| djSpatzi | 29.11.2015 19:17 |
Windows mrtstub.exe / Vorhin extrem seltsames Verhalten
Hallo zusammen,
habe Windows 8 Pro 64bit (aktiviert über Studentenlizenz) mit verschiedenen "Anomalitäten"?! -->
Unter C:\ habe ich mehrere seltsame Verzeichnisse:
"C:\c0e2988f8fb64bcf46"
"C:\9b7d6bdec1a3502dd5ae0c44"
"C:\95c867db1f210ecc5ccd1fe14584"
mit jeweils einer mrtstub.exe darin....? Laut Google ist mrtstub ja nichts bedenkliches, aber wieso mehrfach? Ist das i.o.?
Des weiteren habe ich unter "C:\inetpub" ein Verzeichnis inkl "wwwroot" darin. Darin enthalten ist die Datei iisstart.htm, die beim Öffnen darauf deutet, dass ich einen IIS-Server von Microsoft installiert hätte!?... Wieso das denn? Habe nämlich keinen installiert...
Sonst läuft eigentlich alles soweit recht stabil - vorhin hatte ich jedoch ein seltsames Verhalten: PC war an, jedoch Bildschirm aus. Nachdem ich diesen wieder eingeschaltet habe, war die Icons auf dem Desktop ganz wild verschoben, die Fenster haben geflimmert und waren nur partiell zu sehen - ich konnte keine Software steuern, manche Desktopicons haben gefehlt und ich konnte nichts mehr machen. Habe den PC dann einfach vom Strom getrennt, sonst blieb mir nichts. Nach einem Neustart war dann wieder alles i.o.
Vielen Dank Euch für die Hilfe und Mühen im Voraus FRST: Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:28-11-2015
durchgeführt von deruser (Administrator) auf BSPC (29-11-2015 19:21:08)
Gestartet von C:\Users\deruser\Desktop
Geladene Profile: deruser (Verfügbare Profile: deruser & Classic .NET AppPool & .NET v4.5 & .NET v2.0 & .NET v4.5 Classic & .NET v2.0 Classic)
Platform: Windows 8.1 Pro N (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files\Listary\ListaryService.exe
() C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
() C:\Windows\SysWOW64\NMSAccessU.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe
(Bopsoft) C:\Program Files\Listary\Listary.exe
() C:\Program Files\Listary\ListaryHelper64.exe
(hxxp://www.SteveMiller.net) C:\Program Files (x86)\_PortableSoftware\puretext_3.0_64-bit\PureText.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Spotify Ltd) C:\Users\deruser\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\deruser\AppData\Local\AudioSwitch\AudioSwitch.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(LastPass) C:\Program Files (x86)\LastPass\nplastpass.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Dropbox, Inc.) C:\Users\deruser\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Secomba GmbH) C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe
(2BrightSparks Pte Ltd) C:\Program Files (x86)\2BrightSparks\SyncBackPro\SyncBackPro.exe
() C:\Program Files (x86)\Keybreeze4\Keybreeze.exe
() C:\Program Files (x86)\_PortableSoftware\TyperTask\typertask.exe
(Greenshot) C:\Program Files (x86)\_PortableSoftware\Greenshot\Greenshot.exe
(Spotify Ltd) C:\Users\deruser\AppData\Roaming\Spotify\Spotify.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Spotify Ltd) C:\Users\deruser\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\deruser\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\deruser\AppData\Roaming\Spotify\Spotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1084328 2015-04-13] (The Eraser Project)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6133520 2015-11-07] (AVAST Software)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2720144 2015-08-09] (Dominik Reichl)
HKLM-x32\...\Run: [Keybreeze4] => C:\Program Files (x86)\Keybreeze4\Keybreeze.exe [564736 2012-12-28] ()
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2015-09-27] (Adobe Systems Inc.)
HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.8\bin\EpmNews.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [BrowserChoice] => C:\Windows\BrowserChoice\browserchoice.exe [86816 2013-08-22] (Microsoft Corporation)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2013-11-18] (TrueCrypt Foundation)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [ASRock A-Tuning] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [Facebook Update] => C:\Users\deruser\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-04-07] (Facebook Inc.)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [ConEmuDefaultTerminal] => "C:\Program Files (x86)\ConEmu\ConEmu.exe" /SetDefTerm /Detached /MinTSA
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run:[Listary] => C:\Program Files\Listary\Listary.exe [3733776 2013-09-22] (Bopsoft)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [PureText] => C:\Program Files (x86)\_PortableSoftware\puretext_3.0_64-bit\PureText.exe [33792 2013-01-04] (hxxp://www.SteveMiller.net)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [Spotify Web Helper] => C:\Users\deruser\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2344768 2015-11-16] (Spotify Ltd)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Run: [Dropbox Update] => C:\Users\deruser\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-18] (Dropbox, Inc.)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day0] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day1] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day2] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day3] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day4] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day5] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\RunOnce: [AsrOMG_Day6] => [X]
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\MountPoints2: {775fcb1c-4a0c-11e4-9c42-0019e0144132} - "D:\LG_PC_Programs.exe"
IFEO\notepad.exe: [Debugger] C:\Program Files (x86)\NppLauncher\NppLauncher.exe
SSODL: EldosMountNotificator-cbfs4 - {3BB2B8FB-0A6B-47D1-B968-EB689DB75F59} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {3BB2B8FB-0A6B-47D1-B968-EB689DB75F59} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-09-20] (AVAST Software)
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs4] -> {DF2D0F40-4FE0-429B-9D7F-D2D6CC767392} => C:\Windows\system32\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs4] -> {DF2D0F40-4FE0-429B-9D7F-D2D6CC767392} => C:\Windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OpenVPN Client.lnk [2015-11-26]
ShortcutTarget: OpenVPN Client.lnk -> C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\uiboot.exe ()
Startup: C:\Users\deruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioSwitch.lnk [2015-10-28]
ShortcutTarget: AudioSwitch.lnk -> C:\Users\deruser\AppData\Local\AudioSwitch\AudioSwitch.exe ()
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyServer: [S-1-5-21-2919065167-3665529847-2276591382-1001] => 194.158.204.194:1080
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.192.1
Tcpip\..\Interfaces\{4665CB4A-B1BB-45AC-B78E-BB54AF088F77}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{74885D69-6484-44DB-9B6D-9C687C4A3384}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{74885D69-6484-44DB-9B6D-9C687C4A3384}: [DhcpNameServer] 192.168.192.1
Tcpip\..\Interfaces\{E620872D-B3B6-4A32-87A1-0CD8E90CDF21}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-05] (AVAST Software)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-12-02] (Adobe Systems Incorporated)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-12-02] (Adobe Systems Incorporated)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-27] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-05] (AVAST Software)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-27] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
Toolbar: HKLM - Kein Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Keine Datei
Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Keine Datei
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-12-02] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-03-31] (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-28] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll [2014-03-31] (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-03-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-03-04] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin HKU\S-1-5-21-2919065167-3665529847-2276591382-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\deruser\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-09-20] [ist nicht signiert]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-10-14] [ist nicht signiert]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSearchURL: Default -> hxxps://mail.google.com/mail/u/0/#inbox
CHR DefaultSearchKeyword: Default -> lp
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll => Keine Datei
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\ppGoogleNaClPluginChrome.dll => Keine Datei
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\pdf.dll => Keine Datei
CHR Plugin: (Dragon NaturallySpeaking Rich Internet Application Support) - C:\PROGRA~2\Nuance\NATURA~1\Program\npDgnRia.dll => Keine Datei
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll => Keine Datei
CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll => Keine Datei
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.550.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll => Keine Datei
CHR Plugin: (Java(TM) Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => Keine Datei
CHR Plugin: (NPLastPass) - C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (QUAKE LIVE) - C:\ProgramData\id Software\QuakeLive\npquakezero.dll => Keine Datei
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\deruser\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll => Keine Datei
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll => Keine Datei
CHR Profile: C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Duolingo im Web) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2015-11-18]
CHR Extension: (Lockify) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiigoloogeminempipceaikpnaimbekd [2015-11-18]
CHR Extension: (Google Drive) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-18]
CHR Extension: (Adblock Plus) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-11-28]
CHR Extension: (Tampermonkey) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2015-11-28]
CHR Extension: (User-Agent Switcher for Chrome) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\djflhoibgkdhkhhcedjiklpkjnoahfmg [2015-11-18]
CHR Extension: (Google Kalender) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2015-11-18]
CHR Extension: (TrashMail.com: Wegwerf-E-Mail erstellen) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihbdpohplcdnhllhliaeapefmmpcdjo [2015-11-18]
CHR Extension: (EditThisCookie) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2015-11-18]
CHR Extension: (HTTPS Everywhere) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2015-11-18]
CHR Extension: (Google Docs Offline) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-23]
CHR Extension: (Avast Online Security) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-18]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2015-11-18]
CHR Extension: (Bookmark Search) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhmokalkpaiacdofbcddkogifepbaijk [2015-11-18]
CHR Extension: (AirDroid) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkgndiocipalkpejnpafdbdlfdjihomd [2015-11-18]
CHR Extension: (Checker Plus for Google Calendar™) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkhggnncdpfibdhinjiegagmopldibha [2015-11-29]
CHR Extension: (Mail 1A - Wegwerf Mail) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlemhhbnifgcoghhkbjdnnlhincehiem [2015-11-18]
CHR Extension: (Pixlr Express) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmjpdlmjopaeginhldhiokeidchjid [2015-11-18]
CHR Extension: (Pixlr Editor) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk [2015-11-18]
CHR Extension: (Start in Non-Pinned Tab) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihdmghkoepdddbcdomljmbaajiccappf [2015-11-18]
CHR Extension: (Voice Recognition) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikjmfindklfaonkodbnidahohdfbdhkn [2015-11-18]
CHR Extension: (Open Frame in New Tab) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjjodgdplcalapdbmmgadocimcahehjf [2015-11-18]
CHR Extension: (Google Play) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi [2015-11-18]
CHR Extension: (Google Maps) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2015-11-18]
CHR Extension: (Better Google Tasks) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbhddnkmimnokfjdlogacnfjfclgcdme [2015-11-18]
CHR Extension: (Native URL Shortener) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngmiekalinhgehhfjbbiabodfeahckhe [2015-11-18]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-18]
CHR Extension: (Personal Blocklist (by Google)) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef [2015-11-18]
CHR Extension: (Page Monitor) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\pemhgklkefakciniebenbfclihhmmfcd [2015-11-18]
CHR Extension: (Google Mail) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-18]
CHR Profile: C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5
CHR Extension: (Google Präsentationen) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-18]
CHR Extension: (Google Docs) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-18]
CHR Extension: (Google Drive) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-18]
CHR Extension: (YouTube) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-18]
CHR Extension: (Google-Suche) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-18]
CHR Extension: (Google Tabellen) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-18]
CHR Extension: (Google Docs Offline) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18]
CHR Extension: (Avast Online Security) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-18]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-18]
CHR Extension: (Google Mail) - C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-18]
CHR HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\deruser\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-05-30]
CHR HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2015-09-27]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-27]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-09-20] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4048280 2015-09-20] (Avast Software)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-09-25] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 ListaryService; C:\Program Files\Listary\ListaryService.exe [275720 2013-09-22] ()
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccessU.exe [71096 2009-01-12] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe [24064 2010-08-12] () [Datei ist nicht signiert]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2014-07-03] (Microsoft Corporation)
S3 sopcastp2p; C:\Program Files (x86)\SopCast\srvany.exe [X]
S2 vtigercrmApache540; "C:\Program Files (x86)\vtigercrm-5.4.0\apache\bin\Apache.exe" -k runservice [X]
S2 vtigercrmMysql540; "C:\Program Files (x86)\vtigercrm-5.4.0\mysql\bin\mysqld-nt" "--defaults-file=C:\Program Files (x86)\vtigercrm-5.4.0\mysql\my.ini" vtigercrmMysql540
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2014-05-27] (Google Inc)
S3 AndnetBus; C:\Windows\System32\drivers\lgandnetbus64.sys [20992 2014-05-27] (LG Electronics Inc.)
S3 AndNetDiag; C:\Windows\system32\DRIVERS\lgandnetdiag64.sys [29184 2014-05-27] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\system32\DRIVERS\lgandnetmodem64.sys [36352 2014-05-27] (LG Electronics Inc.)
R3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2013-11-19] (ASRock Incorporation)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-09-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-09-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-09-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-09-20] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1059656 2015-11-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449992 2015-11-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [153744 2015-09-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-09-20] (AVAST Software)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [132608 2015-01-30] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 dsNcAdpt; C:\Windows\system32\DRIVERS\dsNcAdpt.sys [36816 2013-10-28] (Juniper Networks) [Datei ist nicht signiert]
S3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [469264 2013-06-26] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R2 IntelHaxm; C:\Windows\system32\DRIVERS\IntelHaxm.sys [91392 2014-03-14] ()
S3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-03-14] ()
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
R0 ngvss; C:\Windows\System32\Drivers\ngvss.sys [132656 2015-09-20] (AVAST Software)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R3 RTL8023x64; C:\Windows\system32\DRIVERS\Rtnic64.sys [51712 2013-06-18] (Realtek Semiconductor Corporation )
R3 tapoas; C:\Windows\system32\DRIVERS\tapoas.sys [30720 2010-08-03] (The OpenVPN Project)
U5 UnlockerDriver5; C:\Program Files (x86)\_PortableSoftware\unlocker1.9.0-portable\x86\UnlockerDriver5.sys [4096 2010-07-04] () [Datei ist nicht signiert]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [274336 2015-09-20] (Avast Software)
R1 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys [117768 2015-11-10] (Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\system32\DRIVERS\VBoxNetLwf.sys [194976 2015-11-10] (Oracle Corporation)
R3 vpnpbus; C:\Windows\System32\drivers\vpnpbus.sys [18624 2013-08-30] (EldoS Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 VBoxNetFlt; \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-11-29 19:21 - 2015-11-29 19:21 - 00037999 _____ C:\Users\deruser\Desktop\FRST.txt
2015-11-29 19:20 - 2015-11-29 19:21 - 00000000 ____D C:\FRST
2015-11-29 19:20 - 2015-11-29 19:20 - 02349056 _____ (Farbar) C:\Users\deruser\Desktop\FRST64.exe
2015-11-29 19:19 - 2015-11-29 19:19 - 00050477 _____ C:\Users\deruser\Desktop\Defogger.exe
2015-11-29 19:19 - 2015-11-29 19:19 - 00000000 _____ C:\Users\deruser\defogger_reenable
2015-11-28 22:38 - 2015-11-28 22:38 - 00000000 ___HD C:\$Windows.~WS
2015-11-28 22:23 - 2015-11-28 22:23 - 00000000 ____D C:\$WINDOWS.~BT
2015-11-28 18:00 - 2015-11-28 10:51 - 00001076 _____ C:\Users\deruser\Desktop\Oracle VM VirtualBox.lnk
2015-11-28 10:51 - 2015-11-28 10:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-11-28 10:51 - 2015-11-28 10:51 - 00000000 ____D C:\Program Files\Oracle
2015-11-28 10:51 - 2015-11-10 17:56 - 00964928 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-11-28 10:51 - 2015-11-10 17:56 - 00138904 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-11-26 20:39 - 2015-11-26 20:39 - 00001396 _____ C:\Users\Public\Desktop\OpenVPN Client.lnk
2015-11-26 20:39 - 2015-11-26 20:39 - 00000000 ____D C:\Users\deruser\Desktop\AllLocations
2015-11-26 20:39 - 2015-11-26 20:39 - 00000000 ____D C:\Users\deruser\AppData\Roaming\OpenVPN Technologies
2015-11-26 20:39 - 2015-11-26 20:39 - 00000000 ____D C:\Users\deruser\AppData\Local\OpenVPN Technologies
2015-11-26 20:39 - 2015-11-26 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN Client
2015-11-26 20:39 - 2015-11-26 20:39 - 00000000 ____D C:\Program Files (x86)\OpenVPN Technologies
2015-11-25 21:46 - 2015-11-25 21:46 - 00000008 ___RH C:\Users\deruser\hwid
2015-11-25 21:45 - 2015-11-25 21:47 - 00000000 ____D C:\Jts
2015-11-25 21:45 - 2015-11-25 21:45 - 00001416 _____ C:\Users\deruser\Desktop\Trader Workstation.lnk
2015-11-25 21:45 - 2015-11-25 21:45 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trader Workstation
2015-11-25 21:45 - 2015-11-25 21:45 - 00000000 ____D C:\Users\deruser\.i4j_jres
2015-11-18 16:25 - 2015-11-18 16:25 - 00002425 _____ C:\Users\deruser\Desktop\BANKING - Chrome.lnk
2015-11-12 19:02 - 2015-11-12 19:02 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-11-11 19:27 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 19:27 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 19:27 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 19:27 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 19:27 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 19:27 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-11-11 19:27 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-11-11 19:27 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-11-11 19:27 - 2015-10-30 23:39 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-11-11 19:27 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-11-11 19:27 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 19:27 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 19:27 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 19:27 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 19:27 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-11-11 19:27 - 2015-10-30 23:14 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-11-11 19:27 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-11-11 19:27 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-11-11 19:27 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 19:27 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 19:27 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-11-11 19:27 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-11-11 19:27 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-11-11 19:27 - 2015-10-20 22:54 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 19:27 - 2015-10-20 15:53 - 03705856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 19:27 - 2015-10-20 15:36 - 02243072 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 19:27 - 2015-10-20 15:35 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 19:27 - 2015-10-20 15:34 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-11-11 19:27 - 2015-10-20 15:34 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 19:27 - 2015-10-20 15:34 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 19:27 - 2015-10-20 15:33 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 19:27 - 2015-10-20 15:14 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-11-11 19:27 - 2015-10-20 15:13 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-11-11 19:27 - 2015-10-20 15:13 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-11-11 19:27 - 2015-10-20 15:13 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-11-11 19:27 - 2015-10-17 15:19 - 04176384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 19:27 - 2015-10-15 17:08 - 00990208 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 19:27 - 2015-10-15 16:46 - 00803328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-11-11 19:27 - 2015-10-15 00:02 - 07455064 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 19:27 - 2015-10-15 00:02 - 01659560 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-11-11 19:27 - 2015-10-15 00:02 - 01519592 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-11-11 19:27 - 2015-10-15 00:02 - 01487008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-11-11 19:27 - 2015-10-15 00:02 - 01355848 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-11-11 19:27 - 2015-10-13 18:10 - 00559616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 19:27 - 2015-10-13 18:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 19:27 - 2015-10-13 16:59 - 00397224 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 19:27 - 2015-10-13 16:59 - 00340872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2015-11-11 19:27 - 2015-10-13 16:59 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 19:27 - 2015-10-13 16:59 - 00120376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-11-11 19:27 - 2015-10-13 16:59 - 00106952 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2015-11-11 19:27 - 2015-10-13 16:59 - 00091416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2015-11-11 19:27 - 2015-10-11 07:36 - 00561952 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 19:27 - 2015-10-11 07:36 - 00177496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 19:27 - 2015-10-10 19:40 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 19:27 - 2015-10-10 19:39 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 19:27 - 2015-10-10 19:07 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-11-11 19:27 - 2015-10-10 18:33 - 01441280 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 19:27 - 2015-10-10 18:27 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 19:27 - 2015-10-10 18:11 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-11-11 19:27 - 2015-10-10 17:45 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-11-11 19:27 - 2015-10-08 17:08 - 01083904 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2015-11-11 19:27 - 2015-09-29 13:24 - 00155480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2015-11-11 19:27 - 2015-09-12 14:47 - 00414559 _____ C:\Windows\system32\ApnDatabase.xml
2015-11-11 19:27 - 2015-09-07 17:22 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2015-11-11 19:27 - 2015-09-07 17:21 - 00825856 _____ (Microsoft Corporation) C:\Windows\system32\pmcsnap.dll
2015-11-11 19:27 - 2015-09-07 17:17 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\ppcsnap.dll
2015-11-11 19:27 - 2015-09-07 16:54 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2015-11-11 19:27 - 2015-09-07 16:30 - 01091584 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2015-11-11 19:27 - 2015-09-04 20:24 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tunnel.sys
2015-11-11 19:27 - 2015-08-28 23:20 - 00183368 _____ (Microsoft Corporation) C:\Windows\system32\AuthHost.exe
2015-11-11 19:27 - 2015-08-20 21:45 - 01380048 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-11-11 19:27 - 2015-08-20 18:48 - 01096704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-11-11 19:27 - 2015-08-10 19:15 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2015-11-11 19:27 - 2015-08-10 19:06 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2015-11-11 19:27 - 2015-08-10 18:49 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2015-11-11 19:27 - 2015-08-10 17:56 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2015-11-11 19:27 - 2015-08-10 17:46 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2015-11-11 19:27 - 2014-11-10 19:06 - 00136512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2015-11-11 19:27 - 2014-11-05 02:41 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2015-11-11 19:27 - 2014-11-05 02:18 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2015-11-10 17:56 - 2015-11-10 17:56 - 00194976 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetLwf.sys
2015-11-10 17:56 - 2015-11-10 17:56 - 00117768 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp6.sys
2015-11-08 17:06 - 2015-11-08 17:06 - 00000011 _____ C:\Users\deruser\AppData\Local\RawCopy.savedialog.dir
2015-11-08 17:06 - 2015-11-08 17:06 - 00000001 _____ C:\Users\deruser\AppData\Local\RawCopy.sourcedisk.index
2015-11-08 17:06 - 2015-11-08 17:06 - 00000001 _____ C:\Users\deruser\AppData\Local\RawCopy.savedialog.filterindex
2015-11-08 13:00 - 2015-11-08 13:00 - 00000000 ____D C:\Program Files (x86)\ESET
2015-11-08 10:52 - 2015-11-08 10:52 - 00000001 _____ C:\Users\deruser\AppData\Local\RawCopy.1.10.agreement
2015-11-08 09:35 - 2015-11-08 09:35 - 00003166 _____ C:\Users\deruser\photorec.cfg
2015-11-07 22:50 - 2015-11-27 17:25 - 00000000 ____D C:\Users\deruser\.oracle_jre_usage
2015-11-07 21:42 - 2013-01-09 14:26 - 00155736 _____ (Sysinternals) C:\Windows\system32\sdelete.exe
2015-11-03 19:33 - 2015-11-03 19:33 - 08824358 _____ C:\Users\deruser\Desktop\baseq3.zip
2015-11-03 19:33 - 2015-11-03 19:33 - 00000222 _____ C:\Users\deruser\Desktop\Quake Live.url
2015-11-03 19:16 - 2015-11-03 19:16 - 00000000 ____D C:\Users\deruser\AppData\Local\Steam
2015-11-03 19:15 - 2015-11-24 19:15 - 00000000 ____D C:\Program Files (x86)\Steam
2015-11-03 19:15 - 2015-11-03 19:15 - 00000985 _____ C:\Users\Public\Desktop\Steam.lnk
2015-11-03 19:15 - 2015-11-03 19:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-11-03 17:10 - 2015-11-03 17:13 - 00000000 ____D C:\Program Files (x86)\Beyond Compare 4
2015-11-03 17:10 - 2015-11-03 17:10 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Scooter Software
2015-11-03 17:10 - 2015-11-03 17:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Beyond Compare 4
2015-11-03 17:05 - 2015-11-03 17:06 - 00000000 ____D C:\Users\deruser\AppData\Local\Chevolume.com
2015-11-03 17:00 - 2015-11-03 17:00 - 00001189 _____ C:\ProgramData\Microsoft\Windows\Start Menu\CheVolume.lnk
2015-11-03 17:00 - 2015-11-03 17:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WellWeWeb
2015-11-03 17:00 - 2015-11-03 17:00 - 00000000 ____D C:\Program Files (x86)\WellWeWeb
2015-11-02 18:25 - 2015-11-02 18:25 - 00000000 ____D C:\Users\deruser\AppData\Roaming\SQLite Administrator
2015-11-01 19:35 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2015-11-01 19:35 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-11-29 19:20 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-11-29 19:19 - 2013-11-18 14:14 - 00000000 ____D C:\Users\deruser
2015-11-29 19:11 - 2014-04-07 20:40 - 00000956 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA.job
2015-11-29 19:11 - 2013-11-18 18:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-29 18:53 - 2015-06-18 05:43 - 00001252 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA.job
2015-11-29 18:40 - 2013-11-18 14:35 - 00001138 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-29 17:26 - 2013-11-25 20:12 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Spotify
2015-11-29 17:21 - 2013-11-25 20:12 - 00000000 ____D C:\Users\deruser\AppData\Local\Spotify
2015-11-29 17:21 - 2013-11-18 14:38 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Dropbox
2015-11-29 16:53 - 2015-06-18 05:43 - 00001200 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core.job
2015-11-29 16:25 - 2013-11-18 14:19 - 02065254 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-29 16:25 - 2013-08-23 00:26 - 00877294 _____ C:\Windows\system32\perfh007.dat
2015-11-29 16:25 - 2013-08-23 00:26 - 00201442 _____ C:\Windows\system32\perfc007.dat
2015-11-29 16:25 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2015-11-29 16:20 - 2014-01-21 14:55 - 00000000 ____D C:\Users\deruser\AppData\Local\FreePDF_XP
2015-11-29 16:19 - 2014-04-26 11:35 - 00000134 _____ C:\HaxLogs.txt
2015-11-29 16:19 - 2013-11-18 14:35 - 00001134 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-29 16:19 - 2013-11-18 14:17 - 00000000 ____D C:\ProgramData\NVIDIA
2015-11-29 16:19 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-29 11:33 - 2013-11-18 14:20 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2919065167-3665529847-2276591382-1001
2015-11-29 11:05 - 2013-11-18 14:46 - 00000000 ____D C:\Users\deruser\AppData\Local\JDownloader v2.0
2015-11-29 10:44 - 2014-01-15 09:40 - 00000000 ____D C:\Users\deruser\.VirtualBox
2015-11-29 10:41 - 2015-02-04 20:34 - 00000000 ____D C:\Users\deruser\AppData\Local\Waow
2015-11-29 10:39 - 2013-11-27 18:34 - 00000476 __RSH C:\Users\deruser\ntuser.pol
2015-11-29 09:15 - 2013-11-18 15:25 - 00000000 ____D C:\Users\deruser\AppData\Local\Adobe
2015-11-28 22:38 - 2013-11-18 21:09 - 00000000 ____D C:\Windows\Panther
2015-11-28 22:11 - 2014-04-07 20:40 - 00000934 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core.job
2015-11-28 20:36 - 2013-11-18 16:35 - 00000000 ____D C:\Program Files (x86)\_PortableSoftware
2015-11-28 10:53 - 2014-01-15 09:40 - 00000000 ____D C:\Users\deruser\VirtualBox VMs
2015-11-28 10:48 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-11-27 17:29 - 2013-11-18 14:48 - 00000000 ____D C:\ProgramData\Oracle
2015-11-27 17:25 - 2015-08-20 17:37 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-11-27 17:25 - 2015-08-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-27 17:25 - 2013-11-18 14:47 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-26 20:38 - 2014-03-31 15:06 - 00000000 ____D C:\Users\deruser\AppData\LocalLow\LastPass
2015-11-24 21:01 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2015-11-23 19:19 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2015-11-18 19:28 - 2013-11-18 16:44 - 00000000 ____D C:\Users\deruser\AppData\Roaming\KeePass
2015-11-18 18:23 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2015-11-15 22:57 - 2013-11-18 14:31 - 00000000 ____D C:\Windows\system32\MRT
2015-11-15 22:54 - 2013-11-18 14:31 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-15 20:03 - 2013-08-22 15:44 - 05219008 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-13 08:00 - 2014-02-10 11:09 - 00000000 ____D C:\Users\deruser\AppData\Local\TSVNCache
2015-11-13 08:00 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\ToastData
2015-11-12 18:40 - 2013-11-25 21:58 - 00007168 _____ C:\Users\deruser\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-11 20:00 - 2013-11-18 16:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-10 20:11 - 2013-11-18 18:07 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-09 21:17 - 2013-11-18 14:43 - 00000000 ____D C:\Users\deruser\AppData\Roaming\Skype
2015-11-07 22:54 - 2013-11-18 11:02 - 00000000 ____D C:\_Scripts
2015-11-07 22:50 - 2014-05-30 12:09 - 00000000 ___RD C:\Users\deruser\Google Drive
2015-11-07 22:41 - 2015-10-28 17:48 - 00000000 ____D C:\Users\deruser\AppData\Local\Deployment
2015-11-07 22:40 - 2013-11-18 15:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-11-07 21:05 - 2013-11-18 14:14 - 00000000 ____D C:\Users\deruser\AppData\Local\Packages
2015-11-07 21:00 - 2013-11-18 14:40 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2015-11-07 17:03 - 2013-11-18 14:36 - 01059656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-11-07 17:03 - 2013-11-18 14:36 - 00449992 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2015-11-07 16:59 - 2013-11-18 14:54 - 00000000 ____D C:\Users\deruser\AppData\Roaming\TortoiseHg
2015-11-03 01:23 - 2014-05-05 22:20 - 00810488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-03 01:23 - 2014-05-05 22:20 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-01 19:49 - 2014-12-26 18:56 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2013-11-18 15:58 - 2009-10-29 20:42 - 419430400 ____N () C:\Program Files (x86)\MeinGeld10StickPro.dat
2013-10-14 03:44 - 2013-10-14 03:44 - 2174976 ____N (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2014-10-19 17:16 - 2014-10-19 17:16 - 0000132 ____N () C:\Users\deruser\AppData\Roaming\Adobe GIF-Format CC - Voreinstellungen
2014-01-14 21:15 - 2014-11-02 19:37 - 0000132 ____N () C:\Users\deruser\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-01-07 15:17 - 2014-06-27 17:23 - 0001675 ____N () C:\Users\deruser\AppData\Roaming\SAS7_000.DAT
2013-11-19 12:25 - 2014-07-07 09:15 - 0000600 ____N () C:\Users\deruser\AppData\Roaming\winscp.rnd
2013-12-02 13:16 - 2015-09-15 16:23 - 0001456 ____N () C:\Users\deruser\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2013-11-25 21:58 - 2015-11-12 18:40 - 0007168 _____ () C:\Users\deruser\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-19 13:20 - 2015-11-07 22:47 - 0654017 _____ () C:\Users\deruser\AppData\Local\HDGraph.log
2015-11-08 10:52 - 2015-11-08 10:52 - 0000001 _____ () C:\Users\deruser\AppData\Local\RawCopy.1.10.agreement
2015-11-08 17:06 - 2015-11-08 17:06 - 0000011 _____ () C:\Users\deruser\AppData\Local\RawCopy.savedialog.dir
2015-11-08 17:06 - 2015-11-08 17:06 - 0000001 _____ () C:\Users\deruser\AppData\Local\RawCopy.savedialog.filterindex
2015-11-08 17:06 - 2015-11-08 17:06 - 0000001 _____ () C:\Users\deruser\AppData\Local\RawCopy.sourcedisk.index
2014-03-20 11:59 - 2014-03-20 11:59 - 0001239 ____N () C:\Users\deruser\AppData\Local\recently-used.xbel
2013-11-22 18:47 - 2013-11-22 18:47 - 0007603 ____N () C:\Users\deruser\AppData\Local\Resmon.ResmonCfg
2013-11-18 18:02 - 2013-11-18 18:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\deruser\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppz2010.dll
C:\Users\deruser\AppData\Local\Temp\i4jdel0.exe
C:\Users\deruser\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\deruser\AppData\Local\Temp\jre-8u66-windows-au.exe
C:\Users\deruser\AppData\Local\Temp\proxy_vole1522229008118385861.dll
C:\Users\deruser\AppData\Local\Temp\proxy_vole3155301653576153645.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-11-18 18:22
==================== Ende von FRST.txt ============================
Additions: Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:28-11-2015
durchgeführt von deruser (2015-11-29 19:21:26)
Gestartet von C:\Users\deruser\Desktop
Windows 8.1 Pro N (X64) (2013-11-18 13:14:49)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2919065167-3665529847-2276591382-500 - Administrator - Disabled)
deruser (S-1-5-21-2919065167-3665529847-2276591382-1001 - Administrator - Enabled) => C:\Users\deruser
Gast (S-1-5-21-2919065167-3665529847-2276591382-501 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Acrobat XI (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.13 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.199 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Update Management Tool (HKLM-x32\...\{534A7A1A-7102-4AF6-23EA-7CD279C7B625}_is1) (Version: 7.0 - PainteR)
Agent Ransack x64 (HKLM\...\{FD8C1365-2229-4F37-A126-558DB2471CBE}) (Version: 7.0.828.1 - Mythicsoft Ltd)
ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.)
A-Tuning v2.0.45 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.45 - )
AudioSwitch (HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\AudioSwitch_is1) (Version: 2.1.1.0 - )
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.4.2233 - AVAST Software)
Beyond Compare 4.0.2 (HKLM-x32\...\BeyondCompare4_is1) (Version: 4.0.2.19186 - Scooter Software)
BitTorrent Sync (HKLM-x32\...\BitTorrent Sync) (Version: 1.2.82 - )
Boxcryptor Classic 1.7 (HKLM-x32\...\{DF47AB90-FB92-42F4-926E-1C4FF16029E7}) (Version: 1.7.409.131 - Secomba GmbH)
CheVolume 0.3.0.0 (HKLM-x32\...\CheVolume_0) (Version: 0.3.0.0 - WellWeWeb)
Combined Community Codec Pack 2013-11-27 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2013.11.27.0 - CCCP Project)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Dropbox) (Version: 3.10.11 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.2.24.20150630 - Landesfinanzdirektion Thüringen)
Eraser 6.2.0.2969 (HKLM\...\{66AB13EA-E7D2-4CFC-9B66-8E9EE44C89EE}) (Version: 6.2.2969 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.73 - Google Inc.)
Google Drive (HKLM-x32\...\{9C350701-AC04-48BA-A435-BD5E0D82897E}) (Version: 1.25.0523.2491 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
Intel(R) C++ Redistributables on IA-32 (HKLM-x32\...\{5018D8E6-8D8E-4F76-9AFD-CB2EF1100E84}) (Version: 13.0.089 - Intel Corporation)
Intel(R) C++ Redistributables on Intel(R) 64 (HKLM-x32\...\{791FF357-3DE8-485E-BD59-41844BB16415}) (Version: 13.0.089 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{B991A1BC-DE0F-41B3-9037-B2F948F706EC}) (Version: 3.1.1228 - Intel Corporation)
Intel® Hardware Accelerated Execution Manager (HKLM\...\{5657796F-9AA4-41D7-93A1-0D95CF6CEFE8}) (Version: 1.0.8 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
KeePass Password Safe 2.24 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.24 - Dominik Reichl)
Keybreeze (HKLM-x32\...\Keybreeze4) (Version: - Keybreeze Software)
LastPass (Nur deinstallieren) (HKLM-x32\...\LastPass) (Version: - LastPass)
LG United Mobile Drivers (HKLM-x32\...\{15A5D29A-F209-49FD-BA47-5E4C882FF496}) (Version: 3.12.1.0 - LG Electronics)
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version: - )
Listary version 4.02 (HKLM\...\Listary_is1) (Version: 4.02 - )
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - ENU (HKLM-x32\...\Microsoft Visual C++ 2010 Express - ENU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU (HKLM\...\{BCA26999-EC22-3007-BB79-638913079C9A}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSI Afterburner 2.3.1 (HKLM-x32\...\Afterburner) (Version: 2.3.1 - MSI Co., LTD)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
NppLauncher (HKLM-x32\...\NppLauncher) (Version: 0.9.9 - )
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
OpenVPN Client (HKLM-x32\...\{072A5217-8165-4AB7-8366-36CB3245DB60}) (Version: 1.5.6 - OpenVPN Technologies)
Oracle VM VirtualBox 5.0.10 (HKLM\...\{F6E922CF-068D-4AFC-8DBF-4636B84AF0A5}) (Version: 5.0.10 - Oracle Corporation)
Quake Live (HKLM-x32\...\Steam App 282440) (Version: - id Software)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.9 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.9 - Saal Digital Fotoservice GmbH) Hidden
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Spotify) (Version: 1.0.18.60.g5fe0413d - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SyncBackPro (HKLM-x32\...\SyncBackPro_is1) (Version: 6.5.15.0 - 2BrightSparks)
tax 2015 (HKLM-x32\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.09.9087 - Buhl Data Service GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)
Trader Workstation (HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\5889-6375-8446-2021) (Version: stable (952.2c) 20151119 16:17:27 - Interactive Brokers LLC)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)
Winamp Advanced Controls (remove only) (HKLM-x32\...\Winamp Advanced Controls) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
Xilisoft Video Converter Ultimate (HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\Xilisoft Video Converter Ultimate) (Version: 7.7.3.20131014 - Xilisoft)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2919065167-3665529847-2276591382-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\deruser\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
25-11-2015 18:36:33 Geplanter Prüfpunkt
26-11-2015 20:39:19 Installed OpenVPN Client
28-11-2015 10:45:19 Installed Oracle VM VirtualBox 5.0.10
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2014-10-28 10:07 - 00001441 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {00F39315-C1F9-4B03-8C34-25C2637B9ECA} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core => C:\Users\deruser\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {1A3CC2E8-96C0-4BA7-83A9-9CB4D82FCC59} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core => C:\Users\deruser\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-07] (Facebook Inc.)
Task: {2617CC4C-49D0-4522-A9E8-8502644F5E01} - System32\Tasks\ATuning => C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe [2013-10-01] (ASRock Incorporation)
Task: {2797D986-93FC-4CBD-AACD-14A8973A4A69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-10] (Adobe Systems Incorporated)
Task: {27B5F8C5-C7D0-46A2-A980-6EE8942C5822} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {288D575C-E565-4E59-845C-8C7FB5A57510} - System32\Tasks\{1C00CFCE-B048-4670-90DE-0F28E5A4F5D2} => Chrome.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/abandoninstall?source=lightinstaller&page=tsMain
Task: {4D347BF2-804A-4E7F-AAF3-2BADC09EC6E0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {4FBBBE1F-D5B0-40F0-96A9-2D6DBC05ACE7} - System32\Tasks\AHK_musiccontrol => C:\_Scripts\AHK_musiccontrol.exe [2011-12-04] ()
Task: {506A642C-B710-42E0-A30E-D2F9FB1E9358} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2015-09-25] (Intel Corporation)
Task: {51FF74BE-467C-4357-A8BF-8623FD801491} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {57AA11E1-942D-45FD-AC4E-69E4D6B0DCD4} - System32\Tasks\SyncbackPro => C:\Program Files (x86)\2BrightSparks\SyncBackPro\SyncBackPro.exe [2013-11-18] (2BrightSparks Pte Ltd)
Task: {5E842495-A7DC-4960-8F02-B7B39294F17C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA => C:\Users\deruser\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)
Task: {65275B55-30E7-4FBA-8EBC-A431D4E4D1E5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {96F885B5-229A-4718-A1C8-CB11D64C30C1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA => C:\Users\deruser\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-07] (Facebook Inc.)
Task: {9C219CD2-B255-4D2C-B378-A37973D8FA81} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-09-20] (AVAST Software)
Task: {A779CBE7-B45C-4DF7-A32D-2618E6A7B624} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-11-15] (Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core.job => C:\Users\deruser\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA.job => C:\Users\deruser\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001Core.job => C:\Users\deruser\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2919065167-3665529847-2276591382-1001UA.job => C:\Users\deruser\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\vtigerCRM Email Reminder.job => C:\Program Files (x86)\vtigercrm-5.4.0\apache\htdocs\vtigerCRM\modules\Calendar\SendReminder.bat
Task: C:\Windows\Tasks\vtigerCRM Notification Scheduler.job => C:\Program Files (x86)\vtigercrm-5.4.0\apache\htdocs\vtigerCRM\cron\intimateTaskStatus.bat
Task: C:\Windows\Tasks\vtigerCRM Recurring Invoice.job => C:\Program Files (x86)\vtigercrm-5.4.0\apache\htdocs\vtigerCRM\cron\modules\SalesOrder\RecurringInvoiceCron.bat
Task: C:\Windows\Tasks\vtigerCRM WorkFlow.job => C:\Program Files (x86)\vtigercrm-5.4.0\apache\htdocs\vtigerCRM\cron\modules\com_vtiger_workflow\com_vtiger_workflow.bat
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\deruser\Desktop\Mount-N-Autostart.lnk -> C:\_Scripts\TC_Mount.bat () <==== ACHTUNG
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2014-05-13 13:40 - 2014-03-04 14:05 - 00116056 ____N () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-18 14:40 - 2013-09-22 10:36 - 00275720 ____N () C:\Program Files\Listary\ListaryService.exe
2013-11-19 14:50 - 2013-05-28 17:58 - 00454656 ____N () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe
2013-11-18 14:45 - 2009-01-12 08:15 - 00071096 ____N () C:\Windows\SysWOW64\NMSAccessU.exe
2010-08-12 17:45 - 2010-08-12 17:45 - 00024064 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 ____N () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2013-11-18 14:40 - 2013-09-22 10:36 - 00044304 ____N () C:\Program Files\Listary\ListaryHelper64.exe
2015-10-28 17:49 - 2015-07-22 21:22 - 00138752 ____N () C:\Users\deruser\AppData\Local\AudioSwitch\AudioSwitch.exe
2012-12-28 06:13 - 2012-12-28 06:13 - 00564736 ____N () C:\Program Files (x86)\Keybreeze4\Keybreeze.exe
2013-11-27 11:14 - 2013-11-27 11:14 - 00054272 ____N () C:\Program Files (x86)\_PortableSoftware\TyperTask\typertask.exe
2015-09-20 18:49 - 2015-09-20 18:49 - 00103376 ____N () C:\Program Files\AVAST Software\Avast\log.dll
2015-09-20 18:49 - 2015-09-20 18:49 - 00123976 ____N () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-11-29 11:38 - 2015-11-29 11:38 - 02996736 _____ () C:\Program Files\AVAST Software\Avast\defs\15112900\algo.dll
2009-07-05 06:35 - 2009-07-05 06:35 - 00028160 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\servicemanager.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00110592 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\pywintypes26.dll
2009-07-05 06:35 - 2009-07-05 06:35 - 00041472 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32service.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00096256 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32api.pyd
2009-10-26 09:27 - 2009-10-26 09:27 - 00153088 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\pyexpat.pyd
2009-10-26 09:25 - 2009-10-26 09:25 - 00040448 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\_socket.pyd
2009-10-26 09:25 - 2009-10-26 09:25 - 00645120 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\_ssl.pyd
2010-03-16 13:05 - 2010-03-16 13:05 - 00020480 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\zope.interface._zope_interface_coptimizations.pyd
2009-10-26 09:27 - 2009-10-26 09:27 - 00311808 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\_hashlib.pyd
2009-10-26 09:25 - 2009-10-26 09:25 - 00073728 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\_ctypes.pyd
2009-10-26 09:27 - 2009-10-26 09:27 - 00011776 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\select.pyd
2010-05-05 13:44 - 2010-05-05 13:44 - 00010752 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\OpenSSL.rand.pyd
2010-05-05 13:44 - 2010-05-05 13:44 - 00051200 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\OpenSSL.crypto.pyd
2010-05-05 13:44 - 2010-05-05 13:44 - 00039936 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\OpenSSL.SSL.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00036352 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32process.pyd
2010-05-05 13:43 - 2010-05-05 13:43 - 00008192 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\twisted.protocols._c_urlarg.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00110592 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32security.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00017920 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32event.pyd
2009-07-06 04:16 - 2009-07-06 04:16 - 00111104 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32file.pyd
2009-07-05 06:35 - 2009-07-05 06:35 - 00024064 _____ () C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\win32pipe.pyd
2013-11-18 14:40 - 2013-09-22 10:36 - 00136192 ____N () C:\Program Files\Listary\CrashRpt1401.dll
2015-11-25 17:41 - 2015-11-24 09:00 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\libglesv2.dll
2015-11-25 17:41 - 2015-11-24 09:00 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\libegl.dll
2015-09-20 18:49 - 2015-09-20 18:49 - 40539648 ____N () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 ____N () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2013-11-18 18:01 - 2013-09-03 16:52 - 01242584 ____N () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-11-29 17:21 - 2015-11-29 17:21 - 00071168 _____ () c:\users\deruser\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppz2010.dll
2015-03-04 22:45 - 2015-09-03 01:11 - 00012800 _____ () C:\Users\deruser\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 22:45 - 2015-09-03 01:11 - 00779776 _____ () C:\Users\deruser\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 15:54 - 2015-09-03 01:11 - 00056320 _____ () C:\Users\deruser\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 22:45 - 2015-09-03 01:11 - 00012288 _____ () C:\Users\deruser\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-03-16 17:12 - 2015-11-16 18:11 - 50678592 _____ () C:\Users\deruser\AppData\Roaming\Spotify\libcef.dll
2015-11-29 17:21 - 2015-11-29 17:21 - 00098816 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32api.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00110080 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\pywintypes27.dll
2015-11-29 17:21 - 2015-11-29 17:21 - 00364544 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\pythoncom27.dll
2015-11-29 17:21 - 2015-11-29 17:21 - 00046080 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_socket.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 01208320 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_ssl.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00320512 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32com.shell.shell.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00776704 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_hashlib.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 01176576 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._core_.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00806400 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._gdi_.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00816128 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._windows_.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 01067008 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._controls_.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00733184 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._misc_.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00682496 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\pysqlite2._sqlite.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00088064 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_ctypes.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00119808 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32file.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00108544 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32security.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00007168 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\hashobjs_ext.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00070144 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\usb_ext.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00167936 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32gui.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00018432 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32event.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00128512 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_elementtree.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00127488 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\pyexpat.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00013824 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\common.time34.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00036864 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_psutil_windows.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00038912 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32inet.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00011264 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32crypt.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00077312 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._html2.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00027136 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_multiprocessing.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00020480 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\_yappi.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00035840 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32process.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00686080 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\unicodedata.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00123392 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._wizard.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00024064 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32pipe.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00010240 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\select.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00025600 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32pdh.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00525640 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\windows._lib_cacheinvalidation.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00017408 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32profile.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00022528 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\win32ts.pyd
2015-11-29 17:21 - 2015-11-29 17:21 - 00078848 _____ () C:\Users\deruser\AppData\Local\Temp\_MEI72882\wx._animate.pyd
2015-03-16 17:12 - 2015-11-16 18:11 - 01880896 _____ () C:\Users\deruser\AppData\Roaming\Spotify\libglesv2.dll
2015-03-16 17:12 - 2015-11-16 18:11 - 00081216 _____ () C:\Users\deruser\AppData\Roaming\Spotify\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
AlternateDataStreams: C:\ProgramData\TEMP:6F770ABC
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\deruser\AppData\Roaming\IrfanView\IrfanView_Wallpaper.bmp
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run: => "Eraser"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "Keybreeze4"
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\StartupApproved\Run: => "BrowserChoice"
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\StartupApproved\Run: => "ConEmuDefaultTerminal"
HKU\S-1-5-21-2919065167-3665529847-2276591382-1001\...\StartupApproved\Run: => "Facebook Update"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{0EB34346-1EBF-4646-BD09-43806C00A821}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{227485B5-6813-482F-8859-F3AF7E8804D4}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{806198FE-A343-4B45-9F0C-D952FA25217F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{28481D0B-BFC7-4F0D-8E55-090D3C35B08C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{5FDAE614-98A7-4A98-930B-33DB37E49661}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{6CFF7FB1-A3EE-4FF5-BC8E-FCB535DD59EA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{2FF9557A-B655-4700-8752-AE873B11B24A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{919A1D37-79B3-4ACD-A32A-C55E09F37716}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{7404C5AD-94E2-4A75-BA46-F96EEA035BDD}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{C2E84664-E779-4C7A-98C9-BCB492ABBA13}C:\users\deruser\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\deruser\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{08504573-9FC4-4A93-A031-FFB44BD4DD6C}C:\users\deruser\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\deruser\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{195CBD78-4320-42CD-BE39-DC465CD03D6E}C:\program files (x86)\matlab\r2013b\bin\win32\smpd.exe] => (Allow) C:\program files (x86)\matlab\r2013b\bin\win32\smpd.exe
FirewallRules: [UDP Query User{8EF90DBC-647D-4B8F-AB0A-6C2A89A73829}C:\program files (x86)\matlab\r2013b\bin\win32\smpd.exe] => (Allow) C:\program files (x86)\matlab\r2013b\bin\win32\smpd.exe
FirewallRules: [TCP Query User{A9C3DE38-4E5D-4E0F-9DF6-4AD9D72DD6FB}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{BB16BA7C-681E-4B06-9A08-D6F63E6FDEA9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{AEDD1876-64AC-46CF-98CC-52215168EEEC}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{9EA1AFBE-3A88-44E1-895B-7E1EFE66097C}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{A6201FD3-AE66-4011-A96E-E604CA9A552F}] => (Block) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{8E7BF873-D67F-43BC-989C-A26D18327F75}] => (Block) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{08F29980-81CF-4472-A726-A7826DDA8EC5}] => (Block) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{BF90C41D-D899-4D68-AEAA-7654C722D1E7}] => (Block) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{910DF711-5E61-456B-8241-983255059F15}C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [UDP Query User{F7BF3CA2-39CB-4A16-953D-6A2C4EA27947}C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{81FB3406-F72E-4BE7-8D7F-45F13D90B14F}] => (Block) C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{9E8B1717-8B3D-45B7-B9C2-62E7767A988D}] => (Block) C:\users\deruser\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{B67B1384-CE89-41A6-AD79-20F9646FB3BA}] => (Allow) C:\Program Files (x86)\BitTorrent Sync\BTSync.exe
FirewallRules: [{32FF7678-FB4D-4A10-8473-2ABFEE0F9E2E}] => (Allow) C:\Program Files (x86)\BitTorrent Sync\BTSync.exe
FirewallRules: [{66C0612A-9EA6-46D7-81CF-8F5CFEAD6534}] => (Allow) LPort=51001
FirewallRules: [TCP Query User{8CBDDD1A-75F0-4DA3-81F9-78E299B361B8}C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{F0B8853E-31E1-49D5-9BE7-FB41AFEED617}C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe
FirewallRules: [{1B13A4AE-1AA4-4F7E-A48D-2FDD8B356D84}] => (Block) C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe
FirewallRules: [{27D3DD86-D199-4A9B-9027-5FF87F62FB61}] => (Block) C:\program files (x86)\_portablesoftware\skypeportable\app\skype\phone\skype.exe
FirewallRules: [{3F754B70-55F1-4AF5-BDD1-92F811F54887}] => (Allow) LPort=51001
FirewallRules: [TCP Query User{E6766E8F-53C5-4ABE-9351-45FCDD9CFD43}C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe] => (Allow) C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe
FirewallRules: [UDP Query User{20002C75-48CA-48E7-8213-EF3C3ED82172}C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe] => (Allow) C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe
FirewallRules: [{9031D8F5-9AF0-4373-89E8-B23DB2342822}] => (Block) C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe
FirewallRules: [{FCE113A8-F33B-459A-9DEE-BA0D7BA6D248}] => (Block) C:\program files (x86)\java\jdk1.7.0_51\bin\java.exe
FirewallRules: [TCP Query User{2C93E4E3-0D63-4128-961A-991FA299ECAA}C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe] => (Allow) C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe
FirewallRules: [UDP Query User{3406D778-ABAF-478C-8309-64F8A7A8B157}C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe] => (Allow) C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe
FirewallRules: [{CD0F77AC-00EB-4BC2-BABB-F9BDDE8A40CD}] => (Block) C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe
FirewallRules: [{1A00BC50-40F8-44B7-82F1-F36F907F0898}] => (Block) C:\program files (x86)\_portablesoftware\eclipse\eclipse.exe
FirewallRules: [TCP Query User{E549734E-06E7-4030-8C4F-9C3BC0CB0E4F}J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe] => (Allow) J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe
FirewallRules: [UDP Query User{F290312B-18B8-4875-9259-0381D301DA79}J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe] => (Allow) J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe
FirewallRules: [{F453063D-C7BB-4AE8-8564-0BF4C58761F1}] => (Block) J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe
FirewallRules: [{E7047C53-C3D2-4154-BC97-25EB753EEE73}] => (Block) J:\_miscsoftware\matlab2014a\bin\win32\smpd.exe
FirewallRules: [{3CB0ED82-2E9C-414B-81A8-82C1E2D4A865}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{44D15906-3136-4955-BB2F-6E1CDFA5731A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{C7BC498F-A000-4221-9F1D-775655E098E4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{F66C1F3E-478C-48E6-B379-01AD999C0DA2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{C848F117-6F17-4353-811D-D5C2DE7CDADF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CF523646-6E13-4C8F-A446-4D6D66803178}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{B93BAC0B-A0FA-45F9-9ADF-000B0639493E}C:\users\deruser\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\deruser\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{FE74DD89-E9C1-4387-BFFC-7398CD269006}C:\users\deruser\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\deruser\appdata\roaming\spotify\spotify.exe
FirewallRules: [{95EF6027-03C7-495B-A399-00F4890FADBD}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [TCP Query User{306A86D7-0A6F-4345-AA4C-A67836B30B48}C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe] => (Allow) C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe
FirewallRules: [UDP Query User{7D752F6A-BB8F-4F81-92AF-1E113EAC49DD}C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe] => (Allow) C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe
FirewallRules: [{8A07F02E-16B4-4C7D-BC4F-BBBEFE8FFA10}] => (Block) C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe
FirewallRules: [{ADE3389F-7683-4D38-A850-BACE9CB5B11B}] => (Block) C:\program files (x86)\vtigercrm-5.4.0\apache\bin\apache.exe
FirewallRules: [{77060AC5-8989-49F8-8623-16615A0DDC71}] => (Allow) C:\Users\deruser\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{0D166F27-9B6E-465D-845A-139B76E5D80E}] => (Allow) C:\Users\deruser\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E32E08D7-648F-4686-891C-6C5A66695047}] => (Allow) C:\Users\deruser\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{43B437FF-0DE1-45F0-BE80-2948BD89F92B}C:\users\deruser\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\deruser\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{0F4EDB56-6807-4BB8-902D-F34B8D6B10E1}C:\users\deruser\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\deruser\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{F331F683-1803-477E-A9E8-450914BA7044}] => (Allow) J:\EaseUS Data Recovery Wizard\DRWUI.exe
FirewallRules: [{06E4ECEF-4993-4C2F-B2EE-B1B034BAC51A}] => (Allow) J:\EaseUS Data Recovery Wizard\DRWUI.exe
FirewallRules: [{BA4BDFB2-F8D9-436C-B7F8-D09747516715}] => (Block) J:\EaseUS Data Recovery Wizard\DRWUI.exe
FirewallRules: [{D8396E4A-36AD-4240-91FD-B8FCA517576B}] => (Block) J:\EaseUS Data Recovery Wizard2\DRWUI.exe
FirewallRules: [{D8F7AD4C-C787-498C-8266-AAB45980E59A}] => (Block) J:\EaseUS Data Recovery Wizard2\DRW.exe
FirewallRules: [{6ECD98EA-78A3-4E86-8447-D6FCF5DD17E5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6EBE602F-2396-412A-A41C-8B37AEB67FFE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{5012D5FB-43F5-4E93-AD81-B83CDFD31BA6}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{75916B77-22E4-44E9-B73F-07ADA8B9AA0E}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{40715BD1-DD12-4BC5-A4A3-FCE171D7346F}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{E58D7D55-2C60-4A38-A2AE-592FC1F76AD8}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{370C5F0A-A8F0-4B62-81D6-D31CD9E47D01}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{9EAFDF80-ABC5-4E98-8684-394398123A4F}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{F4266D9D-8C2E-4DD0-B829-FE586AFE8EF5}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7778A42D-19E8-43AD-A730-7A04F7598D5E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{241E9447-E526-41B9-B3A9-E3DFB2CD46A0}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{B3CAA0CD-1FF5-4B5F-8EC0-BD64235904E6}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{900D59DE-5A97-4542-80F5-7ABD1C39C06B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F2A4C9AE-27E5-4506-B86A-9B5EB90E54A1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{4A83948A-DC1C-4836-B2B1-EAEFE23AA720}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1BB1FB3F-6992-40F7-81F5-3664C331D14E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{3CBE00B2-F5D1-46DF-A048-37B789A9CA32}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{C97B0C25-5FE6-4178-94E0-DDD0741B83AC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{AED8F5EE-A1B3-4AD3-9448-DC05E5861965}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Intel(R) Ethernet Connection I217-V
Description: Intel(R) Ethernet Connection I217-V
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: e1dexpress
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/29/2015 05:58:47 PM) (Source: VSS) (EventID: 12293) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen einer Routine auf einem Volumeschattenkopieanbieter "{b5946137-7b9f-4925-af80-51abd60b20d5}" ist ein Fehler aufgetreten. Routinedetails Cannot ask provider {b5946137-7b9f-4925-af80-51abd60b20d5} if volume is supported. [0x8000ffff] [hr = 0x8000ffff, Schwerwiegender Fehler
].
Vorgang:
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Volume einem Schattenkopiesatz hinzufügen
Kontext:
Ausführungskontext: Coordinator
Anbieter-ID: {00000000-0000-0000-0000-000000000000}
Volumename: \\?\Volume{9817d904-505f-11e3-9bf7-0019e0144132}\
Ausführungskontext: Coordinator
Error: (11/29/2015 04:18:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvstreamsvc.exe, Version: 1.7.321.0, Zeitstempel: 0x52f17b5b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18007, Zeitstempel: 0x55c4c16b
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec4e0
ID des fehlerhaften Prozesses: 0x117a8
Startzeit der fehlerhaften Anwendung: 0xnvstreamsvc.exe0
Pfad der fehlerhaften Anwendung: nvstreamsvc.exe1
Pfad des fehlerhaften Moduls: nvstreamsvc.exe2
Berichtskennung: nvstreamsvc.exe3
Vollständiger Name des fehlerhaften Pakets: nvstreamsvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvstreamsvc.exe5
Error: (11/29/2015 04:18:46 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Error: (11/29/2015 04:18:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvstreamsvc.exe, Version: 1.7.321.0, Zeitstempel: 0x52f17b5b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18007, Zeitstempel: 0x55c4c16b
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec4e0
ID des fehlerhaften Prozesses: 0x1378
Startzeit der fehlerhaften Anwendung: 0xnvstreamsvc.exe0
Pfad der fehlerhaften Anwendung: nvstreamsvc.exe1
Pfad des fehlerhaften Moduls: nvstreamsvc.exe2
Berichtskennung: nvstreamsvc.exe3
Vollständiger Name des fehlerhaften Pakets: nvstreamsvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvstreamsvc.exe5
Error: (11/29/2015 04:18:41 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Error: (11/29/2015 04:18:35 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Error: (11/29/2015 04:18:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvstreamsvc.exe, Version: 1.7.321.0, Zeitstempel: 0x52f17b5b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18007, Zeitstempel: 0x55c4c16b
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec4e0
ID des fehlerhaften Prozesses: 0x12214
Startzeit der fehlerhaften Anwendung: 0xnvstreamsvc.exe0
Pfad der fehlerhaften Anwendung: nvstreamsvc.exe1
Pfad des fehlerhaften Moduls: nvstreamsvc.exe2
Berichtskennung: nvstreamsvc.exe3
Vollständiger Name des fehlerhaften Pakets: nvstreamsvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvstreamsvc.exe5
Error: (11/29/2015 04:18:30 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Error: (11/29/2015 04:18:25 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Error: (11/29/2015 04:18:20 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to kill already running streamer. [5]
Systemfehler:
=============
Error: (11/29/2015 04:19:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "vtigercrmMysql540" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/29/2015 04:19:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "vtigercrmApache540" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/29/2015 04:19:37 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 28.11.2015 um 10:49:04 unerwartet heruntergefahren.
Error: (11/29/2015 04:18:34 PM) (Source: DCOM) (EventID: 10010) (User: bsPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (11/29/2015 11:21:58 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde mit folgendem Fehler beendet:
%%2
Error: (11/29/2015 11:21:58 AM) (Source: RasMan) (EventID: 20030) (User: )
Description: Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da mindestens eine DLL für die Kommunikation nicht geladen werden konnte. Stellen Sie sicher, dass die Kommunikationshardware installiert ist, und starten Sie dann die RAS-Verbindungsverwaltung neu. Falls das Problem weiterhin besteht, wenden Sie sich an den Systemadministrator neu. Das System kann die angegebene Datei nicht finden.
Error: (11/29/2015 11:19:55 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde mit folgendem Fehler beendet:
%%2
Error: (11/29/2015 11:19:55 AM) (Source: RasMan) (EventID: 20030) (User: )
Description: Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da mindestens eine DLL für die Kommunikation nicht geladen werden konnte. Stellen Sie sicher, dass die Kommunikationshardware installiert ist, und starten Sie dann die RAS-Verbindungsverwaltung neu. Falls das Problem weiterhin besteht, wenden Sie sich an den Systemadministrator neu. Das System kann die angegebene Datei nicht finden.
Error: (11/29/2015 11:17:53 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde mit folgendem Fehler beendet:
%%2
Error: (11/29/2015 11:17:53 AM) (Source: RasMan) (EventID: 20030) (User: )
Description: Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da mindestens eine DLL für die Kommunikation nicht geladen werden konnte. Stellen Sie sicher, dass die Kommunikationshardware installiert ist, und starten Sie dann die RAS-Verbindungsverwaltung neu. Falls das Problem weiterhin besteht, wenden Sie sich an den Systemadministrator neu. Das System kann die angegebene Datei nicht finden.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
Prozentuale Nutzung des RAM: 22%
Installierter physikalischer RAM: 16314.5 MB
Verfügbarer physikalischer RAM: 12573.29 MB
Summe virtueller Speicher: 18746.5 MB
Verfügbarer virtueller Speicher: 14334.64 MB
==================== Laufwerke ================================
Drive c: (System) (Fixed) (Total:119.24 GB) (Free:22.25 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive j: (1TB) (Fixed) (Total:931.51 GB) (Free:190.37 GB) NTFS
Drive s: (EncFS) (Fixed) (Total:931.51 GB) (Free:190.37 GB) FAT32
Drive z: (1TB_Backup) (Fixed) (Total:931.51 GB) (Free:192.79 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 00014D7E)
Partition 1: (Active) - (Size=119.2 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: CC183A9C)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 16341DCC)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
MBAR: Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2015.11.29.04
rootkit: v2015.11.26.01
Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.18098
deruser :: BSPC [administrator]
29.11.2015 19:38:27
mbar-log-2015-11-29 (19-38-27).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 542599
Time elapsed: 9 minute(s), 19 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
AdwCleaner: Code:
# AdwCleaner v5.022 - Bericht erstellt am 29/11/2015 um 20:00:34
# Aktualisiert am 22/11/2015 von Xplode
# Datenbank : 2015-11-29.2 [Server]
# Betriebssystem : Windows 8.1 Pro N (x64)
# Benutzername : deruser - BSPC
# Gestartet von : C:\Users\deruser\Desktop\AdwCleaner_5.022.exe
# Option : Suchlauf
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
Ordner Gefunden : C:\ProgramData\apn <<<<< hxxp://www.file.net/prozess/apnstub.exe.html sieht ok aus!?
Ordner Gefunden : C:\Users\deruser\AppData\Local\PackageAware
Ordner Gefunden : C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg <<< Edit this Cookie Extension, auch unten gelistet, sieht ok aus...?
Ordner Gefunden : C:\Users\deruser\AppData\Roaming\.acestream
***** [ Dateien ] *****
Datei Gefunden : C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fngmhnnpilhplaeedifhccceomclgfbg_0.localstorage
Datei Gefunden : C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage
***** [ DLL ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKLM\SOFTWARE\InstallIQ <<< hxxp://www.computerbase.de/forum/showthread.php?t=1358566 sieht ok aus oder??
***** [ Internetbrowser ] *****
[C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : ehoopddfhgaehhmphfcooacjdpmbjlao
[C:\Users\deruser\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : fngmhnnpilhplaeedifhccceomclgfbg
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1535 Bytes] ##########
|
Hinweis: 
