| elbshots | 16.05.2016 18:26 |
Moin, sorry, dass ich mich erst wieder so spät melde, war außer landes.
Hier die Logs;
Gruß Jerome
(Eset habe ich vergessen zu löschen, schlimm für das Ergebnis?)
ESET: Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=8f8c7632e3223c4e9a9c076a2435269b
# end=init
# utc_time=2016-05-16 04:41:40
# local_time=2016-05-16 06:41:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 29489
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=8f8c7632e3223c4e9a9c076a2435269b
# end=updated
# utc_time=2016-05-16 04:49:22
# local_time=2016-05-16 06:49:22 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=8f8c7632e3223c4e9a9c076a2435269b
# engine=29489
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-05-16 05:18:27
# local_time=2016-05-16 07:18:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 1469100 17233250 0 0
# compatibility_mode_1='ESET Smart Security 9.0'
# compatibility_mode=8232 16777213 100 100 1618496 7263273 0 0
# scanned=228119
# found=10
# cleaned=0
# scan_time=1744
sh=4E8EF58F219192357241A8812C79D9C5065CABAF ft=1 fh=47dc20ee8e09f2f7 vn="Variante von Win32/Obfuscated.NGB Trojaner" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\Dravsynlether\Drvcoresrv.exe.vir"
sh=482F3C79FEB515872E51D7EF987918965D76A892 ft=1 fh=8f1f457ac83ce7a7 vn="Variante von Win32/Obfuscated.NGB Trojaner" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\Dravsynlether\Drvcoretsk.exe.vir"
sh=1FE26778774B8EC2939906182A4DFA963DE2F823 ft=1 fh=dbc3c1b7d6244840 vn="Variante von Win32/Obfuscated.NGF Trojaner" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\hohobnd\CCeuter.exe.vir"
sh=033FA9662C4389E897907BD7176853E68BE49587 ft=1 fh=9bd6f180d26a1b86 vn="Variante von Win32/Obfuscated.NGC Trojaner" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\hohobnd\cloguing.exe.vir"
sh=0ED84FCECCC5CBAA3DF6858319CE53D1B4529E84 ft=1 fh=3c89aa79fc2dbe4d vn="Variante von Win32/SpeedBit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jerome Pohlmann\AppData\Local\Temp\San56ED.tmp"
sh=568D59700912601E56EF500171569C1E25E32109 ft=1 fh=dde0eb9ea596d805 vn="Variante von Win32/SpeedBit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jerome Pohlmann\AppData\Local\Temp\Set56E7.tmp"
sh=568D59700912601E56EF500171569C1E25E32109 ft=1 fh=dde0eb9ea596d805 vn="Variante von Win32/SpeedBit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jerome Pohlmann\AppData\Local\Temp\SetECA.tmp"
sh=A8FCD0056B409671AE86EC19AC12BADB5E53D7DC ft=1 fh=c1c583e69e4440e5 vn="Variante von Win32/SpeedBit.AH evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jerome Pohlmann\AppData\Local\Temp\C487G9NNO\C487G9NNO.exe"
sh=F679F9CF95C7ABEEA0FEA1B1C1AFA1076E2B2F79 ft=0 fh=0000000000000000 vn="Android/Exploit.Towel.A Trojaner" ac=I fn="C:\Users\Jerome Pohlmann\Desktop\adbfw128\tr.apk"
sh=1ACEE04B1635DC01C996792674EDE6037EA9891A ft=1 fh=0d2e1357ad98f82e vn="Variante von Win32/SpeedBit.AH evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\bi2.exe"
FRST: Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:16-05-2016
durchgeführt von Jerome Pohlmann (Administrator) auf JEROMELT (16-05-2016 19:23:47)
Gestartet von C:\Users\Jerome Pohlmann\Desktop
Geladene Profile: Jerome Pohlmann (Verfügbare Profile: Jerome Pohlmann & Pia)
Platform: Windows 10 Home Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Intel) C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google, Inc) C:\Users\Jerome Pohlmann\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe
(Deutsche Telekom AG) C:\Program Files\Deutsche Telekom AG\Online Manager\Online Manager.exe
() C:\Windows\SysWOW64\UMonit64.exe
(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.19761.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.168_none_76587b40265ca57e\TiWorker.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [920280 2015-04-17] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585744 2015-01-16] (NVIDIA Corporation)
HKLM-x32\...\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3207680 2015-05-20] (GoPro)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Run: [Spotify Web Helper] => C:\Users\Jerome Pohlmann\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1524336 2016-04-29] (Spotify Ltd)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23484296 2016-04-25] (Google)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Run: [Google Update] => C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-11-06] (Google Inc.)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Run: [Google Photos Backup] => C:\Users\Jerome Pohlmann\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe [3790936 2016-04-09] (Google, Inc)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Run: [GoogleChromeAutoLaunch_81866A5FF31D411FC2B81FAF4933DAFF] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [874648 2016-04-06] (Google Inc.)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\RunOnce: [Uninstall C:\Users\Jerome Pohlmann\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Jerome Pohlmann\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\RunOnce: [Uninstall C:\Users\Jerome Pohlmann\AppData\Local\Microsoft\OneDrive\17.3.5892.0626] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Jerome Pohlmann\AppData\Local\Microsoft\OneDrive\17.3.5892.0626"
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-04-25] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-04-25] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-04-25] (Google)
Startup: C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Manager.lnk [2016-04-30]
ShortcutTarget: Online Manager.lnk -> C:\Program Files\Deutsche Telekom AG\Online Manager\Online Manager.exe (Deutsche Telekom AG)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{27ca4822-3eb8-4788-b842-dbdb0ab5751d}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{40b64713-d284-41ce-a8bf-c69c3013a18b}: [DhcpNameServer] 192.168.44.1
ManualProxies:
Internet Explorer:
==================
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com/?pc=ASJB
SearchScopes: HKLM-x32 -> DefaultScope Wert fehlt
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-01-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1875599853-1810634468-1048324862-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1875599853-1810634468-1048324862-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-16] (Google Inc.)
Chrome:
=======
CHR HomePage: Default -> hxxp://www-searching.com/?pid=s&s=g4rzbwybl01ao,d5f7021c-eb2c-4b61-b1ab-cfe73b6cedad,&vp=ch&prd=set_ch
CHR StartupUrls: Default -> "hxxp://www-searching.com/?pid=s&s=g4rzbwybl01ao,d5f7021c-eb2c-4b61-b1ab-cfe73b6cedad,&vp=ch&prd=set_ch"
CHR Session Restore: Default -> ist aktiviert.
CHR Profile: C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-04-28]
CHR Extension: (Google Docs) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-28]
CHR Extension: (Google Drive) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-28]
CHR Extension: (YouTube) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-28]
CHR Extension: (Google Kalender) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2016-04-28]
CHR Extension: (Google Tabellen) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-04-28]
CHR Extension: (Plex) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpniocchabmgenibceglhnfeimmdhdfm [2016-04-28]
CHR Extension: (Google Docs Offline) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-28]
CHR Extension: (Google Notizen – Notizen & Listen) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2016-05-16]
CHR Extension: (Google*Hangouts) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2016-05-16]
CHR Extension: (Skype) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2016-05-16]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-04-28]
CHR Extension: (Google Maps) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2016-04-28]
CHR Extension: (Google Zeichnungen) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkaakpdehdafacodkgkpghoibnmamcme [2016-04-28]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-28]
CHR Extension: (Picasa) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2016-04-28]
CHR Extension: (Google Mail) - C:\Users\Jerome Pohlmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-28]
CHR HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2519904 2016-04-13] (ESET)
R2 esifsvc; C:\Windows\SysWOW64\esif_uf.exe [1037568 2015-02-03] (Intel Corporation)
S2 ibtsiva; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [125168 2014-12-12] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373160 2016-01-09] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
R2 IntelUSBoverIP; C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe [395744 2015-01-14] (Intel)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2015-01-06] (Intel Corporation)
R2 Online Manager Service; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\OnlineManager_Service.exe [3034112 2015-11-15] (Deutsche Telekom AG) [Datei ist nicht signiert]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
S2 Ceouza; "C:\Users\Jerome Pohlmann\AppData\Roaming\PygegeSoz\Rokgej.exe" -cms [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [98296 2015-12-14] (ASUS Corporation)
S3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [165376 2015-10-30] (Microsoft Corporation)
S3 BthHFAud; C:\Windows\system32\DRIVERS\BthHfAud.sys [36864 2015-10-30] (Microsoft Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2015-02-03] (Intel Corporation)
R3 dptf_pch; C:\Windows\System32\drivers\dptf_pch.sys [38208 2015-02-03] (Intel Corporation)
R3 DroidCam; C:\Windows\system32\DRIVERS\droidcam.sys [33592 2015-06-21] (Dev47Apps)
R3 DroidCamVideo; C:\Windows\system32\DRIVERS\droidcamvideo.sys [230712 2015-06-21] (Windows (R) Win 7 DDK provider)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [264552 2016-04-13] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [199680 2016-04-13] (ESET)
S0 eelam; C:\Windows\System32\DRIVERS\eelam.sys [14976 2016-04-13] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [186784 2016-04-13] (ESET)
R2 ekbdflt; C:\Windows\system32\DRIVERS\ekbdflt.sys [142976 2016-04-13] (ESET)
R1 epfw; C:\Windows\system32\DRIVERS\epfw.sys [198096 2016-04-13] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [53384 2016-04-13] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [84800 2016-04-13] (ESET)
R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216904 2015-02-03] (Intel Corporation)
S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [110824 2014-06-11] (GenesysLogic)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [266512 2015-07-16] (Intel Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-10-16] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2015-01-06] (Intel Corporation)
R3 NETwNb64; C:\Windows\System32\drivers\Netwbw02.sys [3495704 2015-03-02] (Intel Corporation)
R3 SensorsAlsDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [216064 2015-10-30] (Microsoft Corporation)
S3 TelekomNM6; C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [212056 2015-01-14] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-16 18:41 - 2016-05-16 18:41 - 02870984 _____ (ESET) C:\Users\Jerome Pohlmann\Downloads\esetsmartinstaller_deu.exe
2016-05-16 18:41 - 2016-05-16 18:41 - 00000000 ____D C:\Program Files (x86)\ESET
2016-04-30 23:07 - 2016-05-16 19:23 - 00000000 ____D C:\Users\Jerome Pohlmann\Desktop\FRST-OlderVersion
2016-04-30 22:59 - 2016-04-30 23:00 - 03581504 _____ C:\Users\Jerome Pohlmann\Desktop\AdwCleaner_5.114 (1).exe
2016-04-30 22:55 - 2016-04-30 22:55 - 00001204 _____ C:\Users\Jerome Pohlmann\Desktop\mbam.txt
2016-04-30 22:39 - 2016-04-30 22:57 - 00001171 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-30 22:39 - 2016-04-30 22:56 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-04-30 22:39 - 2016-04-30 22:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-04-30 22:39 - 2016-04-30 22:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-30 22:39 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-04-30 22:39 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-04-30 22:39 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-04-30 22:37 - 2016-04-30 22:38 - 22851472 _____ (Malwarebytes ) C:\Users\Jerome Pohlmann\Desktop\mbam-setup-2.2.1.1043.exe
2016-04-30 00:17 - 2016-04-30 23:08 - 00044477 _____ C:\Users\Jerome Pohlmann\Desktop\Addition.txt
2016-04-30 00:16 - 2016-05-16 19:23 - 00021193 _____ C:\Users\Jerome Pohlmann\Desktop\FRST.txt
2016-04-29 23:59 - 2016-05-16 19:23 - 00000000 ____D C:\FRST
2016-04-29 23:58 - 2016-05-16 19:23 - 02382336 _____ (Farbar) C:\Users\Jerome Pohlmann\Desktop\FRST64.exe
2016-04-28 21:40 - 2016-04-28 21:40 - 00013249 _____ C:\Users\Jerome Pohlmann\Desktop\esetlog.txt
2016-04-28 01:39 - 2016-04-28 01:39 - 03013280 _____ (ESET) C:\Users\Jerome Pohlmann\Downloads\eset_smart_security_live_installer_ (1).exe
2016-04-28 01:37 - 2016-04-28 01:37 - 03581504 _____ C:\Users\Jerome Pohlmann\Downloads\adwcleaner_5.114.exe
2016-04-28 01:17 - 2016-04-30 23:02 - 00000000 ____D C:\AdwCleaner
2016-04-28 01:05 - 2016-04-28 01:05 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\ESET
2016-04-28 01:04 - 2016-04-28 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2016-04-28 01:04 - 2016-04-28 01:04 - 00000000 ____D C:\ProgramData\ESET
2016-04-28 01:04 - 2016-04-28 01:04 - 00000000 ____D C:\Program Files\ESET
2016-04-28 01:03 - 2016-04-28 01:04 - 03013280 _____ (ESET) C:\Users\Jerome Pohlmann\Downloads\eset_smart_security_live_installer_.exe
2016-04-28 00:44 - 2016-04-28 00:44 - 00000000 ____D C:\WINDOWS\system32\syn
2016-04-28 00:42 - 2016-04-28 00:40 - 00001552 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2016-04-28 00:39 - 2016-04-28 02:14 - 00187904 _____ C:\WINDOWS\rsrcs.dll
2016-04-28 00:39 - 2016-04-28 00:42 - 00000000 ____D C:\WINDOWS\system32\SSL
2016-04-28 00:37 - 2015-10-09 12:04 - 00020872 _____ (Phoenix Technologies) C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS
2016-04-28 00:36 - 2016-04-28 00:36 - 06494208 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\agent.dat
2016-04-28 00:36 - 2016-04-28 00:36 - 01626777 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Lightsoft.tst
2016-04-28 00:36 - 2016-04-28 00:36 - 00072717 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Daltfresh.tst
2016-04-28 00:36 - 2016-04-28 00:36 - 00018432 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Main.dat
2016-04-28 00:35 - 2016-04-28 01:11 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\Jiojcu
2016-04-28 00:35 - 2016-04-28 00:35 - 00127488 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Installer.dat
2016-04-28 00:34 - 2016-04-28 00:35 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\Tempfolder
2016-04-28 00:34 - 2016-04-28 00:34 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-04-28 00:34 - 2016-04-28 00:34 - 00000000 ____D C:\uninst
2016-04-27 22:34 - 2016-04-28 23:15 - 00000000 ____D C:\ProgramData\POIbase
2016-04-27 22:34 - 2016-04-27 22:38 - 00000000 ____D C:\Program Files (x86)\POIbase
2016-04-27 22:34 - 2016-04-27 22:34 - 24626224 _____ ( ) C:\Users\Jerome Pohlmann\Downloads\poibase_setup_poibase.exe
2016-04-27 22:34 - 2016-04-27 22:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\POIbase
2016-04-27 22:20 - 2016-04-27 22:20 - 49940536 _____ C:\Users\Jerome Pohlmann\Downloads\furgoperfectos.pdf
2016-04-27 22:15 - 2016-04-27 22:15 - 00294771 _____ C:\Users\Jerome Pohlmann\Downloads\navigator_lpg.zip
2016-04-27 22:10 - 2016-04-27 22:10 - 00100089 _____ C:\Users\Jerome Pohlmann\Downloads\Furgoperfectos_v2015_Tomtom.zip
2016-04-27 21:42 - 2016-04-28 00:36 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\Mozilla
2016-04-27 21:42 - 2016-04-27 21:42 - 00000000 ____D C:\Users\Jerome Pohlmann\Documents\TomTom
2016-04-27 21:42 - 2016-04-27 21:42 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\TomTom
2016-04-27 21:42 - 2016-04-27 21:42 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\TomTom
2016-04-27 21:42 - 2016-04-27 21:42 - 00000000 ____D C:\ProgramData\TomTom
2016-04-27 21:41 - 2016-04-27 21:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2016-04-27 21:41 - 2016-04-27 21:41 - 00000000 ____D C:\Program Files (x86)\TomTom International B.V
2016-04-27 21:41 - 2016-04-27 21:41 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2
2016-04-27 21:40 - 2016-04-27 21:40 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\Downloaded Installations
2016-04-27 21:38 - 2016-04-27 21:40 - 31109864 _____ C:\Users\Jerome Pohlmann\Downloads\TomTomHOME2winlatest.exe
2016-04-27 09:53 - 2016-04-27 09:53 - 00460288 _____ C:\WINDOWS\system32\bi2.exe
2016-04-25 20:41 - 2016-04-25 20:41 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\LocalLow\Temp
2016-04-18 20:05 - 2016-04-18 20:05 - 00000000 ____D C:\Users\Pia\AppData\Local\Comms
2016-04-18 19:50 - 2016-04-18 19:50 - 00000000 ____D C:\Users\Pia\AppData\Local\ActiveSync
2016-04-18 19:49 - 2016-04-18 19:49 - 00002394 _____ C:\Users\Pia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-18 19:49 - 2016-04-18 19:49 - 00000000 ___RD C:\Users\Pia\OneDrive
2016-04-18 19:49 - 2016-04-18 19:49 - 00000000 ____D C:\Users\Pia\AppData\Local\Conexant
2016-04-18 19:48 - 2016-04-28 01:29 - 00001361 _____ C:\Users\Pia\Desktop\Google Chrome.lnk
2016-04-18 19:48 - 2016-04-24 20:09 - 00000000 ____D C:\Users\Pia\AppData\Local\Packages
2016-04-18 19:48 - 2016-04-24 19:49 - 00000165 _____ C:\Users\Pia\AppData\Roaming\sp_data.sys
2016-04-18 19:48 - 2016-04-24 19:40 - 00000000 __SHD C:\Users\Pia\IntelGraphicsProfiles
2016-04-18 19:48 - 2016-04-19 18:13 - 00000000 ____D C:\Users\Pia\AppData\Local\Google
2016-04-18 19:48 - 2016-04-18 19:49 - 00000000 ____D C:\Users\Pia
2016-04-18 19:48 - 2016-04-18 19:48 - 00000020 ___SH C:\Users\Pia\ntuser.ini
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Vorlagen
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Startmenü
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Netzwerkumgebung
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Lokale Einstellungen
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Eigene Dateien
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Druckumgebung
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Documents\Eigene Videos
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Documents\Eigene Musik
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Documents\Eigene Bilder
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\AppData\Local\Verlauf
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\AppData\Local\Anwendungsdaten
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 _SHDL C:\Users\Pia\Anwendungsdaten
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 ____D C:\Users\Pia\AppData\Roaming\Adobe
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 ____D C:\Users\Pia\AppData\Local\VirtualStore
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 ____D C:\Users\Pia\AppData\Local\TileDataLayer
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 ____D C:\Users\Pia\AppData\Local\Publishers
2016-04-18 19:48 - 2016-04-18 19:48 - 00000000 ____D C:\Users\Pia\AppData\Local\NVIDIA
2016-04-17 12:00 - 2016-04-19 18:56 - 00000000 ____D C:\Users\Jerome Pohlmann\Desktop\Photos (1)
2016-04-17 10:08 - 2016-04-17 10:09 - 09018660 _____ C:\Users\Jerome Pohlmann\Downloads\52aa9b025389513 (2).mp4
2016-04-17 09:59 - 2016-04-17 10:02 - 26713742 _____ C:\Users\Jerome Pohlmann\Downloads\52aa9b025389513.mp4
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-16 19:23 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-16 19:23 - 2015-06-16 02:16 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-16 19:18 - 2015-06-16 02:16 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-16 18:57 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-05-16 18:56 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-16 18:53 - 2015-06-10 21:06 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\Packages
2016-05-16 18:48 - 2015-06-10 13:10 - 00002266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-16 18:48 - 2015-06-10 13:09 - 00001136 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-16 18:46 - 2015-11-06 12:23 - 00001178 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001UA.job
2016-05-16 18:46 - 2015-11-06 12:23 - 00001126 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001Core.job
2016-05-16 18:46 - 2015-06-10 13:09 - 00001132 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-16 18:43 - 2015-06-10 13:25 - 00003544 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update1
2016-05-16 18:43 - 2015-06-10 13:25 - 00003534 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update2
2016-05-16 18:41 - 2015-11-06 12:23 - 00004316 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001UA
2016-05-16 18:41 - 2015-11-06 12:23 - 00003940 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001Core
2016-05-16 18:41 - 2015-06-10 13:09 - 00004194 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-16 18:41 - 2015-06-10 13:09 - 00003962 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-16 18:40 - 2016-02-25 13:16 - 00000000 ____D C:\ProgramData\ASUS Smart Gesture
2016-05-16 18:40 - 2016-01-09 13:38 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-05-16 18:40 - 2015-06-15 13:04 - 00000000 ___RD C:\Users\Jerome Pohlmann\Google Drive
2016-05-16 18:40 - 2015-06-10 21:06 - 00000165 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\sp_data.sys
2016-05-16 18:40 - 2015-06-10 21:06 - 00000000 __SHD C:\Users\Jerome Pohlmann\IntelGraphicsProfiles
2016-05-11 21:57 - 2015-10-30 09:26 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 21:57 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-04-30 23:10 - 2015-10-30 20:35 - 00778202 _____ C:\WINDOWS\system32\perfh007.dat
2016-04-30 23:10 - 2015-10-30 20:35 - 00155964 _____ C:\WINDOWS\system32\perfc007.dat
2016-04-30 23:10 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-04-30 23:10 - 2015-10-25 19:35 - 01799166 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-30 23:03 - 2016-01-09 13:43 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-04-30 23:03 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-04-30 22:57 - 2016-01-26 21:06 - 00001374 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Online Manager.lnk
2016-04-30 22:57 - 2016-01-26 21:06 - 00001362 _____ C:\Users\Public\Desktop\Online Manager.lnk
2016-04-30 22:57 - 2016-01-09 14:12 - 00001296 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intel WiDi Toast.lnk
2016-04-30 22:57 - 2016-01-09 13:42 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-04-30 22:57 - 2016-01-09 13:39 - 00001963 _____ C:\ProgramData\Microsoft\Windows\Start Menu\SmartAudio.lnk
2016-04-30 22:57 - 2015-11-27 11:37 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-04-30 22:57 - 2015-10-25 20:01 - 00002459 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-30 22:57 - 2015-08-27 22:53 - 00000295 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb.lnk
2016-04-30 22:57 - 2015-06-18 15:01 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-04-30 22:57 - 2015-06-15 11:46 - 00001851 _____ C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2016-04-30 22:57 - 2015-05-04 13:53 - 00000724 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) HD Graphics Control Panel.lnk
2016-04-30 22:57 - 2014-10-29 08:19 - 00002002 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-04-30 22:56 - 2015-10-30 09:26 - 00000000 ____D C:\WINDOWS\Setup
2016-04-30 22:54 - 2015-06-10 13:11 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps
2016-04-30 00:15 - 2015-06-15 20:40 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\vlc
2016-04-29 00:11 - 2015-06-15 11:46 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\Spotify
2016-04-29 00:10 - 2015-06-10 14:06 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Roaming\Spotify
2016-04-28 23:37 - 2016-01-09 13:40 - 00000000 ____D C:\Users\Jerome Pohlmann
2016-04-28 23:37 - 2015-10-29 00:34 - 00011960 _____ C:\Users\Jerome Pohlmann\Desktop\tarifrechnung.ods
2016-04-28 23:37 - 2015-06-15 12:02 - 00000000 ____D C:\Users\Jerome Pohlmann\Desktop\Programme
2016-04-28 23:35 - 2015-12-20 16:30 - 00000000 ____D C:\Users\Jerome Pohlmann\Desktop\Pia
2016-04-28 01:29 - 2015-06-21 13:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AirDroid
2016-04-28 01:05 - 2015-10-30 09:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2016-04-28 00:36 - 2013-08-22 15:25 - 00000226 _____ C:\WINDOWS\win.ini
2016-04-27 22:52 - 2015-10-25 17:42 - 00000000 ____D C:\Users\Jerome Pohlmann\AppData\Local\JDownloader v2.0
2016-04-27 21:30 - 2015-12-22 23:31 - 00000000 ____D C:\Users\Jerome Pohlmann\jDownloader
2016-04-27 20:41 - 2015-06-15 13:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-04-22 09:57 - 2015-06-15 11:57 - 00453288 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-04-19 18:17 - 2016-04-11 21:50 - 00000023 _____ C:\WINDOWS\ODBCINST.INI
2016-04-18 19:48 - 2015-09-10 07:37 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-04-17 08:19 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\rescache
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2016-04-28 00:36 - 2016-04-28 00:36 - 6494208 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\agent.dat
2016-04-28 00:36 - 2016-04-28 00:36 - 0072717 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\Daltfresh.tst
2016-04-28 00:35 - 2016-04-28 00:35 - 0127488 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\Installer.dat
2016-04-28 00:36 - 2016-04-28 00:36 - 1626777 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\Lightsoft.tst
2016-04-28 00:36 - 2016-04-28 00:36 - 0018432 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\Main.dat
2015-06-10 21:06 - 2016-05-16 18:40 - 0000165 _____ () C:\Users\Jerome Pohlmann\AppData\Roaming\sp_data.sys
2015-06-25 00:45 - 2015-06-25 00:45 - 0002831 _____ () C:\Users\Jerome Pohlmann\AppData\Local\recently-used.xbel
2015-07-10 00:44 - 2015-07-20 23:19 - 0007647 _____ () C:\Users\Jerome Pohlmann\AppData\Local\Resmon.ResmonCfg
2015-06-21 14:00 - 2016-01-16 15:04 - 0000036 _____ () C:\ProgramData\droidcam-settings
2014-10-29 08:25 - 2012-09-07 13:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-10-29 08:25 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-10-29 08:25 - 2012-09-07 13:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS
Einige Dateien in TEMP:
====================
C:\Users\Jerome Pohlmann\AppData\Local\Temp\e07XKi6YRX.exe
C:\Users\Jerome Pohlmann\AppData\Local\Temp\proxy_vole1878406170297561191.dll
C:\Users\Jerome Pohlmann\AppData\Local\Temp\proxy_vole2975003625302849541.dll
C:\Users\Jerome Pohlmann\AppData\Local\Temp\rjgm1e32dc.exe
C:\Users\Jerome Pohlmann\AppData\Local\Temp\tu17p84.exe
C:\Users\Jerome Pohlmann\AppData\Local\Temp\Uninstall.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-04-20 20:37
==================== Ende von FRST.txt ============================
Addition: Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:16-05-2016
durchgeführt von Jerome Pohlmann (2016-05-16 19:24:15)
Gestartet von C:\Users\Jerome Pohlmann\Desktop
Windows 10 Home Version 1511 (X64) (2016-01-09 11:45:20)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1875599853-1810634468-1048324862-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1875599853-1810634468-1048324862-503 - Limited - Disabled)
fdjrvqxtbw (S-1-5-21-1875599853-1810634468-1048324862-1003 - Limited - Disabled)
Gast (S-1-5-21-1875599853-1810634468-1048324862-501 - Limited - Disabled)
Jerome Pohlmann (S-1-5-21-1875599853-1810634468-1048324862-1001 - Administrator - Enabled) => C:\Users\Jerome Pohlmann
Pia (S-1-5-21-1875599853-1810634468-1048324862-1002 - Limited - Enabled) => C:\Users\Pia
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: ESET Smart Security 9.0.377.1 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.377.1 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 15.09 beta (x64) (HKLM\...\7-Zip) (Version: 15.09 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
AirDroid 3.1.3.0 (HKLM-x32\...\AirDroid) (Version: 3.1.3.0 - Sand Studio)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.3.4 - ASUS)
ASUS Screen Saver (HKLM-x32\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 2.1.0 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.9 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 3.05.0001 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 4.1.1 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0039 - ASUS)
AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.0.55 - ICEpower a/s)
Bonjour (HKLM-x32\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.)
calibre 64bit (HKLM\...\{DBF2A8AA-9EE9-454D-8958-F74F1FCB0789}) (Version: 2.41.0 - Kovid Goyal)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.4.60 - Conexant)
Device Setup (HKLM-x32\...\{1F07F2C7-596F-4F34-B805-2C61A3E50E5A}) (Version: 1.0.18 - ASUSTek Computer Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
ESET Smart Security (HKLM\...\{186176BE-07AA-41C3-B91A-380E2E82C2AC}) (Version: 9.0.377.1 - ESET, spol. s r.o.)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.2.5.930 - Foxit Software Inc.)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.2.2.1001 - Genesys Logic)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
Google Drive (HKLM-x32\...\{D7269C20-B3CE-4CD0-8E88-3D307D3BD41A}) (Version: 1.29.2074.1528 - Google, Inc.)
Google Photos Backup (HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Google Photos Backup) (Version: 1.1.2.13 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
GoPro App (x32 Version: 0.1.443 - GoPro, Inc.) Hidden
GoPro Studio 2.5.5 (HKLM-x32\...\{5d43231e-c765-405a-a122-81de16acd8b4}) (Version: 2.5.5.443 - GoPro, Inc.)
IIS 7.5 Express (HKLM-x32\...\{3A30B5F5-F12C-490F-8CD4-D200C75DF7E8}) (Version: 7.5.1190 - Microsoft Corporation)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation)
Intel(R) Chipset Device Software (x32 Version: 10.0.24 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.0.10101.101 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.38.1036 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4112 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{AACB7B6F-5057-4612-B026-FE2A3D69F30B}) (Version: 5.1.28.0 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{B2913DAE-3EBC-4C88-8245-0AA34B2E461D}) (Version: 17.1.1450.0402 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{1663dca9-b4be-4a91-940e-d94c82761dbb}) (Version: 17.15.1 - Intel Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4641.3004 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23506 (HKLM-x32\...\{23daf363-3020-4059-b3ae-dc4ad39fed19}) (Version: 14.0.23506.0 - Microsoft Corporation)
NVIDIA Graphics Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Online Manager (HKLM-x32\...\Online Manager) (Version: 2.00 - Deutsche Telekom AG)
Online Manager (Version: 2.00 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Plex Media Server (HKLM-x32\...\{06f702c0-12c1-4d02-a753-2c00d9f1d01e}) (Version: 0.9.1506 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1506 - Plex, Inc.) Hidden
POIbase 2.0.18 (HKLM-x32\...\POIbase_is1) (Version: - POIbase)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek USB Fast Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{D2B61BE0-B18B-4091-81B4-F234F4C30DFD}) (Version: 8.13.106.2014 - Realtek)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.103 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\Spotify) (Version: 1.0.26.132.ga4e3ccee - Spotify AB)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
TomTom HOME (HKLM-x32\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (01/13/2015 6.0.0.41) (HKLM\...\E43971232F0609D99713D21682E603E28D0F0518) (Version: 01/13/2015 6.0.0.41 - ASUS)
Windows-Treiberpaket - ASUS (ATP) Mouse (10/21/2015 6.0.0.66) (HKLM\...\BC69268D29996F70FD79F32A561263B8537AAF34) (Version: 10/21/2015 6.0.0.66 - ASUS)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 3.0.1 - ASUS)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Jerome Pohlmann\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-1875599853-1810634468-1048324862-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll (Google Inc.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {00BC0191-482B-40D4-AEB9-F69D8574BB18} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {1052340E-7404-47FB-B814-6FA428ABC6F9} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {150CBED0-A98A-4CA8-AB47-21A6DF20A55E} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {1B29D267-1A22-4BF2-88DF-2751F079F1A0} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2014-11-05] (ASUS)
Task: {30283839-B205-4449-98A3-6D2612C05F3D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001Core => C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\GoogleUpdate.exe [2015-11-06] (Google Inc.)
Task: {36E27157-D0DB-4D2D-A708-3BCE4417161E} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2014-09-02] (ASUSTek Computer Inc.)
Task: {42247830-2313-43FE-BE86-43C45F9BFA31} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {441E688C-DD24-4F2F-8432-E6A8BE7631A2} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2014-12-17] (ASUSTek Computer Inc.)
Task: {446E3A6E-E165-4B5D-B1F4-76D41B2DC21E} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)
Task: {44C10CE7-EF50-4F61-981E-398222168210} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001UA => C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\GoogleUpdate.exe [2015-11-06] (Google Inc.)
Task: {4ED1F5F9-E14E-4DFD-AD88-D20B6C06A7C8} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {5FA8D5E0-056B-439A-B2F2-E50CB7EFE0B8} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2015-03-10] (ASUSTek Computer Inc.)
Task: {6AB5A2EE-31F6-4AAC-AD5E-9DA9148A3911} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)
Task: {7F3A28E8-E148-4AE5-94ED-19CF47B6A2BD} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {84D91427-3E79-43B4-AB10-F0DD88E95AAA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-10] (Google Inc.)
Task: {92AB4421-A84C-4D36-8719-95BCC8A2BFBF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {956C40C6-9DEE-4821-AC57-BA648CAC3EA1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-05-16] (Microsoft Corporation)
Task: {9CC7529B-A618-4AAA-8DAF-F4FA3D542B82} - System32\Tasks\UMonitor Task => C:\Windows\SysWOW64\UMonit64.exe [2014-03-05] ()
Task: {B298C5D5-DEC0-4AF1-A717-069C0DFF4316} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-10] (Google Inc.)
Task: {B8F71794-46E5-4CDA-A30E-78F1117588E8} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {BDA5F884-EB84-4A06-877E-C20721056FDC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
Task: {CAA8EADE-3758-4A2E-8429-F2F5AB2CEE59} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2015-12-14] (AsusTek)
Task: {D0F5A424-21BE-4F98-AFCC-03D8DE4ECB24} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D6ECC0CD-C744-4296-A110-B6E4F7F2300E} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()
Task: {E85A2C76-6891-445C-8A23-180EF214775C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {EF1E3C47-8775-43C5-8773-5489BFD56164} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {FB84A9CE-3547-4CEE-973D-259B8B620B38} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001Core.job => C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1875599853-1810634468-1048324862-1001UA.job => C:\Users\Jerome Pohlmann\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2010-10-19 09:31 - 2010-10-19 09:31 - 00205312 _____ () C:\Program Files\Deutsche Telekom AG\Online Manager\NMInfraIS2\driver64\SoftplugLib.DLL
2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-01-09 13:38 - 2015-07-13 19:37 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-04-14 08:39 - 2016-03-29 12:20 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-14 08:39 - 2016-03-29 12:20 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-01-09 13:17 - 2016-01-09 13:17 - 00402344 _____ () C:\WINDOWS\system32\igfxTray.exe
2016-01-09 13:34 - 2016-01-09 13:34 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-04-14 08:38 - 2016-04-02 05:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-14 08:38 - 2016-04-02 05:03 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-04-14 08:38 - 2016-04-02 04:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-14 08:38 - 2016-04-02 04:59 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-04-14 08:38 - 2016-04-02 05:02 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-05-04 14:01 - 2014-03-05 10:49 - 00053248 _____ () C:\Windows\SysWOW64\UMonit64.exe
2016-03-30 20:48 - 2016-03-30 20:48 - 00016896 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-03-30 20:48 - 2016-03-30 20:48 - 17535488 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-03-04 21:28 - 2016-03-04 21:29 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-01-06 16:40 - 2015-01-06 16:40 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-11-05 13:44 - 2014-11-05 13:44 - 00037424 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2014-11-05 13:44 - 2014-11-05 13:44 - 00124928 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2016-04-11 21:46 - 2016-04-06 12:04 - 01675928 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.112\libglesv2.dll
2016-04-11 21:46 - 2016-04-06 12:04 - 00086168 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.112\libegl.dll
2016-05-16 18:40 - 2016-05-16 18:40 - 00098816 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32api.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00110080 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\pywintypes27.dll
2016-05-16 18:40 - 2016-05-16 18:40 - 00364544 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\pythoncom27.dll
2016-05-16 18:40 - 2016-05-16 18:40 - 00320512 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32com.shell.shell.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00776704 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_hashlib.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 01176576 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._core_.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00806400 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._gdi_.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00816128 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._windows_.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 01067008 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._controls_.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00733184 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._misc_.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00682496 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\pysqlite2._sqlite.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00088064 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_ctypes.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00119808 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32file.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00108544 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32security.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00007168 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\hashobjs_ext.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00017920 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\thumbnails_ext.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00088064 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\usb_ext.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00167936 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32gui.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00018432 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32event.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00046080 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_socket.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 01208320 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_ssl.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00128512 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_elementtree.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00127488 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\pyexpat.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00012288 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\common.time34.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00038912 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32inet.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00036864 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_psutil_windows.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00525208 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\windows._lib_cacheinvalidation.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00011264 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32crypt.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00077312 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._html2.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00027136 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_multiprocessing.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00020480 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\_yappi.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00035840 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32process.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00686080 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\unicodedata.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00078848 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._animate.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00123392 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\wx._wizard.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00024064 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32pipe.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00010240 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\select.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00025600 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32pdh.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00017408 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32profile.pyd
2016-05-16 18:40 - 2016-05-16 18:40 - 00022528 ____R () C:\Users\Jerome Pohlmann\AppData\Local\Temp\_MEI7042\win32ts.pyd
2016-04-09 00:35 - 2016-04-09 00:35 - 03481600 _____ () C:\Users\Jerome Pohlmann\AppData\Local\Programs\Google\Google Photos Backup\gpuploader_i18n.dll
2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-04-28 00:40 - 00001552 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img2.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "GoPro Studio Importer"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKU\S-1-5-21-1875599853-1810634468-1048324862-1001\...\StartupApproved\Run: => "Spotify Web Helper"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{3FB7C9B3-54BD-4820-B696-FBAFF610E75E}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{5848E9C4-895F-4622-A95C-BDF39B9D0939}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [{D48F6F7F-BD46-41F0-BD6B-37F58504FF32}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{534D71F2-1B40-4D1C-93DC-6527C774551E}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{D608E55D-2308-433D-90ED-CD15F14E0C4E}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{AA015A58-A2CD-4081-9A96-26B3C0F7E036}] => (Allow) C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe
FirewallRules: [TCP Query User{D33D8EDD-970A-4942-9AB3-92798AFEF04B}C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{1448CF60-453A-40D2-93AC-561ADCAAC704}C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe
FirewallRules: [{63A24556-7241-42BE-B171-0C75AF66F82F}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{539B3BF2-E449-4C9B-A00B-B018CAEEA910}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe
FirewallRules: [{F1C9A601-F0A4-404F-9DBF-907206586FFF}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe
FirewallRules: [TCP Query User{7C204A7A-B979-46CD-9674-79D323BEBA93}C:\program files (x86)\airdroid\airdroid.exe] => (Allow) C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [UDP Query User{C0936FFF-D7F4-4AB2-90A6-6B2204395F2D}C:\program files (x86)\airdroid\airdroid.exe] => (Allow) C:\program files (x86)\airdroid\airdroid.exe
FirewallRules: [{85FB7FB5-624B-41A4-B426-85234B0AD6B3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{4C3B7B87-7D1D-4F3B-9D62-EAFD3ABB8001}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{34694186-D3D4-4BCF-94E3-69891DD61241}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [TCP Query User{455F220E-942D-4C5B-B893-B01B8B5D19ED}C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{A5F3E921-341B-4E8E-8FE6-11E053225794}C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jerome pohlmann\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{872AEF8C-CA3C-4387-AA58-984A0539E047}C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe] => (Allow) C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe
FirewallRules: [UDP Query User{2863029C-1916-4361-95EB-4DE1554C4194}C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe] => (Allow) C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe
FirewallRules: [TCP Query User{352292F9-5278-4BE9-96B7-6E77F69212A8}C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe] => (Block) C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe
FirewallRules: [UDP Query User{E54CCFA2-FCAB-40E4-83AE-EE9EFFA0AFC9}C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe] => (Block) C:\program files (x86)\asus\asus smart gesture\astpcenter\x64\asussgplusbtserver64.exe
FirewallRules: [{F546603F-0505-4C32-AA97-2CEBFDC6FBDF}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
FirewallRules: [{223A1701-E8F8-4EFB-B4CF-436E6650EAC8}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
FirewallRules: [{3A3B17A7-C580-4920-8213-84955C9EA75C}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
FirewallRules: [{EDF34B9F-D506-4254-A5CA-746C4FB27528}] => (Allow) LPort=5001
FirewallRules: [{EBBBE1ED-4C18-40ED-83CA-831C8467FC9C}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{363977BD-51E7-4DD8-AFFE-571373816478}] => (Allow) C:\Program Files\NewExt\jsinjector.exe
FirewallRules: [{27D99E4C-F1E7-42C2-9105-80667EAB9351}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Wiederherstellungspunkte =========================
ACHTUNG: Systemwiederherstellung ist deaktiviert
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/16/2016 07:19:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
Error: (05/16/2016 06:41:26 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
Error: (05/16/2016 06:41:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
Error: (05/16/2016 06:41:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
Error: (04/30/2016 11:04:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SmartAudio.exe, Version: 6.0.245.0, Zeitstempel: 0x55405092
Name des fehlerhaften Moduls: SmartAudio.ni.exe, Version: 6.0.245.0, Zeitstempel: 0x55405092
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00132def
ID des fehlerhaften Prozesses: 0x940
Startzeit der fehlerhaften Anwendung: 0xSmartAudio.exe0
Pfad der fehlerhaften Anwendung: SmartAudio.exe1
Pfad des fehlerhaften Moduls: SmartAudio.exe2
Berichtskennung: SmartAudio.exe3
Vollständiger Name des fehlerhaften Pakets: SmartAudio.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SmartAudio.exe5
Error: (04/30/2016 11:04:21 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: SmartAudio.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
at SmartAudio.MainWindow.GetPage(System.String)
at SmartAudio.MainWindow._mainContainer_Deactivated(System.Object, System.EventArgs)
at System.Windows.Window.OnDeactivated(System.EventArgs)
at System.Windows.Window.HandleActivate(Boolean)
at System.Windows.Window.WmActivate(IntPtr)
at System.Windows.Window.WindowFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at System.Windows.Interop.HwndSource.PublicHooksFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
Error: (04/30/2016 11:03:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 10.0.10586.0, Zeitstempel: 0x5632d7ba
Name des fehlerhaften Moduls: ESENT.dll, Version: 10.0.10586.212, Zeitstempel: 0x56fa1686
Ausnahmecode: 0xc0000602
Fehleroffset: 0x000000000022885f
ID des fehlerhaften Prozesses: 0xa60
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3
Vollständiger Name des fehlerhaften Pakets: svchost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe5
Error: (04/30/2016 11:03:22 PM) (Source: ESENT) (EventID: 908) (User: )
Description: svchost (2656) Der Prozess wird aufgrund eines nicht behebbaren Fehlers beendet: PV: 10.0.10586.0 SV: 10.0.10586.0 GLE: 0 ERR: -4006(osdisk.cxx:4484): dllentry.cxx(103) (ESENT[10.0.10586.0] RETAIL RTM MBCS)
Error: (04/28/2016 02:20:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_5.114 (1).exe, Version: 5.1.1.4, Zeitstempel: 0x572125ec
Name des fehlerhaften Moduls: adwcleaner_5.114 (1).exe, Version: 5.1.1.4, Zeitstempel: 0x572125ec
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00020fea
ID des fehlerhaften Prozesses: 0x1eb4
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_5.114 (1).exe0
Pfad der fehlerhaften Anwendung: adwcleaner_5.114 (1).exe1
Pfad des fehlerhaften Moduls: adwcleaner_5.114 (1).exe2
Berichtskennung: adwcleaner_5.114 (1).exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_5.114 (1).exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_5.114 (1).exe5
Error: (04/28/2016 01:11:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 10.0.10586.0, Zeitstempel: 0x5632d7ba
Name des fehlerhaften Moduls: ESENT.dll, Version: 10.0.10586.212, Zeitstempel: 0x56fa1686
Ausnahmecode: 0xc0000602
Fehleroffset: 0x000000000022885f
ID des fehlerhaften Prozesses: 0xa98
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3
Vollständiger Name des fehlerhaften Pakets: svchost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe5
Systemfehler:
=============
Error: (05/16/2016 07:20:32 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {F3B4E234-7A68-4E43-B813-E4BA55A065F6}
Error: (05/16/2016 06:49:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/16/2016 06:49:15 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\JEROME~1\AppData\Local\Temp\ehdrv.sys
Error: (05/16/2016 06:49:14 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\JEROME~1\AppData\Local\Temp\ehdrv.sys
Error: (05/16/2016 06:49:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/16/2016 06:49:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/16/2016 06:49:14 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\JEROME~1\AppData\Local\Temp\ehdrv.sys
Error: (05/16/2016 06:43:11 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
Error: (05/16/2016 06:42:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (05/16/2016 06:42:24 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\JEROME~1\AppData\Local\Temp\ehdrv.sys
CodeIntegrity:
===================================
Date: 2016-04-30 23:03:38.093
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 23:03:38.074
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 23:03:37.222
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 23:03:37.215
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 23:03:37.208
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 23:03:37.200
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 22:56:13.335
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 22:56:13.320
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 22:56:12.544
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-04-30 22:56:12.535
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 8094.46 MB
Verfügbarer physikalischer RAM: 5137.73 MB
Summe virtueller Speicher: 9374.46 MB
Verfügbarer virtueller Speicher: 6346.45 MB
==================== Laufwerke ================================
Drive c: (OS) (Fixed) (Total:118.57 GB) (Free:13.94 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: 921A8AC6)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
FRST 32-Bit | FRST 64-Bit
AdwCleaner auf deinen Desktop.
Hast du noch irgendwelche Probleme mit deinem Rechner? 
