| |
| |||||||
Diskussionsforum: Norton zeigt Trojaner und Bitcoin Miner Angriff an, Speicherplatz verschwindet, hoher DatenverkehrWindows 7 Hier sind ausschließlich fachspezifische Diskussionen erwünscht. Bitte keine Log-Files, Hilferufe oder ähnliches posten. Themen zum "Trojaner entfernen" oder "Malware Probleme" dürfen hier nur diskutiert werden. Bereinigungen von nicht ausgebildeten Usern sind hier untersagt. Wenn du dir einen Virus doer Trojaner eingefangen hast, eröffne ein Thema in den Bereinigungsforen oben. |
17.11.2019, 17:34
| #1 |
| |  Norton zeigt Trojaner und Bitcoin Miner Angriff an, Speicherplatz verschwindet, hoher Datenverkehr Hallo Community, ich habe seit einigen Tagen/Wochen ein paar Probleme mit meinem Laptop. 1. Norton zeigt mir eigentlich alle 5 Minuten einen Angriff von einem Tronajer oder von verschiedenen BitcoinMinern an, die er vermeindlich (hoffentlich) blockiert Jegliche Scans finden dann aber keine Bedrohung (Logfile erstellt). 2. Festplatte C verliert die ganze Zeit Speicher ohne Grund was dazu führt, dass ich ständig versuche die Festplatte zu leeren, aber gestern sind von 9 GB plötzlch 6 GB verschwunden und ich weiss nicht wohin. Ich habe keine Installationen oder Downloads getätigt. Es kam damit schon vor, dass meine Festplatte plötzlich so wenig Speicher hatte, dass der PC abgestürzt ist. 3. Norton zeigt mir bei jedem Start des PC einen sehr hohen Datenverker von meinem PC ausgehend an. Er schlägt mir immer vor den Power-Eraser auszuführen, der dann meistens eine Riched32.dll findet, die ich laut Google Suche aber wohl nicht löschen soll. Manchmal finder er auch gar nichts. Ich weiß nicht mehr weiter. Den einzigen Download den ich in letzter Zeit getätigt habe, der mir komisch vor kam war ein Programm, das ich unter folgendem Link geladen habe: https://movesoftabcsoft.weebly.com/blog/bd-cellquest-pro-software-free-download Das Programm konnte dann runtergeladen werden, aber nach anklicken der Exe ist nichts passiert, was mir sehr komisch vorkam. Ich habe das Gefühl, dass erst danach die Trojaner und BitcoinMiner Angriffe kamen bin mir aber nicht sicher. Die Festplattenspeicherproblematik hatte ich allerdings bereits zuvor. Eine zusätzliche Frage ist folgende: Ich arbeite derzeit an einer Abhandlung und mache daher eigentlich fast täglich ein Backup im Sinne von Copy Paste der neuen Daten und Word Dokumente auf eine externe Festplatte. Kann ich diese damit auch infiziert haben und muss ich diese sowie verwendete USB Sticks ebenfalls prüfen/bearbeiten? Ich bin am verzweifeln und um jede Hilfe dankbar. Hier kommen die Logfiles von FRST und Norton, aufgrund der Länge aufgeteil Vielen Dank für eure Hilfe FRST Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 14-11-2019
durchgeführt von Tobias (Administrator) auf TOBIAS-HP (Hewlett-Packard HP Pavilion dv7 Notebook PC) (17-11-2019 16:45:13)
Gestartet von C:\Users\Tobias\Desktop
Geladene Profile: Tobias & Julia (Verfügbare Profile: Tobias & Julia)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Adobe Systems, Incorporated -> Adobe Systems Inc.) D:\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Advanced Micro Devices Inc.) [Datei ist nicht signiert] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(ATI Technologies Inc.) [Datei ist nicht signiert] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AuthenTec, Inc. -> HP) C:\Program Files (x86)\HP SimplePass 2012\BioMonitor.exe
(AuthenTec, Inc. -> HP) C:\Program Files (x86)\HP SimplePass 2012\TouchControl.exe
(AuthenTec, Inc. -> HP) C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe
(CyberLink -> CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink -> cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Digital Wave Ltd.) [Datei ist nicht signiert] C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(EasyBits Software AS -> EasyBits Software AS) [Datei ist nicht signiert] C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe
(Hewlett-Packard Company -> ) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(HP Inc. -> HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Huawei Technologies Co., Ltd. -> ) [Datei ist nicht signiert] C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Intel Corporation - Mobile Wireless Group -> Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation-Mobile Wireless Group -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel® Identity Protection Technology Software -> Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Logitech -> Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Logitech -> Logitech, Inc.) C:\Program Files\Common Files\Logishrd\sp6\LU2\LogitechUpdate.exe
(Logitech -> Logitech, Inc.) C:\Program Files\Common Files\Logishrd\sp6\LU2\LULnchr.exe
(Logitech Inc -> Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NETGEAR -> ) C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
(NETGEAR -> ) C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
(Realsil Microelectronics Inc.) [Datei ist nicht signiert] C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Renesas Electronics Corporation -> Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Symantec Corporation -> Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\nst.exe
(Symantec Corporation -> Symantec Corporation) C:\Program Files\Norton Security\Engine\22.19.8.65\NortonSecurity.exe
(Symantec Corporation -> Symantec Corporation) C:\Program Files\Norton Security\Engine\22.19.8.65\NortonSecurity.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Windscribe Limited -> Windscribe Limited) D:\Programme\Windscribe\WindscribeService.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated -> Synaptics Incorporated)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10372368 2011-07-12] (Intel Corporation - Mobile Wireless Group -> Intel Corporation)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [43320 2011-09-30] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2013-06-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech -> Logitech, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc. -> Apple Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-26] (Logitech Inc -> Logitech, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation -> Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-01] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-04-15] (Renesas Electronics Corporation -> Renesas Electronics Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [169528 2011-10-08] (Hewlett-Packard Company -> Hewlett-Packard Company)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-09-15] (EasyBits Software AS -> EasyBits Software AS) [Datei ist nicht signiert]
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink -> CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2013-06-16] (CyberLink -> cyberlink)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1444880 2015-11-26] (Easybits AS -> Easybits)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [Datei ist nicht signiert]
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => D:\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => D:\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [2904984 2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3211040 2019-10-02] (Valve -> Valve Corporation)
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung Electronics CO., LTD. -> Samsung)
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd -> Disc Soft Ltd)
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\Policies\Explorer: [NoSecurityTab] 1
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: I - I:\setup.exe
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {adc05ac3-d65a-11e2-8f3e-4ceb421ebf1c} - H:\LaunchU3.exe -a
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {ba27d821-d35c-11e6-bb41-4ceb421ebf1c} - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {baf4eba1-6677-11e3-94da-4ceb421ebf1c} - I:\SETUP.EXE
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {d55bd58f-3018-11e7-b7f0-4ceb421ebf1c} - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {e3d6ecf3-31a4-11e7-b5bc-4ceb421ebf1c} - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\...\MountPoints2: {f3817553-f2e1-11e7-9b4f-4ceb421ebf1c} - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\...\AppCompatFlags\Custom\1602.exe: [{b7082f5b-b3cc-44ac-a030-69ef3e35225d}.sdb] -> Anno 1602 Compatibility fix
HKLM\Software\...\AppCompatFlags\Custom\1602Edit.exe: [{b7082f5b-b3cc-44ac-a030-69ef3e35225d}.sdb] -> Anno 1602 Compatibility fix
HKLM\Software\...\AppCompatFlags\InstalledSDB\{b7082f5b-b3cc-44ac-a030-69ef3e35225d}: [DatabasePath] -> C:\Windows\AppPatch\Custom\{b7082f5b-b3cc-44ac-a030-69ef3e35225d}.sdb [2018-12-20]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\78.0.3904.97\Installer\chrmstp.exe [2019-11-14] (Google LLC -> Google LLC)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}] -> msiexec /fu {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} /qn
HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100 Genie.lnk [2014-08-13]
ShortcutTarget: NETGEAR WNA3100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe (NETGEAR -> )
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2017-07-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Keine Datei)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {01294F01-97A3-489C-B579-297D4F24A4BC} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [1890552 2019-09-11] (Symantec Corporation -> Symantec Corporation)
Task: {029C0DEB-EF29-4E48-8950-6088DAA8CA7C} - System32\Tasks\AdobeAAMUpdater-1.0-Tobias-HP-Tobias => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {04F5BDC9-9FD8-405F-905B-5C64B5DC94B4} - System32\Tasks\{7528A3F4-B8B4-4758-B126-32F334BA7DC8} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxps://ui.skype.com/ui/0/7.31.0.104/de/abandoninstall?page=tsProgressBar
Task: {0C8E4B90-EB34-4CA3-BFCB-06B79B5A9527} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.19.8.65\SymErr.exe [102424 2019-09-11] (Symantec Corporation -> Symantec Corporation)
Task: {13222818-D8F1-48DA-A3A9-230E88EC141E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [250232 2019-10-08] (HP Inc. -> HP Inc.)
Task: {15005BA7-6060-44EE-99A9-8CC7C4DB2291} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [655736 2019-07-31] (HP Inc. -> HP Inc.)
Task: {20A6DEBA-FF83-4A73-9DCE-631462781638} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1094008 2019-10-10] (HP Inc. -> HP Inc.)
Task: {25D65F82-1D65-491E-B77F-39E84D7D8778} - System32\Tasks\Norton AntiVirus\Norton Error Processor => C:\Program Files (x86)\Norton AntiVirus\Engine\21.7.0.11\SymErr.exe
Task: {2D5079CD-2EF3-4D44-8941-03A571977949} - System32\Tasks\Norton AntiVirus\Norton Error Analyzer => C:\Program Files (x86)\Norton AntiVirus\Engine\21.7.0.11\SymErr.exe
Task: {2DE4EA7F-F129-4504-BE1E-AD125C25D88B} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [198696 2016-11-07] (HP Inc. -> HP Inc.)
Task: {354446E4-E8C3-460B-846B-65F48C1C4444} - System32\Tasks\G2MUploadTask-S-1-5-21-1937020662-3346648387-3673308353-1001 => C:\Users\Tobias\AppData\Local\GoToMeeting\10996\g2mupload.exe
Task: {397D5AF0-9857-48C2-A4D9-7AD61E7E8B4A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [570240 2017-02-14] (Apple Inc. -> Apple Inc.)
Task: {3B12B46F-255C-4072-90DE-D434DCFBA589} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2017-06-16] (Google Inc -> Google Inc.)
Task: {3CBC8228-CA8A-48C6-AF71-259063BBB532} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1094008 2019-10-10] (HP Inc. -> HP Inc.)
Task: {464B5214-49B2-45F3-A2E2-F13FD75D1DD7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2011-09-28] (CyberLink -> CyberLink)
Task: {4A025E1D-4201-4B82-BC08-EA1A5603DFCF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2017-06-16] (Google Inc -> Google Inc.)
Task: {500B5B54-E831-4280-BD9E-DF7B7E248637} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1506680 2019-06-14] (HP Inc. -> HP Inc.)
"C:\Windows\System32\Tasks\Microsoft\Windows\Google\GoogleUpdateTaskMachineSV" wurde entsperrt. <==== ACHTUNG
Task: {55750CF3-7370-4A3C-BD34-A6EF95E55DF1} - System32\Tasks\Microsoft\Windows\Google\GoogleUpdateTaskMachineSV => C:\Windows\SysWOW64\Microsoft\Protect\S-1-51-34\RB_1.4.47.90.exe [67896 2009-07-14] () [Datei ist nicht signiert] <==== ACHTUNG
Task: {63551612-3250-4701-829F-C8F8177E1B74} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [145272 2019-10-31] (HP Inc. -> HP Inc.)
Task: {6C8B920B-5AD0-4F66-98EC-8454B3C17C95} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {79DFCB5C-B07E-43FB-9496-B2B33E3938E9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-11-14] (Adobe Inc. -> Adobe)
Task: {7BDA2C1A-211E-4A17-94B0-126E1182FDB2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {7E49ED28-7079-4DE6-BED2-069CC2017843} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Engine\22.19.8.65\WSCStub.exe [707624 2019-09-11] (Symantec Corporation -> Symantec Corporation)
Task: {83260AA8-CEAD-47C8-A943-3B191AF805FE} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {917B0197-F25B-48CE-982C-74237B251A4B} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [70496 2014-01-30] (Symantec Corporation -> Symantec Corporation)
Task: {9C43B795-0302-444C-B1C9-C036C83ADEB3} - System32\Tasks\{FD7A0917-CF18-4160-96C9-260DFC08E0ED} => C:\Windows\system32\pcalua.exe -a G:\Setup.exe -d G:\
Task: {A0BFBF1E-CC68-4079-A0B5-5EEB42B97B00} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1506680 2019-06-14] (HP Inc. -> HP Inc.)
Task: {A4B476CA-6F3B-40B5-836F-7F85E04C7DEA} - System32\Tasks\HPCeeScheduleForTobias => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [96568 2015-06-16] (Hewlett-Packard Company -> Hewlett-Packard)
Task: {ACCAFA6C-EFC7-4E68-91AF-DF15F88D74F3} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe [70496 2014-01-30] (Symantec Corporation -> Symantec Corporation)
Task: {C1E5B2EF-82CB-4095-AEEC-EF6B34EC7D5F} - System32\Tasks\G2MUpdateTask-S-1-5-21-1937020662-3346648387-3673308353-1001 => C:\Users\Tobias\AppData\Local\GoToMeeting\10996\g2mupdate.exe
Task: {C9DACEDE-D399-4504-B907-E92770434802} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.19.8.65\SymErr.exe [102424 2019-09-11] (Symantec Corporation -> Symantec Corporation)
Task: {D0D70C7C-AD7E-493D-BB65-6AE4C1B76CAD} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1344312 2013-08-19] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
Task: {E343449C-962E-4926-B304-F3B98906D3C2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1240656 2019-09-10] (Adobe Inc. -> Adobe Systems)
Task: {E8056E5D-0F24-4D96-A9CD-574EB1BB9989} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_293_Plugin.exe [1457720 2019-11-14] (Adobe Inc. -> Adobe)
Task: {EB832187-C389-4793-BBDE-148F5CFA294D} - System32\Tasks\Norton Security Scan for Tobias => C:\Program Files (x86)\Norton Security Scan\Engine\4.6.1.179\Nss.exe [848912 2019-02-15] (Symantec Corporation -> Symantec Corporation)
Task: {F4059BB3-7732-4F3B-85E6-7121DC7CD83C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [316632 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1937020662-3346648387-3673308353-1001.job => C:\Users\Tobias\AppData\Local\GoToMeeting\10996\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1937020662-3346648387-3673308353-1001.job => C:\Users\Tobias\AppData\Local\GoToMeeting\10996\g2mupload.exe
Task: C:\Windows\Tasks\HPCeeScheduleForTobias.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Winsock: Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5-x64 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{81C8CF3D-B31E-4EAF-8D3E-1AD273EAFBAF}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{9EC5FE3D-068E-4438-AF33-040C25357689}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{B2EB34CC-34B0-44BA-867B-62C9D8E18705}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{B4007C74-9501-41FA-977D-3DFE3EE23062}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKU\S-1-5-21-1937020662-3346648387-3673308353-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKU\S-1-5-21-1937020662-3346648387-3673308353-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/hpnot/4
HKU\S-1-5-21-1937020662-3346648387-3673308353-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {B36BF164-41D9-4944-8E81-8E722003E7B7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {B36BF164-41D9-4944-8E81-8E722003E7B7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> DefaultScope {24C68652-47CB-4CC3-8B23-531FCC1DD656} URL = hxxps://de.search.yahoo.com/search?fr=mcafee&type=C010DE739D20120823&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {24C68652-47CB-4CC3-8B23-531FCC1DD656} URL = hxxps://de.search.yahoo.com/search?fr=mcafee&type=C010DE739D20120823&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {B36BF164-41D9-4944-8E81-8E722003E7B7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=kwd&qsrc=2869
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {B36BF164-41D9-4944-8E81-8E722003E7B7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2019-08-13] (Microsoft Corporation -> Microsoft Corporation)
BHO: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Engine\22.19.8.65\coIEPlg.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Program Files (x86)\Internet Explorer\Citavi Picker\x64\SwissAcademic.Citavi.IEPicker.DLL [2018-12-13] (Swiss Academic Software -> Swiss Academic Software)
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2012\x64\IEBHO.dll [2011-08-26] (AuthenTec, Inc. -> HP)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
BHO: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll [2015-03-05] (Symantec Corporation -> Symantec Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-26] (Logitech Inc -> Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2018-07-20] (Microsoft Corporation -> Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2017-10-27] (HP Inc. -> HP Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2019-09-10] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Engine32\22.19.8.65\coIEPlg.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Program Files (x86)\Internet Explorer\Citavi Picker\SwissAcademic.Citavi.IEPicker.DLL [2018-12-13] (Swiss Academic Software -> Swiss Academic Software)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => Keine Datei
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2012\IEBHO.dll [2011-08-26] (AuthenTec, Inc. -> HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
BHO-x32: Norton Identity Protection -> {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} -> C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\coIEPlg.dll [2015-03-05] (Symantec Corporation -> Symantec Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-26] (Logitech Inc -> Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2018-07-22] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2017-10-27] (HP Inc. -> HP Inc.)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Toolbar: HKLM - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.11.42\coIEPlg.dll [2015-03-05] (Symantec Corporation -> Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine\22.19.8.65\coIEPlg.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
Toolbar: HKLM-x32 - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\coIEPlg.dll [2015-03-05] (Symantec Corporation -> Symantec Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine32\22.19.8.65\coIEPlg.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
Toolbar: HKU\S-1-5-21-1937020662-3346648387-3673308353-1003 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine\22.19.8.65\coIEPlg.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Keine Datei
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Keine Datei
FireFox:
========
FF DefaultProfile: ynpcuz68.default
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default [2019-11-17]
FF Notifications: Mozilla\Firefox\Profiles\ynpcuz68.default -> hxxps://bestellen.dominos.de
FF Extension: (Norton Safe Search) - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\Extensions\nortonsafesearch_ul_2@symantec.com.xpi [2019-10-08] [UpdateUrl:hxxps://static.nortoncdn.com/idscp/firefox/nsss/ds_modified/updates.json]
FF Extension: (Norton Safe Web) - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\Extensions\nortonsafeweb@symantec.com.xpi [2019-10-12]
FF Extension: (Deaktivierungs-Add-on von Google Analytics) - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\Extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi [2017-04-29] [UpdateUrl:hxxps://tools.google.com/service/update2/ff?guid=%ITEM_ID%&version=%ITEM_VERSION%&application=%APP_ID%&appversion=%APP_VERSION%]
FF Extension: (Citavi Picker) - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\Extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2019-06-30]
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-10-23]
FF Extension: (Kein Name) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [nicht gefunden]
FF Extension: (Kein Name) - C:\Program Files\McAfee\WebAdvisor\saffplg.xpi [nicht gefunden]
FF Extension: (Kein Name) - C:\Program Files\McAfee\WebAdvisorsaffplg.xpi [nicht gefunden]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\11-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\englische-ergebnisse.xml [2014-06-04]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\gmx-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\lastminute.xml [2014-04-17]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\McSiteAdvisor.xml [2018-12-18]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\safesearch.xml [2014-03-25]
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ynpcuz68.default\searchplugins\webde-suche.xml [2014-06-04]
FF Extension: (Citavi Picker) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2018-09-11]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2017-10-22] [] [ist nicht signiert]
FF HKLM-x32\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.6.6.3\coFFPlgn
FF Extension: (Kein Name) - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.6.6.3\coFFPlgn [2015-03-28] [ist nicht signiert]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: (Adobe Acrobat - Create PDF) - D:\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2017-02-15] [] [ist nicht signiert]
FF HKU\S-1-5-21-1937020662-3346648387-3673308353-1003\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_293.dll [2019-11-14] (Adobe Inc. -> )
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_293.dll [2019-11-14] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [Keine Datei]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-07-20] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-11-06] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-11-06] (Google Inc -> Google LLC)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\VLC\npvlc.dll [2014-02-05] (VideoLAN) [Datei ist nicht signiert]
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [Keine Datei]
FF Plugin-x32: Adobe Acrobat -> D:\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2011-09-05] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-10-16] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1937020662-3346648387-3673308353-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Tobias\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-03-14] (Citrix Online -> Citrix Online)
FF Plugin HKU\S-1-5-21-1937020662-3346648387-3673308353-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Tobias\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon Services LLC -> Amazon.com, Inc.)
Chrome:
=======
CHR Profile: C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default [2019-11-03]
CHR Extension: (Präsentationen) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-22]
CHR Extension: (Docs) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-22]
CHR Extension: (Google Drive) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-16]
CHR Extension: (YouTube) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-16]
CHR Extension: (Avira Safe Shopping) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh [2019-09-09]
CHR Extension: (Website Logon) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\debkinhcgejcbfgjiaalomcmkedjmiaa [2017-06-16]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2017-10-22]
CHR Extension: (Tabellen) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-22]
CHR Extension: (Google Docs Offline) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-30]
CHR Extension: (AdBlock) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2019-09-09]
CHR Extension: (Norton Identity Safe) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2017-06-16]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-10]
CHR Extension: (Norton Security Toolbar) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob [2017-06-16]
CHR Extension: (Citavi Picker) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2019-05-18]
CHR Extension: (Google Mail) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-05-09]
CHR Extension: (Chrome Media Router) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-09-09]
CHR HKLM\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif]
CHR HKLM\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\Exts\Chrome.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
CHR HKLM-x32\...\Chrome\Extension: [debkinhcgejcbfgjiaalomcmkedjmiaa] - C:\Program Files (x86)\HP SimplePass 2012\tschrome.crx [2011-08-25]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif]
CHR HKLM-x32\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\Exts\Chrome.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn]
==================== Dienste (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2013-06-16] (Microsoft Windows Hardware Compatibility Publisher -> Andrea Electronics Corporation)
R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [204288 2011-10-01] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc. -> Apple Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [6076936 2018-08-15] (BattlEye Innovations e.K. -> )
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [244720 2012-02-08] (CyberLink -> CyberLink)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [384512 2016-06-27] (Digital Wave Ltd.) [Datei ist nicht signiert]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS -> EasyBits Software AS) [Datei ist nicht signiert]
R2 FPLService; C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe [260424 2011-08-26] (AuthenTec, Inc. -> HP)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [360312 2019-10-14] (HP Inc. -> HP Inc.)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [190784 2019-07-03] (Huawei Technologies Co., Ltd. -> ) [Datei ist nicht signiert]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2413056 2011-06-29] (Realsil Microelectronics Inc.) [Datei ist nicht signiert]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] (Intel Corporation-Mobile Wireless Group -> )
R2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe [131144 2015-03-05] (Symantec Corporation -> Symantec Corporation)
R2 NortonSecurity; C:\Program Files\Norton Security\Engine\22.19.8.65\NortonSecurity.exe [225608 2019-09-11] (Symantec Corporation -> Symantec Corporation)
S3 Origin Client Service; D:\Spiele\Origin\OriginClientService.exe [2157456 2017-06-15] (Electronic Arts, Inc. -> Electronic Arts)
S2 Origin Web Helper Service; D:\Spiele\Origin\OriginWebHelperService.exe [3127192 2017-06-15] (Electronic Arts, Inc. -> Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2016-12-16] (Even Balance, Inc. -> )
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311808 2013-06-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
R2 WindscribeService; D:\Programme\Windscribe\WindscribeService.exe [493232 2019-01-19] (Windscribe Limited -> Windscribe Limited)
R2 wlidsvc; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2292096 2011-03-28] (Microsoft Corporation -> Microsoft Corp.)
R2 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [307928 2013-11-11] (NETGEAR -> )
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel Corporation-Mobile Wireless Group -> Intel® Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 Accelerometer; C:\Windows\System32\DRIVERS\Accelerometer.sys [43320 2011-05-27] (Hewlett-Packard Company -> Hewlett-Packard Company)
R3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [9981952 2011-10-01] (Microsoft Windows Hardware Compatibility Publisher -> ATI Technologies Inc.)
R3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [310272 2011-10-01] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R3 AMPPAL; C:\Windows\System32\DRIVERS\AMPPAL.sys [195584 2012-01-09] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S3 AMPPALP; C:\Windows\System32\DRIVERS\amppal.sys [195584 2012-01-09] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [1256192 2011-12-12] (NETGEAR -> Broadcom Corporation)
R1 BHDrvx64; C:\Program Files\Norton Security\NortonData\22.19.8.65\Definitions\BASHDefs\20191112.003\BHDrvx64.sys [1952136 2019-10-07] (Symantec Corporation -> Symantec Corporation)
R1 ccSet_NGC; C:\Windows\System32\drivers\NGCx64\1613080.041\ccSetx64.sys [194416 2019-09-11] (Symantec Corporation -> Symantec Corporation)
S1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\7DE070B0.02A\ccSetx64.sys [162392 2013-09-27] (Symantec Corporation -> Symantec Corporation)
R3 clwvd; C:\Windows\System32\DRIVERS\clwvd.sys [31088 2010-07-28] (CyberLink -> CyberLink Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-15] (Disc Soft Ltd -> Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [516784 2019-10-10] (Symantec Corporation -> Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [154288 2019-10-10] (Symantec Corporation -> Symantec Corporation)
S3 ew_usbccgpfilter; C:\Windows\System32\DRIVERS\ew_usbccgpfilter.sys [18944 2019-07-03] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] () [Datei ist nicht signiert]
R0 hpdskflt; C:\Windows\System32\DRIVERS\hpdskflt.sys [30008 2011-05-27] (Hewlett-Packard Company -> Hewlett-Packard Company)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2019-07-03] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R1 IDSVia64; C:\Program Files\Norton Security\NortonData\22.19.8.65\Definitions\IPSDefs\20191115.061\IDSvia64.sys [1451016 2019-10-07] (Symantec Corporation -> Symantec Corporation)
S3 intaud_WaveExtensible; C:\Windows\System32\drivers\intelaud.sys [34200 2011-08-05] (Wireless Display -> Intel Corporation)
R3 iwdbus; C:\Windows\System32\DRIVERS\iwdbus.sys [25496 2011-08-05] (Wireless Display -> Intel Corporation)
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [23040 2013-08-06] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.)
S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc. -> CACE Technologies, Inc.)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [91648 2011-06-11] (Microsoft Windows Hardware Compatibility Publisher -> Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [208896 2011-06-11] (Microsoft Windows Hardware Compatibility Publisher -> Renesas Electronics Corporation)
S3 phantomtap; C:\Windows\System32\DRIVERS\phantomtap.sys [35664 2017-10-25] (Avira Operations GmbH & Co. KG -> The OpenVPN Project)
R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [25056 2011-07-22] (NETGEAR -> Windows (R) Win 7 DDK provider)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [28400 2016-12-19] () [Datei ist nicht signiert]
R1 SRTSP; C:\Windows\System32\drivers\NGCx64\1613080.041\SRTSP64.SYS [885936 2019-09-11] (Symantec Corporation -> Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\drivers\NGCx64\1613080.041\SRTSPX64.SYS [50864 2019-09-11] (Symantec Corporation -> Symantec Corporation)
S3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL6.SYS [292864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV6.SYS [1485312 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
S3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT6.SYS [740864 2009-06-10] (Microsoft Windows -> Conexant Systems, Inc.)
R3 STHDA; C:\Windows\System32\DRIVERS\stwrt64.sys [535552 2013-06-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
R0 SymEFASI; C:\Windows\System32\drivers\NGCx64\1613080.041\SYMEFASI64.SYS [1963400 2019-09-11] (Symantec Corporation -> Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [99848 2019-10-08] (Symantec Corporation -> Symantec Corporation)
S3 SymEvnt; C:\Program Files\Norton Security\NortonData\22.19.8.65\SymPlatform\SymEvnt.sys [721584 2019-10-10] (Symantec Corporation -> Symantec Corporation)
R1 SymIRON; C:\Windows\System32\drivers\NGCx64\1613080.041\Ironx64.SYS [316656 2019-09-11] (Symantec Corporation -> Symantec Corporation)
R1 SymNetS; C:\Windows\System32\drivers\NGCx64\1613080.041\symnets.sys [573448 2019-09-11] (Symantec Corporation -> Symantec Corporation)
R3 tapwindscribe0901; C:\Windows\System32\DRIVERS\tapwindscribe0901.sys [45560 2018-07-06] (Windscribe Limited -> The OpenVPN Project)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Windows -> Microsoft Corporation)
S3 wpCtrlDrv_NGC; C:\Windows\System32\drivers\NGCx64\1613080.041\wpCtrlDrv.sys [1012120 2019-09-11] (Symantec Corporation -> Symantec Corporation)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.8.1.14\Definitions\SDSDefs\20170615.020\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.8.1.14\Definitions\SDSDefs\20170615.020\NAVEX15.SYS [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat (erstellte) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2019-11-17 16:45 - 2019-11-17 16:46 - 000062070 _____ C:\Users\Tobias\Desktop\FRST.txt
2019-11-17 16:45 - 2019-11-17 16:45 - 000000000 ____D C:\FRST
2019-11-17 16:44 - 2019-11-17 16:44 - 002260480 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2019-11-17 16:42 - 2019-11-17 16:42 - 000000000 ____D C:\Windows\system32\Tasks\Remediation
2019-11-11 18:36 - 2019-11-11 18:36 - 000083074 _____ C:\Users\Tobias\Downloads\MRIU_Ärztedienstplan_November2019.pdf
2019-11-03 16:45 - 2019-11-03 16:45 - 000000000 ____D C:\Windows\rescache
2019-11-03 11:45 - 2019-11-03 11:45 - 000000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat
2019-11-03 11:45 - 2019-11-03 11:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat
2019-11-03 11:19 - 2019-11-03 11:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-10-20 16:43 - 2019-10-20 16:43 - 000724968 _____ C:\Users\Tobias\Downloads\Objekte unter dem Mikroskop messen.pdf
2019-10-20 16:31 - 2019-10-20 16:31 - 000190297 _____ C:\Users\Tobias\Downloads\Paprikacremesuppe.pdf
==================== Ein Monat (geänderte) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2019-11-17 16:43 - 2014-08-31 18:10 - 000000000 ____D C:\Users\Tobias\AppData\Local\Adobe
2019-11-17 16:43 - 2011-11-10 12:12 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2019-11-17 16:42 - 2009-07-14 05:45 - 000032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-11-17 16:42 - 2009-07-14 05:45 - 000032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-11-17 16:34 - 2017-05-11 11:35 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2019-11-17 16:33 - 2012-08-16 20:05 - 000003938 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{A3718786-F0FC-42B7-B837-15E492F36507}
2019-11-17 16:32 - 2012-08-16 20:03 - 000000000 ____D C:\Users\Tobias\AppData\LocalLow\AuthenTec
2019-11-15 18:35 - 2014-10-20 12:47 - 000000000 ____D C:\Users\Tobias\AppData\Local\NPE
2019-11-15 18:33 - 2019-10-08 19:21 - 000003192 _____ C:\Windows\system32\Tasks\HPCeeScheduleForTobias
2019-11-15 18:33 - 2019-10-08 19:21 - 000000336 _____ C:\Windows\Tasks\HPCeeScheduleForTobias.job
2019-11-15 18:26 - 2009-07-14 03:34 - 000000478 _____ C:\Windows\win.ini
2019-11-14 20:10 - 2016-03-14 16:50 - 000000544 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1937020662-3346648387-3673308353-1001.job
2019-11-14 18:32 - 2017-06-16 09:35 - 000002218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-11-14 18:32 - 2017-06-16 09:35 - 000002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-11-14 18:32 - 2017-06-16 09:35 - 000002177 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2019-11-14 18:30 - 2018-03-13 16:22 - 000004520 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
2019-11-14 18:30 - 2014-05-15 19:37 - 000004366 _____ C:\Windows\system32\Tasks\Adobe Flash Player Updater
2019-11-14 18:30 - 2012-08-16 20:47 - 000842296 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
2019-11-14 18:30 - 2012-08-16 20:47 - 000000000 ____D C:\Windows\system32\Macromed
2019-11-14 18:30 - 2011-11-10 12:12 - 000175160 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2019-11-11 19:39 - 2016-03-14 16:50 - 000000640 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1937020662-3346648387-3673308353-1001.job
2019-11-11 19:20 - 2016-11-16 16:34 - 000000000 ____D C:\Users\Tobias\AppData\LocalLow\Mozilla
2019-11-11 19:14 - 2019-05-17 17:57 - 000000000 ____D C:\Users\Tobias\Documents\Citavi 6
2019-11-09 17:22 - 2011-11-10 20:42 - 000699682 _____ C:\Windows\system32\perfh007.dat
2019-11-09 17:22 - 2011-11-10 20:42 - 000149790 _____ C:\Windows\system32\perfc007.dat
2019-11-09 17:22 - 2009-07-14 06:13 - 001620684 _____ C:\Windows\system32\PerfStringBackup.INI
2019-11-09 17:22 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2019-11-09 13:51 - 2013-01-27 20:05 - 000000000 ____D C:\Program Files (x86)\Steam
2019-11-09 13:51 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-11-06 17:45 - 2017-06-16 09:34 - 000003546 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
2019-11-06 17:45 - 2017-06-16 09:34 - 000003418 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
2019-11-06 17:45 - 2017-06-16 09:34 - 000000000 ____D C:\Program Files (x86)\Google
2019-11-06 17:34 - 2016-10-26 17:41 - 001581568 ___SH C:\Users\Tobias\Desktop\Thumbs.db
2019-11-03 13:35 - 2014-09-30 12:16 - 000003919 _____ C:\Windows\wininit.ini
2019-11-03 13:33 - 2017-07-10 18:51 - 000000000 ____D C:\Users\Tobias\Desktop\Doktorarbeit
2019-11-03 12:34 - 2014-09-04 20:30 - 000000000 ___RD C:\Users\Tobias\Desktop\Bali
2019-10-23 16:04 - 2012-08-18 11:10 - 000000000 ____D C:\Wichtige Dokumente
2019-10-23 15:25 - 2015-06-11 04:46 - 000004476 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task
2019-10-21 16:58 - 2018-12-20 15:58 - 000000000 ____D C:\ProgramData\Buhl Data Service GmbH
2019-10-21 13:54 - 2019-10-12 15:23 - 000000000 ____D C:\Users\Tobias\Desktop\PKV Marco
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========
2014-11-10 15:38 - 2014-11-10 15:38 - 000000037 ___SH () C:\Users\Tobias\AppData\Local\70149b02515b3bb20dd492.47983420
2012-12-04 20:13 - 2012-12-04 20:13 - 000003584 _____ () C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-03-03 17:17 - 2015-03-03 17:17 - 000007609 _____ () C:\Users\Tobias\AppData\Local\Resmon.ResmonCfg
==================== SigCheck ============================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
LastRegBack: 2019-11-09 20:55
==================== Ende von FRST.txt ========================
|
| Themen zu Norton zeigt Trojaner und Bitcoin Miner Angriff an, Speicherplatz verschwindet, hoher Datenverkehr |
| antivirus, askbar, avira, error, exe, festplatte, firefox, flash player, frage, google, home, logfile, mozilla, netgear, programm, prozesse, realtek, registry, rundll, sigcheck, siteadvisor, speicherplatz, symantec, trojaner, updates, usb, webadvisor, windows |
Baum-Darstellung