Ricoh co.,Ltd.) [Datei ist nicht signiert]
HKLM-x32\...\Run: [ACTray] => C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe [439400 2017-03-17] (Lenovo -> Lenovo)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de) [Datei ist nicht signiert]
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories, Inc. -> Dolby Laboratories Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [644552 2019-07-04] (Oracle America, Inc. -> Oracle Corporation)
HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\Run: [Google Update] => C:\Users\Step\AppData\Local\Google\Update\1.3.34.11\GoogleUpdateCore.exe [410920 2019-05-15] (Google Inc -> Google LLC)
HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\MountPoints2: {181db963-0383-11e8-8b33-74e543976c52} - F:\AutoRun.exe
HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\MountPoints2: {181db973-0383-11e8-8b33-74e543976c52} - F:\AutoRun.exe
HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\MountPoints2: {433178a6-1fc2-11e8-b969-74e543976c52} - F:\AutoRun.exe
HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\MountPoints2: {4f14578c-3424-11e8-8758-74e543976c52} - F:\AutoRun.exe
HKLM\...\Drivers32: [msacm.ulmp3acm] => C:\PROGRAM FILES (X86)\COMMON FILES\ULEAD SYSTEMS\MPEG\ulmp3acm.acm [319488 2006-01-23] (Ulead systems) [Datei ist nicht signiert]
HKLM\...\Drivers32: [msacm.mpegacm] => C:\PROGRAM FILES (X86)\COMMON FILES\ULEAD SYSTEMS\MPEG\mpegacm.acm [69632 2006-04-17] (Ulead Systems, Inc.) [Datei ist nicht signiert]
HKLM\...\Drivers32: [msacm.dvacm] => C:\Program Files (x86)\Common Files\Ulead Systems\vio\DVACM.acm [32768 2008-05-16] (Ulead Systems, Inc.) [Datei ist nicht signiert]
HKLM\Software\...\Authentication\Credential Providers: [{18CBEEAA-6708-41A1-9379-D08915333CF2}] -> C:\Program Files\ThinkVantage Fingerprint Software\provider.dll [2013-03-06] (AuthenTec, Inc. -> Authentec Inc.)
HKLM\Software\...\Authentication\Credential Providers: [{50968FF7-10C1-4fb3-98B0-CD654D6CB97E}] -> C:\Program Files\ThinkPad\Bluetooth Software\\BtwCP.dll [2013-05-14] (Broadcom Corporation -> Broadcom Corporation.)
HKLM\Software\...\Authentication\Credential Providers: [{D28973E5-8630-41af-8831-50A15FEB396B}] -> C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll [2013-05-14] (Broadcom Corporation -> Broadcom Corporation.)
HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2010-09-22] (Microsoft Corporation -> Microsoft Corp.)
HKLM\Software\...\Authentication\Credential Provider Filters: [{AE583D93-8D1B-424F-9858-5623FB7824EE}] -> C:\Program Files\ThinkVantage Fingerprint Software\provider.dll [2013-03-06] (AuthenTec, Inc. -> Authentec Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ACGina C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2017-02-26]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation -> Broadcom Corporation.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {10FDCFF7-B474-47F3-B405-53372D2BC611} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-4260870709-187772707-436843402-1000 => "C:\Windows\system32\rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\Step\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms
Task: {2FAFC0A8-2203-421A-BED1-E06321443D5B} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [1321280 2017-02-14] (Lenovo -> Lenovo)
Task: {433CC81D-F10E-484C-9B57-2FD84777ECFC} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {4BB3EB3D-3C5E-4164-86D1-36D6F458C64F} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe
Task: {643614AC-A2A1-489C-987D-7DC1333B04FC} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\pcdrcui.exe [974416 2010-11-19] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
Task: {76861471-EDA5-4CA5-AEF9-A1F0BB675547} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => C:\Windows\system32\rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
Task: {80A4AD7F-9FC5-4DBD-AC37-947D5522FA75} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {83F82922-D1D0-45C1-AE8E-5B9B435379B3} - System32\Tasks\TVT\TVSUUpdateTask_UserLogOn => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [1758488 2019-05-24] (Lenovo -> )
Task: {8B599DA5-E587-46AE-A0B0-A6DD56261BA3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4260870709-187772707-436843402-1000UA => C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [153752 2016-10-20] (Google Inc -> Google Inc.)
Task: {8C25F5F9-EA26-4F93-B93E-32B948A1DFAB} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {8D4E4CAC-9E5F-43B0-92EB-97FAB4EAE493} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-14] (Adobe Inc. -> Adobe)
Task: {940C5044-9D35-4FC5-A3BE-B576430E9961} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe
Task: {94938396-3245-450A-9B57-871FCF298601} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [6656 2009-02-10] () [Datei ist nicht signiert]
Task: {99372469-0DAC-4EFF-983D-3363200A0DA0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [603216 2010-11-19] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
Task: {A384129A-7259-488F-9DD5-CED75AC9950D} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [33872 2010-11-19] (PC-Doctor, Inc. -> )
Task: {B397E9A1-3771-473B-A409-E1D765E35699} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [3647272 2018-05-16] (Lenovo -> Lenovo Group Limited)
Task: {B7695C93-4C4A-4E72-8E3C-0F0495D4E7C1} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [10175808 2017-02-14] (Lenovo -> Lenovo)
Task: {C024F9E7-801C-42B2-83B3-7FD88550FE0B} - System32\Tasks\G2MUploadTask-S-1-5-21-4260870709-187772707-436843402-1000 => C:\Users\Step\AppData\Local\GoToMeeting\13761\g2mupload.exe [32256 2019-07-27] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {CB2E29AD-596A-4EA0-BBC4-80C4BDF0337E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4260870709-187772707-436843402-1000Core => C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [153752 2016-10-20] (Google Inc -> Google Inc.)
Task: {D1E07227-DDD3-468D-9695-7E823146EB45} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [264000 2017-02-14] (Lenovo -> )
Task: {DAC72EF9-F3CE-4411-BCA0-2AEE5E2D5ADD} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [1758488 2019-05-24] (Lenovo -> )
Task: {EB9C4AD2-1E39-4CDF-92B5-B63C31C8A2DE} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1236048 2019-07-24] (Adobe Inc. -> Adobe Systems)
Task: {F0CC30C0-D9FD-48DD-BD5E-38F0A25951E1} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [10175808 2017-02-14] (Lenovo -> Lenovo)
Task: {F2BB42C9-5EAE-4FA2-A630-BF09EDE0DE86} - System32\Tasks\G2MUpdateTask-S-1-5-21-4260870709-187772707-436843402-1000 => C:\Users\Step\AppData\Local\GoToMeeting\13761\g2mupdate.exe [32256 2019-07-27] (LogMeIn, Inc. -> LogMeIn, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-4260870709-187772707-436843402-1000.job => C:\Users\Step\AppData\Local\GoToMeeting\13761\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-4260870709-187772707-436843402-1000.job => C:\Users\Step\AppData\Local\GoToMeeting\13761\g2mupload.exe
Task: C:\Windows\Tasks\Lenovo Power Management Driver PnP Task.job => C:\Windows\system32\ibmpmsvc.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exeq-backgroundmon scripts\backgroundmon.xml
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\pcdrcui.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 172.25.25.252
Tcpip\..\Interfaces\{18688C74-C461-443A-943C-35387DFA5858}: [DhcpNameServer] 172.25.25.252
Tcpip\..\Interfaces\{259D6079-7BAA-4DC4-9145-81139119AA3D}: [NameServer] 10.74.210.210 10.74.210.211
Tcpip\..\Interfaces\{2CD4F485-515E-49B1-A86E-4B275442855A}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{44EFDAA6-D59C-40B5-A478-A4FF7B866C05}: [NameServer] 139.7.30.126 139.7.30.125
Tcpip\..\Interfaces\{55917DD8-3260-43E8-A782-EB46BFEA5644}: [DhcpNameServer] 172.25.25.252
Tcpip\..\Interfaces\{BB4708E3-7592-4293-90B9-EC2C5ABB0455}: [DhcpNameServer] 192.168.211.1
Tcpip\..\Interfaces\{CA88A361-3C52-405F-B913-326CC0DB1BC8}: [NameServer] 10.74.210.210 10.74.210.211
Tcpip\..\Interfaces\{EA777DEF-B020-4F5A-B1C6-2B5ECD931CC2}: [DhcpNameServer] 192.168.74.2
HKLM\System\...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.185.254,-1]

Internet Explorer:
==================
HKU\S-1-5-21-4260870709-187772707-436843402-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {FB22F607-8C5C-42FA-9E3E-5C1AA612D740} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {FB22F607-8C5C-42FA-9E3E-5C1AA612D740} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {FC496CB1-55FD-486B-BDB4-C2F5221ABFC9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {FC496CB1-55FD-486B-BDB4-C2F5221ABFC9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4260870709-187772707-436843402-1000 -> DefaultScope {FB22F607-8C5C-42FA-9E3E-5C1AA612D740} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_221\bin\ssv.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corporation -> Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_221\bin\jp2ssv.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2010-05-28] (Hewlett-Packard Company -> Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_221\bin\ssv.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corporation -> Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_221\bin\jp2ssv.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2010-05-28] (Hewlett-Packard Company -> Hewlett-Packard Co.)
DPF: HKLM-x32 {42B182F9-3F08-484E-9913-07193A5D36B3} hxxp://schwalbennest.ddns.net:8082/DericamPlug.exe

FireFox:
========
FF DefaultProfile: ptk3j9g3.default
FF ProfilePath: C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default [2019-08-13]
FF user.js: detected! => C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\user.js [2016-05-16]
FF Homepage: Mozilla\Firefox\Profiles\ptk3j9g3.default -> hxxp://www.multimediaforum.de
FF Extension: (Facebook Container) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\@contain-facebook.xpi [2019-07-08]
FF Extension: (hotfix-update-xpi-intermediate) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\hotfix-update-xpi-intermediate@mozilla.com.xpi [2019-05-15]
FF Extension: (uBlock Origin) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\uBlock0@raymondhill.net.xpi [2019-07-26]
FF Extension: (Adblock für Youtube™) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\{0ac04bdb-d698-452f-8048-bcef1a3f4b0d}.xpi [2018-05-04]
FF Extension: (Deaktivierungs-Add-on von Google Analytics) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi [2017-04-01] [UpdateUrl:hxxps://tools.google.com/service/update2/ff?guid=%ITEM_ID%&version=%ITEM_VERSION%&application=%APP_ID%&appversion=%APP_VERSION%]
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Step\AppData\Roaming\Mozilla\Firefox\Profiles\ptk3j9g3.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-08-09]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2018-06-09] [Legacy] [ist nicht signiert]
FF HKU\S-1-5-21-4260870709-187772707-436843402-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-14] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\dtplugin\npDeployJava1.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\plugin2\npjp2.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-14] (Adobe Inc. -> )
FF Plugin-x32: @google.com/webplugin -> C:\Windows\system32\npwebplugin.dll [Keine Datei]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.221.2 -> C:\Program Files (x86)\Java\jre1.8.0_221\bin\dtplugin\npDeployJava1.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.221.2 -> C:\Program Files (x86)\Java\jre1.8.0_221\bin\plugin2\npjp2.dll [2019-07-17] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-07-31] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4260870709-187772707-436843402-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Step\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2017-02-16] (Citrix Online -> Citrix Online)
FF Plugin HKU\S-1-5-21-4260870709-187772707-436843402-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Step\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google Inc -> Google)
FF Plugin HKU\S-1-5-21-4260870709-187772707-436843402-1000: @talk.google.com/O1DPlugin -> C:\Users\Step\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google Inc -> Google)
FF Plugin HKU\S-1-5-21-4260870709-187772707-436843402-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Step\AppData\Local\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin HKU\S-1-5-21-4260870709-187772707-436843402-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Step\AppData\Local\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\Step\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2016-10-20]
FF Plugin ProgramFiles/Appdata: C:\Users\Step\AppData\Roaming\mozilla\plugins\npo1d.dll [2016-10-20]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [326160 2018-05-16] (LENOVO -> Lenovo.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [40080 2018-10-22] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd)
S3 ElfoService; C:\Program Files (x86)\ElsterFormular Update Service\bin\elfoService.exe [1284360 2018-04-25] (Bayerisches Landesamt fuer Steuern -> )
R2 GobiQDLService; C:\Program Files (x86)\Sierra Wireless Inc\Gobi\QDLService\GobiQDLService.exe [312688 2011-11-25] (Sierra Wireless Inc. -> Sierra Wireless, Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2014-01-15] (Huawei Technologies Co., Ltd. -> )
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319096 2016-06-10] (Intel Corporation - pGFX -> Intel Corporation)
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] (Shrew Soft Inc -> )
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel® Trusted Connect Service -> Intel(R) Corporation)
R2 Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [505856 2017-02-10] (Intel Corporation) [Datei ist nicht signiert]
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [682064 2014-04-26] (Huawei Technologies Co., Ltd. -> )
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] (Shrew Soft Inc -> )
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [169176 2017-05-12] (Lenovo -> Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [120400 2017-04-03] (Lenovo -> Lenovo Group Limited)
S2 LPlatSvc; C:\Windows\system32\LPlatSvc.exe [892760 2018-12-26] (Lenovo -> Lenovo.)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273216 2017-02-14] (Lenovo -> Lenovo)
R2 MacheenService; C:\Program Files (x86)\Lenovo\MobileAccess\MacheenService.exe [29472 2012-07-10] (Macheen Inc. -> Macheen)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes Corporation -> Malwarebytes)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [Datei ist nicht signiert]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [Datei ist nicht signiert]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11795800 2019-04-15] (TeamViewer GmbH -> TeamViewer GmbH)
R2 VSNAPVSS; C:\Program Files (x86)\StorageCraft\ShadowProtect\vsnapvss.exe [71976 2018-01-27] (StorageCraft Technology Corporation -> StorageCraft Technology Corporation)
R2 WebUpdate4; C:\Windows\SysWOW64\WebUpdateSvc4.exe [278800 2010-08-18] (Data Perceptions -> Data Perceptions / PowerProgrammer)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [689560 2012-10-18] (Ericsson AB -> Ericsson AB)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3833248 2016-02-08] (Intel Corporation-Wireless Connectivity Solutions -> Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 AMPPAL; C:\Windows\System32\DRIVERS\AMPPAL.sys [164832 2013-07-29] (Intel Corporation-Mobile Wireless Group -> Windows (R) Win 7 DDK provider)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2018-12-10] (AVM Computersysteme Vertriebs GmbH -> AVM Berlin)
R0 dcrypt; C:\Windows\System32\drivers\dcrypt.sys [210632 2014-07-09] (ReactOS Foundation -> )
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2011-10-05] (Ericsson AB -> Ericsson AB)
S3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [29736 2011-10-05] (Ericsson AB -> Ericsson AB)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-03-22] (Malwarebytes Corporation -> )
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [54216 2018-10-22] (CHENGDU YIWO Tech Development Co., Ltd. -> )
S3 ew_hwusbdev; C:\Windows\System32\DRIVERS\ew_hwusbdev.sys [109568 2013-01-25] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 ew_usbenumfilter; C:\Windows\System32\DRIVERS\ew_usbenumfilter.sys [18560 2015-01-07] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2016-01-12] (Siemens AG -> Siemens Home and Office Communication Devices GmbH & Co. KG)
R3 huawei_enumerator; C:\Windows\System32\DRIVERS\ew_jubusenum.sys [91648 2013-11-30] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [125952 2014-07-25] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [380800 2015-01-07] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-02] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
S3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [103184 2012-03-02] (Ericsson AB -> Ericsson AB)
S3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Microsoft Windows Hardware Compatibility Publisher -> Lenovo)
S3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [111544 2017-05-09] (Malwarebytes Corporation -> Malwarebytes)
S3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-05-09] (Malwarebytes Corporation -> Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [251832 2019-08-13] (Malwarebytes Corporation -> Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [82720 2017-05-09] (Malwarebytes Corporation -> Malwarebytes)
S3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [443208 2012-10-02] (MCCI Corporation -> MCCI Corporation)
S3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [453960 2012-10-02] (MCCI Corporation -> MCCI Corporation)
S3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [21832 2012-10-02] (MCCI Corporation -> MCCI Corporation)
S3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [506184 2012-10-02] (MCCI Corporation -> MCCI Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
R3 NETwNs64; C:\Windows\System32\DRIVERS\NETwsw01.sys [11534096 2015-05-04] (Intel Corporation-Wireless Connectivity Solutions -> Intel Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S3 PCDSRVC{127174DC-C366ED8B-06020101}_0; c:\program files\pc-doctor\pcdsrvc_x64.pkms [25072 2010-11-19] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
R0 PMDRVS; C:\Windows\System32\DRIVERS\pmdrvs.sys [44160 2018-12-26] (Lenovo -> Lenovo.)
R3 RCUVCAVS; C:\Windows\System32\DRIVERS\RCUVCAVS.sys [177920 2013-07-05] (Microsoft Windows Hardware Compatibility Publisher -> Ricoh co.,Ltd.)
S2 risdsnpe; C:\Windows\System32\DRIVERS\risdsne64.sys [78848 2010-09-08] (Microsoft Windows Hardware Compatibility Publisher -> REDC)
R2 risdxc; C:\Windows\System32\DRIVERS\risdxc64.sys [101888 2011-05-25] (Microsoft Windows Hardware Compatibility Publisher -> REDC)
R1 sbmount; C:\Windows\System32\Drivers\sbmount.sys [116048 2018-01-27] (StorageCraft Technology Corporation -> StorageCraft Technology Corporation)
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2016-10-18] (Intel(R) Code Signing External -> )
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [53800 2018-11-21] (Synaptics Incorporated -> Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-31] (AuthenTec, Inc. -> Authentec Inc.)
S3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL6.SYS [292864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV6.SYS [1485312 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT6.SYS [740864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R0 stcvsm; C:\Windows\System32\DRIVERS\stcvsm.sys [277288 2018-01-27] (StorageCraft Technology Corporation -> StorageCraft Technology Corporation)
S3 swg3kmbb01; C:\Windows\System32\DRIVERS\swg3kmbb01.sys [458240 2012-04-13] (Microsoft Windows Hardware Compatibility Publisher -> Sierra Wireless Incorporated)
S3 swg3knmea01; C:\Windows\System32\DRIVERS\swg3knmea01.sys [259584 2012-04-13] (Microsoft Windows Hardware Compatibility Publisher -> Sierra Wireless Incorporated)
S3 swg3kser01; C:\Windows\System32\DRIVERS\swg3kser01.sys [259584 2012-04-13] (Microsoft Windows Hardware Compatibility Publisher -> Sierra Wireless Incorporated)
S3 swibus01; C:\Windows\System32\DRIVERS\swibus01.sys [79360 2012-04-13] (Microsoft Windows Hardware Compatibility Publisher -> Sierra Wireless Inc.)
S3 swibusflt01; C:\Windows\System32\DRIVERS\swibusflt01.sys [79360 2012-04-13] (Microsoft Windows Hardware Compatibility Publisher -> Sierra Wireless Inc.)
R3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-08] (Lenovo (Japan) Ltd. -> ThinkVantage Communications Utility)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Windows -> Microsoft Corporation)
R3 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [200832 2018-01-15] (Oracle Corporation -> Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\System32\DRIVERS\VBoxNetLwf.sys [211704 2018-01-15] (Oracle Corporation -> Oracle Corporation)
R1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [24064 2013-07-01] (Microsoft Windows Hardware Compatibility Publisher -> Shrew Soft Inc)
S3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [17408 2013-07-01] (Microsoft Windows Hardware Compatibility Publisher -> Shrew Soft Inc)
R0 vsock; C:\Windows\System32\DRIVERS\vsock.sys [93248 2016-09-30] (VMware, Inc. -> VMware, Inc.)
R3 wdkmd; C:\Windows\System32\DRIVERS\WDKMD.sys [42392 2010-12-01] (Wireless Display -> Intel Corporation)
S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [281840 2013-02-19] (Ericsson AB -> Ericsson AB)
S3 btmaudio; system32\drivers\btmaud.sys [X]
S3 btmaux; system32\DRIVERS\btmaux.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2019-08-13 20:04 - 2019-08-13 20:09 - 000045385 _____ C:\Users\Step\Desktop\FRST.txt
2019-08-13 20:03 - 2019-08-13 20:04 - 000000000 ____D C:\FRST
2019-08-13 20:01 - 2019-08-13 20:01 - 002097664 _____ (Farbar) C:\Users\Step\Desktop\FRST64.exe
2019-08-13 16:29 - 2019-08-13 16:29 - 002870984 _____ (ESET) C:\Users\Step\Desktop\esetsmartinstaller_deu.exe
2019-08-13 16:29 - 2019-08-13 16:29 - 000000000 ____D C:\Program Files (x86)\ESET
2019-08-13 16:17 - 2019-08-13 16:17 - 007623880 _____ (Malwarebytes) C:\Users\Step\Desktop\adwcleaner_7.4.exe
2019-08-13 16:15 - 2019-08-13 16:20 - 000000000 ____D C:\AdwCleaner
2019-08-13 15:23 - 2019-07-07 17:34 - 001601486 _____ C:\Users\Step\Desktop\privat.kdbx
2019-08-08 15:09 - 2019-08-08 15:09 - 000000000 ____D C:\Users\Step\AppData\Local\Tvsukernel
2019-07-27 12:15 - 2019-07-31 19:31 - 000003241 _____ C:\Users\Step\Desktop\Neues Textdokument.txt
2019-07-19 23:28 - 2019-07-21 13:02 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-07-17 13:27 - 2019-07-17 13:25 - 000110064 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-64.dll

==================== Ein Monat (geänderte) ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2019-08-13 20:04 - 2014-01-22 21:29 - 000000382 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2019-08-13 20:03 - 2014-01-22 21:29 - 000000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2019-08-13 19:51 - 2017-02-16 14:31 - 000000532 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-4260870709-187772707-436843402-1000.job
2019-08-13 19:50 - 2017-02-16 14:31 - 000000628 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-4260870709-187772707-436843402-1000.job
2019-08-13 17:29 - 2016-05-15 23:45 - 000000000 ____D C:\Users\Step\AppData\Local\MobileAccess
2019-08-13 16:58 - 2014-01-22 22:06 - 000703426 _____ C:\Windows\system32\perfh007.dat
2019-08-13 16:58 - 2014-01-22 22:06 - 000151558 _____ C:\Windows\system32\perfc007.dat
2019-08-13 16:58 - 2009-07-14 07:13 - 001632376 _____ C:\Windows\system32\PerfStringBackup.INI
2019-08-13 16:58 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2019-08-13 16:33 - 2009-07-14 06:45 - 000025408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-08-13 16:33 - 2009-07-14 06:45 - 000025408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-08-13 16:26 - 2016-11-17 15:26 - 000000000 ____D C:\Users\Step\AppData\LocalLow\Mozilla
2019-08-13 16:23 - 2016-09-05 19:04 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2019-08-13 16:22 - 2017-05-27 22:10 - 000000000 ____D C:\ProgramData\VMware
2019-08-13 16:22 - 2016-09-09 13:19 - 000000000 ____D C:\Users\Step\AppData\Local\FreePDF_XP
2019-08-13 16:22 - 2016-05-16 16:37 - 000000000 __SHD C:\Users\Step\IntelGraphicsProfiles
2019-08-13 16:21 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-08-13 16:02 - 2016-12-02 18:19 - 000251832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2019-08-13 15:55 - 2016-10-23 00:30 - 000000000 ____D C:\Users\Step\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2019-08-13 15:55 - 2016-09-05 19:02 - 000000000 ____D C:\Users\Step\AppData\Local\Downloaded Installations
2019-08-13 15:55 - 2016-05-18 12:14 - 000000000 ____D C:\Users\Step\Desktop\install
2019-08-13 15:53 - 2018-06-09 21:20 - 000000000 ____D C:\Windows\pss
2019-08-13 15:52 - 2016-05-16 00:22 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2019-08-13 15:51 - 2016-05-16 00:21 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2019-08-13 15:22 - 2016-10-23 00:30 - 000000000 ____D C:\Users\Step\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
2019-08-13 15:21 - 2014-01-22 21:27 - 000000000 ____D C:\swshare
2019-08-13 12:08 - 2017-02-24 01:32 - 000000000 ____D C:\Users\Step\AppData\Local\Deployment
2019-08-13 01:36 - 2016-05-16 00:21 - 000002318 ____H C:\Users\Step\Documents\Default.rdp
2019-08-13 01:03 - 2019-06-14 20:31 - 000000000 ____D C:\Users\Step\AppData\Roaming\vlc
2019-08-12 14:45 - 2017-01-19 18:39 - 000000342 _____ C:\Windows\BRRBCOM.INI
2019-08-08 23:32 - 2016-05-18 12:18 - 000000000 ____D C:\ProgramData\FreePDF
2019-07-29 17:51 - 2017-07-16 13:12 - 000000000 ____D C:\Users\Step\AppData\Local\GoToMeeting
2019-07-27 23:06 - 2017-02-16 14:31 - 000003652 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-4260870709-187772707-436843402-1000
2019-07-27 23:06 - 2017-02-16 14:31 - 000003556 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-4260870709-187772707-436843402-1000
2019-07-21 13:02 - 2016-05-15 23:55 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-17 13:28 - 2018-07-20 21:11 - 000000000 ____D C:\Program Files (x86)\Java
2019-07-17 13:28 - 2018-07-20 20:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2019-07-17 13:27 - 2018-07-20 20:46 - 000000000 ____D C:\Program Files\Java
2019-07-17 13:25 - 2018-07-20 20:46 - 000110064 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2019-07-17 13:24 - 2018-07-20 21:11 - 000098288 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2019-07-16 16:10 - 2009-07-14 07:32 - 000000000 ____D C:\Windows\system32\FxsTmp
2019-07-14 20:22 - 2016-05-15 23:50 - 000000000 ____D C:\Users\Step\AppData\Local\Adobe
2019-07-14 20:21 - 2018-09-17 15:56 - 000004514 _____ C:\Windows\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-07-14 20:21 - 2016-09-29 14:51 - 000842296 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
2019-07-14 20:21 - 2016-09-29 14:51 - 000175160 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2019-07-14 20:21 - 2016-09-29 14:51 - 000000000 ____D C:\Windows\system32\Macromed
2019-07-14 20:21 - 2014-01-22 21:29 - 000000000 ____D C:\Windows\SysWOW64\Macromed

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ================

2017-02-25 02:49 - 2017-02-25 17:58 - 000159200 _____ () C:\Users\Step\AppData\Roaming\CrashRpt1402.dll
2017-02-24 00:47 - 2017-02-24 00:47 - 000001523 _____ () C:\Users\Step\AppData\Local\PDLSetup.20170223.234743.txt
2017-02-24 00:47 - 2017-02-24 00:47 - 000001283 _____ () C:\Users\Step\AppData\Local\PDLSetup.20170223.234748.txt
2019-06-09 22:54 - 2019-06-09 22:54 - 000001567 _____ () C:\Users\Step\AppData\Local\PDLSetup.20190609.225404.txt
2019-06-09 22:54 - 2019-06-09 22:54 - 000001544 _____ () C:\Users\Step\AppData\Local\PDLSetup.20190609.225434.txt
2017-05-28 01:20 - 2017-05-29 14:08 - 000000600 _____ () C:\Users\Step\AppData\Local\PUTTY.RND
2018-12-11 19:24 - 2018-12-11 20:39 - 000007630 _____ () C:\Users\Step\AppData\Local\Resmon.ResmonCfg

==================== FLock ================

2014-01-22 21:20 C:\Windows\CSC

==================== SigCheck ===============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)


LastRegBack: 2019-08-11 16:58
==================== Ende von FRST.txt ============================