Lieber Larusso,
vielen Dank für deine Hilfe! Anbei sende ich dir die Logdateien:
AdwCleaner: Code:
# AdwCleaner v5.117 - Bericht erstellt am 22/05/2016 um 12:57:26
# Aktualisiert am 15/05/2016 von Xplode
# Datenbank : 2016-05-15.2 [Server]
# Betriebssystem : Windows 7 Starter Service Pack 1 (X86)
# Benutzername : Henry Haller - HALLESÜD
# Gestartet von : C:\Users\Henry Haller\Downloads\adwcleaner_5.117.exe
# Option : Suchlauf
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
***** [ Dateien ] *****
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [1660 Bytes] - [09/05/2016 17:28:07]
C:\AdwCleaner\AdwCleaner[R0].txt - [8729 Bytes] - [25/05/2015 13:26:22]
C:\AdwCleaner\AdwCleaner[R1].txt - [8090 Bytes] - [26/05/2015 12:39:25]
C:\AdwCleaner\AdwCleaner[S0].txt - [3553 Bytes] - [25/05/2015 13:28:50]
C:\AdwCleaner\AdwCleaner[S1].txt - [4881 Bytes] - [26/05/2015 12:42:11]
C:\AdwCleaner\AdwCleaner[S2].txt - [1434 Bytes] - [09/05/2016 17:22:40]
C:\AdwCleaner\AdwCleaner[S3].txt - [1297 Bytes] - [11/05/2016 20:56:17]
C:\AdwCleaner\AdwCleaner[S4].txt - [1218 Bytes] - [22/05/2016 12:57:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1291 Bytes] ##########
Malwarebytes Anti-Malware: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlaufdatum: 22.05.2016
Suchlaufzeit: 13:06
Protokolldatei: Malwarebytes Anti-Malware.txt
Administrator: Ja
Version: 2.2.1.1043
Malware-Datenbank: v2016.05.22.02
Rootkit-Datenbank: v2016.05.20.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Henry Haller
Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 285666
Abgelaufene Zeit: 27 Min., 31 Sek.
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(keine bösartigen Elemente erkannt)
Module: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)
Registrierungswerte: 0
(keine bösartigen Elemente erkannt)
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Ordner: 0
(keine bösartigen Elemente erkannt)
Dateien: 0
(keine bösartigen Elemente erkannt)
Physische Sektoren: 0
(keine bösartigen Elemente erkannt)
(end)
Junkware Removal Tool: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 7 Starter x86
Ran by Henry Haller (Administrator) on 11.05.2016 at 20:59:57,24
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 34
Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\tempdir (Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15FFM65K (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5IUUMCUH (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96FJ5ZXR (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9JVMBCNA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CNP7J5BR (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EGW9ETKK (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FKPOSQLO (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K19MNP8Y (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K7B9EQRN (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LNBSU9ZK (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N8DOQIDA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q676CLBV (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RZ5YBEMJ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VJ0RMO1Q (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YU8V81V4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Henry Haller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOI1FJN7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15FFM65K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5IUUMCUH (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96FJ5ZXR (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9JVMBCNA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CNP7J5BR (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EGW9ETKK (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FKPOSQLO (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K19MNP8Y (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K7B9EQRN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LNBSU9ZK (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N8DOQIDA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q676CLBV (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RZ5YBEMJ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VJ0RMO1Q (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YU8V81V4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOI1FJN7 (Temporary Internet Files Folder)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.05.2016 at 21:02:56,78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST text Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:22-05-2016
durchgeführt von Henry Haller (Administrator) auf HALLESÜD (22-05-2016 13:42:16)
Gestartet von C:\Users\Henry Haller\Downloads
Geladene Profile: Henry Haller & (Verfügbare Profile: Henry Haller)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\redirector.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\Receiver\Receiver.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Spotify Ltd) C:\Users\Henry Haller\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Dropbox, Inc.) C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(www.rene-zeidler.de) C:\Users\Henry Haller\Downloads\SnippingToolPlusv3-4-1-0\Snipping Tool Plus.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [814608 2016-05-10] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-04-03] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-04-25] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [759696 2015-12-23] (Cisco Systems, Inc.)
HKLM\...\Run: [ConnectionCenter] => C:\Program Files\Citrix\ICA Client\concentr.exe [522552 2015-12-10] (Citrix Systems, Inc.)
HKLM\...\Run: [Redirector] => C:\Program Files\Citrix\ICA Client\redirector.exe [231736 2015-12-10] (Citrix Systems, Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [164152 2016-03-19] (Apple Inc.)
HKU\S-1-5-21-2556660917-351933305-2770516466-1000\...\Run: [Dropbox Update] => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
HKU\S-1-5-21-2556660917-351933305-2770516466-1000\...\Run: [Spotify Web Helper] => C:\Users\Henry Haller\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1524336 2016-02-20] (Spotify Ltd)
HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Dropbox Update] => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify Web Helper] => C:\Users\Henry Haller\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1524336 2016-02-20] (Spotify Ltd)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\Users\Henry Haller\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-05-16]
ShortcutTarget: Dropbox.lnk -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Hosts: 139.18.25.41 vpn.uni-leipzig.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7BE811F9-97BF-49AA-AAE2-F8F673434CE9}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2556660917-351933305-2770516466-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-26] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-26] (Oracle Corporation)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2015-12-10] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\Henry Haller\AppData\Roaming\Mozilla\Firefox\Profiles\8pvybl2j.default-1462628722450
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-16] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()
FF Plugin: @Citrix.com/npagee,version=10.1.128.8 -> C:\Program Files\Citrix\Secure Access Client\npagee.dll [2014-07-17] (Citrix Systems, Inc.)
FF Plugin: @Citrix.com/npican -> C:\Program Files\Citrix\ICA Client\npicaN.dll [2015-12-10] (Citrix Systems, Inc.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2013-09-17] (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2014-04-18] (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-04-23] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Henry Haller\AppData\Roaming\mozilla\plugins\npagee.dll [2014-07-17] (Citrix Systems, Inc.)
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2016-01-29]
FF HKU\S-1-5-21-2556660917-351933305-2770516466-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Henry Haller\AppData\Roaming\Mozilla\Firefox\Profiles\rsg29c4t.default\extensions\cliqz@cliqz.com => nicht gefunden
FF HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Henry Haller\AppData\Roaming\Mozilla\Firefox\Profiles\rsg29c4t.default\extensions\cliqz@cliqz.com => nicht gefunden
Chrome:
=======
CHR Profile: C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-19]
CHR Extension: (Google Docs) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-19]
CHR Extension: (Google Drive) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-19]
CHR Extension: (YouTube) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-19]
CHR Extension: (Google Tabellen) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-03-19]
CHR Extension: (Google Docs Offline) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-20]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-08]
CHR Extension: (Citavi Picker) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2016-03-19]
CHR Extension: (Google Mail) - C:\Users\Henry Haller\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-19]
CHR HKLM\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - hxxps://clients2.google.com/service/update2/crx
Opera:
=======
OPR Extension: (Adblock Plus) - C:\Users\Henry Haller\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2016-03-10]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [970656 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [467016 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [467016 2016-05-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1435704 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [280008 2016-04-25] (Avira Operations GmbH & Co. KG)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [567184 2015-12-23] (Cisco Systems, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [109248 2015-12-23] (Cisco Systems, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [109016 2016-03-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137240 2016-05-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [60088 2016-05-10] (Avira Operations GmbH & Co. KG)
R3 mobiolavs; C:\Windows\System32\DRIVERS\mobiolavs.sys [26896 2011-04-06] (SHAPE Services GmbH)
R3 MOBIOLA_Wave; C:\Windows\System32\drivers\mobiolawave.sys [25024 2011-04-06] (SHAPE Services)
R3 OZSCR; C:\Windows\System32\DRIVERS\ozscr.sys [92550 2005-04-21] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-09] (Avira Operations GmbH & Co. KG)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva-6.sys [43888 2014-08-15] (Cisco Systems, Inc.)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-22 13:42 - 2016-05-22 13:42 - 00018820 _____ C:\Users\Henry Haller\Downloads\FRST.txt
2016-05-22 13:42 - 2016-05-22 13:42 - 00000000 ____D C:\FRST
2016-05-22 13:40 - 2016-05-22 13:41 - 01733632 _____ (Farbar) C:\Users\Henry Haller\Downloads\FRST.exe
2016-05-22 12:55 - 2016-05-22 12:56 - 03651136 _____ C:\Users\Henry Haller\Downloads\adwcleaner_5.117.exe
2016-05-22 12:53 - 2016-05-22 13:34 - 00000000 ____D C:\Users\Henry Haller\Desktop\TB
2016-05-16 18:25 - 2016-05-16 18:25 - 00000000 ____D C:\Users\Henry Haller\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-05-11 21:11 - 2016-05-11 21:11 - 00000000 ____D C:\Program Files\ESET
2016-05-11 21:10 - 2016-05-11 21:10 - 02870984 _____ (ESET) C:\Users\Henry Haller\Downloads\esetsmartinstaller_deu.exe
2016-05-11 18:42 - 2016-05-11 18:43 - 01610816 _____ (Malwarebytes) C:\Users\Henry Haller\Downloads\JRT.exe
2016-05-11 16:21 - 2016-04-14 15:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-05-11 16:21 - 2016-04-09 08:54 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-05-11 16:21 - 2016-04-09 08:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-05-11 16:21 - 2016-04-09 07:40 - 02397696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-05-11 16:21 - 2016-04-09 06:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-05-11 16:21 - 2016-03-09 20:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2016-05-11 16:20 - 2016-04-23 18:24 - 00346312 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-05-11 16:20 - 2016-04-23 06:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-05-11 16:20 - 2016-04-23 06:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-05-11 16:20 - 2016-04-23 06:11 - 20350464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-05-11 16:20 - 2016-04-23 06:08 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-05-11 16:20 - 2016-04-23 06:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-05-11 16:20 - 2016-04-23 06:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-05-11 16:20 - 2016-04-23 06:07 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-05-11 16:20 - 2016-04-23 06:07 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-05-11 16:20 - 2016-04-23 06:04 - 02285568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-05-11 16:20 - 2016-04-23 06:02 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-05-11 16:20 - 2016-04-23 06:01 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-05-11 16:20 - 2016-04-23 05:59 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-05-11 16:20 - 2016-04-23 05:58 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-05-11 16:20 - 2016-04-23 05:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-05-11 16:20 - 2016-04-23 05:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-05-11 16:20 - 2016-04-23 05:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-05-11 16:20 - 2016-04-23 05:53 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-11 16:20 - 2016-04-23 05:50 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-05-11 16:20 - 2016-04-23 05:45 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-11 16:20 - 2016-04-23 05:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-05-11 16:20 - 2016-04-23 05:43 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-05-11 16:20 - 2016-04-23 05:41 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-05-11 16:20 - 2016-04-23 05:40 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-05-11 16:20 - 2016-04-23 05:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-05-11 16:20 - 2016-04-23 05:36 - 04611072 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-05-11 16:20 - 2016-04-23 05:33 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-05-11 16:20 - 2016-04-23 05:31 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-05-11 16:20 - 2016-04-23 05:31 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-05-11 16:20 - 2016-04-23 05:30 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-05-11 16:20 - 2016-04-23 05:30 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-05-11 16:20 - 2016-04-23 05:26 - 13811200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-05-11 16:20 - 2016-04-23 05:12 - 02121216 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-05-11 16:20 - 2016-04-23 05:09 - 01312256 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-05-11 16:20 - 2016-04-23 05:07 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-05-11 16:17 - 2016-04-09 08:59 - 03998952 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-05-11 16:17 - 2016-04-09 08:59 - 03943144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-05-11 16:17 - 2016-04-09 08:59 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-05-11 16:17 - 2016-04-09 08:59 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-05-11 16:17 - 2016-04-09 08:59 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-05-11 16:17 - 2016-04-09 08:59 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-05-11 16:17 - 2016-04-09 08:57 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 01062400 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-05-11 16:17 - 2016-04-09 08:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-05-11 16:17 - 2016-04-09 07:42 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-05-11 16:17 - 2016-04-09 07:42 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-05-11 16:17 - 2016-04-09 07:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-05-11 16:17 - 2016-04-09 07:42 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-05-11 16:17 - 2016-04-09 07:42 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-05-11 16:17 - 2016-04-09 07:40 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-05-11 16:17 - 2016-04-09 07:38 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-05-11 16:17 - 2016-04-09 07:38 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-05-11 16:17 - 2016-04-09 07:38 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-05-11 16:17 - 2016-04-09 07:37 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-05-11 16:17 - 2016-04-09 07:37 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-05-11 16:17 - 2016-04-09 07:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-05-11 16:17 - 2016-04-09 07:37 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-05-10 16:56 - 2016-05-10 16:58 - 00015657 _____ C:\Users\Henry Haller\Desktop\Fragen Polen.odt
2016-05-07 15:45 - 2016-05-07 15:45 - 00000000 ____D C:\Users\Henry Haller\Desktop\Alte Firefox-Daten
2016-05-06 17:14 - 2016-05-08 08:45 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-05-05 17:08 - 2016-05-05 15:48 - 00010221 _____ C:\Users\Henry Haller\Documents\Mail%20Solidarnosc.docx_0.odt
2016-05-05 16:10 - 2016-05-05 16:10 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-05-05 16:10 - 2016-05-05 16:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-05-05 16:07 - 2016-05-05 16:07 - 00000000 ____D C:\Program Files\iPod
2016-05-05 16:06 - 2016-05-05 16:10 - 00000000 ____D C:\Program Files\iTunes
2016-05-05 15:58 - 2016-05-05 15:58 - 00000000 ____D C:\Program Files\Apple Software Update
2016-04-30 20:43 - 2016-04-30 20:43 - 00350936 _____ (Spotify Ltd) C:\Users\Henry Haller\Downloads\SpotifySetup (1).exe
2016-04-22 15:50 - 2016-04-22 15:50 - 00002687 _____ C:\Users\Public\Desktop\Skype.lnk
2016-04-22 15:50 - 2016-04-22 15:50 - 00000000 ___RD C:\Program Files\Skype
2016-04-22 15:50 - 2016-04-22 15:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-04-22 15:50 - 2016-04-22 15:50 - 00000000 ____D C:\Program Files\Common Files\Skype
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-22 13:28 - 2016-03-19 19:14 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-22 13:23 - 2015-05-27 21:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-05-22 13:20 - 2015-06-16 16:09 - 00001252 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000UA.job
2016-05-22 13:03 - 2015-05-25 13:45 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-22 12:57 - 2015-05-25 13:26 - 00000000 ____D C:\AdwCleaner
2016-05-22 12:51 - 2009-07-14 06:34 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-22 12:51 - 2009-07-14 06:34 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-22 10:33 - 2014-10-17 14:14 - 00000000 ___RD C:\Users\Henry Haller\Dropbox
2016-05-22 10:30 - 2016-03-19 19:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-22 10:30 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-21 15:20 - 2015-06-16 16:09 - 00001200 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000Core.job
2016-05-19 18:36 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2016-05-18 22:38 - 2015-01-17 21:08 - 00000000 ____D C:\Users\Henry Haller\AppData\Roaming\vlc
2016-05-17 19:51 - 2014-04-29 16:46 - 00000000 ____D C:\ProgramData\Package Cache
2016-05-16 18:34 - 2016-03-19 19:16 - 00002133 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-16 18:34 - 2016-03-19 19:16 - 00002121 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-16 18:26 - 2014-10-17 14:07 - 00000000 ____D C:\Users\Henry Haller\AppData\Roaming\Dropbox
2016-05-16 18:23 - 2015-05-27 21:04 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-05-16 18:23 - 2015-05-27 21:04 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-05-16 17:52 - 2015-09-02 12:28 - 00001096 _____ C:\Users\Public\Desktop\Avira Launcher.lnk
2016-05-16 17:51 - 2014-04-29 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-05-12 18:00 - 2016-02-29 09:12 - 00000000 ____D C:\Windows\system32\appraiser
2016-05-12 17:53 - 2015-05-31 17:29 - 00000000 ____D C:\Program Files\Opera
2016-05-12 17:15 - 2011-04-12 03:30 - 00699666 _____ C:\Windows\system32\perfh007.dat
2016-05-12 17:15 - 2011-04-12 03:30 - 00149774 _____ C:\Windows\system32\perfc007.dat
2016-05-12 17:15 - 2010-11-20 23:01 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-12 17:15 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2016-05-12 17:06 - 2009-07-14 06:33 - 00476352 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-12 07:51 - 2015-01-14 21:35 - 00000000 ____D C:\Windows\system32\MRT
2016-05-12 07:34 - 2015-01-14 21:35 - 136686448 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-05-11 15:59 - 2016-01-08 14:23 - 00000000 ____D C:\Users\Henry Haller\AppData\Roaming\Telegram Desktop
2016-05-10 19:09 - 2014-04-29 21:27 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2016-05-10 16:49 - 2014-04-29 16:57 - 00137240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-05-10 16:49 - 2014-04-29 16:57 - 00060088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2016-05-09 18:12 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\IME
2016-05-09 17:38 - 2015-05-25 13:44 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-09 17:38 - 2015-05-25 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-09 17:38 - 2015-05-25 13:44 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-05-08 14:08 - 2016-03-04 22:50 - 00000000 ____D C:\Users\Henry Haller\Documents\MDR
2016-05-08 08:45 - 2015-03-18 12:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-05-07 18:48 - 2016-02-29 09:12 - 00000000 ___SD C:\Windows\system32\GWX
2016-05-05 16:06 - 2014-09-23 18:20 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-05-05 15:58 - 2014-09-23 18:22 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-05-05 15:28 - 2014-04-29 16:52 - 00117552 _____ C:\Users\Henry Haller\AppData\Local\GDIPFONTCACHEV1.DAT
2016-05-05 15:13 - 2014-05-06 10:52 - 00000000 ____D C:\Program Files\Microsoft Office
2016-05-05 15:13 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-05-05 15:12 - 2009-07-14 06:52 - 00000000 ____D C:\Program Files\MSBuild
2016-05-05 15:08 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\System
2016-05-05 15:08 - 2009-07-14 04:04 - 00000387 _____ C:\Windows\win.ini
2016-05-05 15:04 - 2014-07-31 09:49 - 00000000 ____D C:\Program Files\CHIP Updater
2016-05-05 15:00 - 2015-09-12 11:24 - 00000000 ____D C:\Users\Henry Haller\Documents\Citavi 5
2016-04-22 15:53 - 2014-10-17 14:34 - 00000000 ____D C:\Users\Henry Haller\AppData\Roaming\Skype
2016-04-22 15:51 - 2014-10-17 14:34 - 00000000 ____D C:\ProgramData\Skype
2016-04-22 15:50 - 2014-10-17 14:34 - 00000000 ____D C:\Users\Henry Haller\AppData\Local\Skype
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-08-21 17:32 - 2014-08-21 17:32 - 0000058 _____ () C:\Users\Henry Haller\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
Einige Dateien in TEMP:
====================
C:\Users\Henry Haller\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-19 18:26
==================== Ende vom FRST.txt ============================
FRST addition Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x86) Version:22-05-2016
durchgeführt von Henry Haller (2016-05-22 13:43:14)
Gestartet von C:\Users\Henry Haller\Downloads
Microsoft Windows 7 Starter Service Pack 1 (X86) (2014-04-29 14:35:02)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2556660917-351933305-2770516466-500 - Administrator - Disabled)
Gast (S-1-5-21-2556660917-351933305-2770516466-501 - Limited - Disabled)
Henry Haller (S-1-5-21-2556660917-351933305-2770516466-1000 - Administrator - Enabled) => C:\Users\Henry Haller
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.16) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.16 - Adobe Systems Incorporated)
Anki (HKLM\...\Anki) (Version: - )
Apple Application Support (32-Bit) (HKLM\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{15A0A9A6-6CF0-4EEE-8E12-096B33F92CA7}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.17.273 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM\...\{bfb60b68-92b8-481b-b416-7e05b4ea01c9}) (Version: 1.1.61.18979 - Avira Operations GmbH & Co. KG)
Avira Launcher (Version: 1.1.61.18979 - Avira Operations GmbH & Co. KG) Hidden
Bonjour (HKLM\...\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon MX390 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX390_series) (Version: 1.00 - Canon Inc.)
Cisco AnyConnect Secure Mobility Client (HKLM\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.13015 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.13015 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.2.0.8 - Swiss Academic Software)
Citrix Access Gateway Endpoint Analysis (HKLM\...\{6D8DB24C-3FD9-42CB-B9D5-9C69A351A1A0}) (Version: 10.1.128.8 - Citrix Systems, Inc.)
Citrix Receiver (HKLM\...\CitrixOnlinePluginPackWeb) (Version: 14.4.0.8014 - Citrix Systems, Inc.)
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.3.22 - DivX, LLC)
Dropbox (HKU\S-1-5-21-2556660917-351933305-2770516466-1000\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Google Chrome (HKLM\...\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
Google Update Helper (Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
iTunes (HKLM\...\{3079C5C8-325A-4354-A733-456BACA1E5FB}) (Version: 12.3.3.17 - Apple Inc.)
Java 8 Update 40 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 46.0.1 (x86 de) (HKLM\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Online Plug-in (Version: 14.4.0.8014 - Citrix Systems, Inc.) Hidden
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Opera Stable 37.0.2178.43 (HKLM\...\Opera 37.0.2178.43) (Version: 37.0.2178.43 - Opera Software)
PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.3 - Andrea Vacondio)
SecureW2 EAP Suite 1.1.3 for Windows (HKLM\...\SecureW2 EAP Suite) (Version: - )
Self-Service Plug-in (Version: 4.4.0.11833 - Citrix Systems, Inc.) Hidden
Skype™ 7.22 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.22.109 - Skype Technologies S.A.)
SopCast 3.2.9 (HKLM\...\SopCast) (Version: 3.2.9 - www.sopcast.com)
Spotify (HKU\S-1-5-21-2556660917-351933305-2770516466-1000\...\Spotify) (Version: 1.0.23.90.g42187855 - Spotify AB)
Spotify (HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Spotify) (Version: 1.0.23.90.g42187855 - Spotify AB)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{D166BD15-03AF-413A-BEFD-0679FF410B49}\InprocServer32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.29\psuser.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{E7A37920-253C-4FF1-B169-298A7CE6CAA9}\localserver32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2556660917-351933305-2770516466-1000_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\Henry Haller\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {061FE90A-FB0C-42E9-BAD7-A85236A906E9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-03-19] (Google Inc.)
Task: {36AFC721-17EB-4BAF-94D3-924D85B7A34C} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files\CHIP Updater\CHIPUpdater.exe [2014-07-21] (CHIP)
Task: {5AF38E8D-2FFF-4417-91E0-780A8FB7EA51} - System32\Tasks\Opera scheduled Autoupdate 1433086197 => C:\Program Files\Opera\launcher.exe [2016-05-09] (Opera Software)
Task: {5D5B9D36-B975-463B-A7BA-26E519C76563} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000UA => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
Task: {62ED2C94-A2E8-4AA5-9270-F39260247AD0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-03-19] (Google Inc.)
Task: {6EEDCF4B-A92D-40BF-8E34-AF3F819B8460} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000Core => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
Task: {7C4CBAD7-806E-4007-A0BE-80164F52940F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-16] (Adobe Systems Incorporated)
Task: {DB46BF7B-5082-465D-9EBF-61D3DF73225E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {E02A51DD-7E7D-460B-AEDC-C7B4470B6EEE} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000Core.job => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2556660917-351933305-2770516466-1000UA.job => C:\Users\Henry Haller\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-12-23 15:27 - 2015-12-23 15:27 - 00063376 _____ () C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-10 07:26 - 2014-01-10 07:26 - 01861968 _____ () C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2014-01-10 07:28 - 2014-01-10 07:28 - 00100688 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
2016-05-16 18:25 - 2016-04-19 21:47 - 00034768 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2016-05-16 18:24 - 2016-04-19 21:48 - 00019408 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2016-05-16 18:24 - 2016-04-19 21:47 - 00116688 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2016-05-16 18:25 - 2016-04-19 21:47 - 00093640 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2016-05-16 18:25 - 2016-04-19 21:47 - 00018376 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\select.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00019760 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00105928 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32api.pyd
2016-05-16 18:24 - 2016-04-19 21:47 - 00392144 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2016-05-16 18:25 - 2016-05-07 00:35 - 00381752 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2016-05-16 18:25 - 2016-04-19 21:47 - 00692688 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00020816 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2016-05-16 18:25 - 2016-04-19 21:48 - 00121296 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 01682760 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00020808 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00021840 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00038696 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\fastpath.pyd
2016-05-16 18:24 - 2016-04-19 21:49 - 00020936 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00024528 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32event.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00114640 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32security.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00124880 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32file.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00021832 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00024016 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00175560 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32gui.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00030160 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00043472 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32process.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00028616 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32ts.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00048592 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32service.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00026456 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00057808 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00024016 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32profile.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00117056 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00052024 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2016-05-16 18:25 - 2016-04-19 21:47 - 00134608 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2016-05-16 18:24 - 2016-04-19 21:47 - 00134088 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2016-05-16 18:24 - 2016-04-19 21:48 - 00240584 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00020800 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00021824 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winffi.kernel32._winffi_kernel32.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00019776 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00020800 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00024392 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2016-05-16 18:24 - 2016-04-19 21:50 - 00036296 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\librsync.dll
2016-05-16 18:24 - 2016-05-07 00:34 - 00020280 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00023376 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00350152 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00022352 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00084280 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2016-05-16 18:24 - 2016-05-07 00:34 - 01826096 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2016-05-16 18:25 - 2016-04-19 21:48 - 00083912 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\sip.pyd
2016-05-16 18:24 - 2016-05-07 00:35 - 03928880 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 01971504 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00531248 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2016-05-16 18:24 - 2016-05-07 00:35 - 00132912 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2016-05-16 18:24 - 2016-05-07 00:35 - 00223544 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2016-05-16 18:24 - 2016-05-07 00:34 - 00207672 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2016-05-16 18:25 - 2016-04-19 21:49 - 00060880 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\win32print.pyd
2016-05-16 18:25 - 2016-05-07 00:35 - 00024904 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-05-16 18:24 - 2016-05-07 00:35 - 00546096 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2016-05-16 18:24 - 2016-05-07 00:35 - 00357680 _____ () C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:04 - 2015-10-19 19:27 - 00000973 ____A C:\Windows\system32\Drivers\etc\hosts
139.18.25.41 vpn.uni-leipzig.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2556660917-351933305-2770516466-1000\Control Panel\Desktop\\Wallpaper -> %windir%\web\wallpaper\windows\img0.jpg
HKU\S-1-5-21-2556660917-351933305-2770516466-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> %windir%\web\wallpaper\windows\img0.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Spotify => "C:\Users\Henry Haller\AppData\Roaming\Spotify\Spotify.exe" -autostart -minimized
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Henry Haller\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
==================== FirewallRules (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{0CF1C99B-249D-4E70-9265-18E8CB184FFF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{6B193E9E-C331-4B4D-B599-33FBE0BA8C73}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{75791C60-B9B2-46EC-8FF7-D5F82EED0A1E}] => (Allow) c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{6B4E4090-EBF1-48A7-86F0-749A8AFB95E7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D5E696E9-0EEB-42DE-B8E5-F91A7F0382D9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A0D7032B-47BC-47BE-88E1-C2F104D188BA}] => (Allow) C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F89965F3-813C-405B-A04F-CE02C19CACC5}] => (Allow) C:\Users\Henry Haller\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{9817012F-7198-4777-B0C4-FB92A42E38AF}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{35B32285-BFCB-4EA7-92E1-EE871F8A1519}C:\users\henry haller\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\henry haller\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{2D056DA5-F403-45FA-8853-C9380BD159D1}C:\users\henry haller\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\henry haller\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{0D670266-758F-4CF8-ADAB-23E6F4989C90}C:\program files\mobiola webcamera for iphone\webcamforiphone.exe] => (Allow) C:\program files\mobiola webcamera for iphone\webcamforiphone.exe
FirewallRules: [UDP Query User{66E52A3D-D9EA-4D09-A357-D4353C720288}C:\program files\mobiola webcamera for iphone\webcamforiphone.exe] => (Allow) C:\program files\mobiola webcamera for iphone\webcamforiphone.exe
FirewallRules: [{E8FF6A89-F728-4C20-AE47-0CDAA175D0A4}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{6DA75B46-4127-4217-A8C1-52668DF72712}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FCC587B6-EB7B-47AA-9005-09B45C01AF09}C:\users\henry haller\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\henry haller\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{165B8C00-EC68-452B-8C9F-49E4C9F7405B}C:\users\henry haller\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\henry haller\appdata\roaming\spotify\spotify.exe
FirewallRules: [{2F550A55-B1CD-43D3-82B7-D10584AF8D67}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{B64D8C03-169A-4AE6-A3E9-DD8347300D7F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{CF2C062B-62C1-4619-B7B2-CD43178CF5E2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{294A7DD9-6DC8-45E0-943F-515F0BF1E249}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F2848A6A-22D7-464E-8600-C4C2DE1CDE15}] => (Allow) C:\Program Files\Citrix\Secure Access Client\nsepa.exe
FirewallRules: [{FDBF7422-7287-4692-8E6B-54350A525D9A}] => (Allow) C:\Program Files\Citrix\Secure Access Client\nsepa.exe
FirewallRules: [{DAFE1BA0-C80D-43A2-8150-E022DAB96165}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{21B185B7-8518-4861-B378-F26B4E1DE611}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Wiederherstellungspunkte =========================
11-05-2016 16:17:16 Windows Update
11-05-2016 20:59:58 JRT Pre-Junkware Removal
12-05-2016 07:28:58 Windows Update
12-05-2016 18:00:07 Windows Update
16-05-2016 17:59:38 Windows Update
20-05-2016 20:09:19 Windows Update
21-05-2016 13:16:16 Removed TomTom HOME Visual Studio Merge Modules
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/22/2016 12:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10920
Error: (05/22/2016 12:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10920
Error: (05/22/2016 12:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (05/22/2016 10:31:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2016 01:29:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2016 01:14:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CHIPUpdater.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: ed0
Startzeit: 01d1b34c2b4e09f3
Endzeit: 356
Anwendungspfad: C:\Program Files\CHIP Updater\CHIPUpdater.exe
Berichts-ID: 2d5d4e88-1f45-11e6-be5b-0017424053d7
Error: (05/21/2016 12:23:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/20/2016 08:01:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/19/2016 05:43:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/18/2016 05:27:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Systemfehler:
=============
Error: (05/21/2016 05:30:10 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4}
Error: (05/17/2016 06:07:57 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (05/16/2016 06:00:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows-Biometriedienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (05/16/2016 06:00:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Biometriedienst erreicht.
Error: (05/16/2016 05:51:37 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {87DC457B-B35D-48AC-BD42-BDF35EF623CE}
Error: (05/16/2016 05:48:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (05/16/2016 05:48:52 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst iPod-Dienst erreicht.
Error: (05/16/2016 05:48:52 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053iPod Service{063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (05/13/2016 09:13:04 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (05/12/2016 06:00:03 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4}
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Prozentuale Nutzung des RAM: 55%
Installierter physikalischer RAM: 2038.05 MB
Verfügbarer physikalischer RAM: 899.87 MB
Summe virtueller Speicher: 4076.11 MB
Verfügbarer virtueller Speicher: 2716.98 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:149.04 GB) (Free:36.63 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 477719F1)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
==================== Ende vom Addition.txt ============================
|
FRST 32-Bit | FRST 64-Bit