Trojaner-Board - Windows10: Trojanerfunde TR/Crypt.ZPACK.opknz + TR/Crypt.ZPACK.gezb + TR/Crypt.Xpack.400358 + TR/Dropper.A.40051 + TR/Dropper.A.40034

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows10: Trojanerfunde TR/Crypt.ZPACK.opknz + TR/Crypt.ZPACK.gezb + TR/Crypt.Xpack.400358 + TR/Dropper.A.40051 + TR/Dropper.A.40034 (https://www.trojaner-board.de/184043-windows10-trojanerfunde-tr-crypt-zpack-opknz-tr-crypt-zpack-gezb-tr-crypt-xpack-400358-tr-dropper-a-40051-tr-dropper-a-40034-a.html)

Windows10: Trojanerfunde TR/Crypt.ZPACK.opknz + TR/Crypt.ZPACK.gezb + TR/Crypt.Xpack.400358 + TR/Dropper.A.40051 + TR/Dropper.A.40034

Hallo liebes Forum,

Avira Free Antivirus (Produktversion 15.0.24.146, 06.12.2016) hat -soweit ich das überblicke- diese 5 Trojaner gemeldet:

TR/Crypt.ZPACK.opknz
TR/Crypt.ZPACK.gezb
TR/Crypt.Xpack.400358
TR/Dropper.A.40051
TR/Dropper.A.40034

Lt. Avira-Logfile befinden sich diese wohl innerhalb irgendwelcher gepackten Mail-Anhänge (von Pseudo-Juristen-Abmahnern) und in "Backupfiles.zip". Da diese (soweit ich das als Laie beurteilen kann) sich in Archiven befinden, können keine Reparaturen oder Entfernungen vorgenommen werden.

Mein System läuft einwandfrei (soweit ich das laienhaft feststellen kann).

Meine Frage an Euch Profis:
Was mache ich nun? Ignorieren? Oder diese "Schläfer" lieber entfernen?
Ich würde die Beseitigung dieser Besucher bevorzugen. Habe aber keine Ahnung wie.

Daher wäre ich Euch dankbar, wenn Ihr mir mit ein wenig Rat zur Seite stehen würdet und verbleibe mit besten Grüßen
Laocoon

Anbei der Auszug aus der FRST-Datei.
Die Auszüge aus der Addition-Datei und aus dem aktuellsten Avira-Log lade ich als zip hoch, da diese scheinbar zu groß sind.

Hier die FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 18-01-2017

durchgeführt von hans (Administrator) auf DELFINE (20-01-2017 19:25:53)

Gestartet von C:\Users\hans\Desktop

Geladene Profile: hans & Mcx1-DELFINE & Leo & DefaultAppPool (Verfügbare Profile: hans & Mcx1-DELFINE & Leo & DefaultAppPool)

Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(Axis Communications AB) C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe

(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE

(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\epson\MyEpson Portal\mepService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AsDLNAServerReal.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 

==================== Registry (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-26] (Logitech, Inc.)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-11-18] (Microsoft Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [ASUS WiFi GO! FileTransfer Execute] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFile\WiFileTransfer.exe [1376896 2012-04-12] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917576 2016-12-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [407904 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153952 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AXIS Camera Management Service Control] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmAdmin.exe [1834160 2015-05-08] (Axis Communications AB)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Plugin Install] => C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe [86016 2016-04-05] ()

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: igfxdev.dll [X]

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000002] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\SpybotSearchDestroy2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\RunOnce: [Uninstall 17.3.6381.0405\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\RunOnce: [Uninstall 17.3.6381.0405] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2014-02-03]

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Philips GoGear SA4VBE Device Manager.lnk [2013-06-14]

ShortcutTarget: Philips GoGear SA4VBE Device Manager.lnk -> C:\Program Files (x86)\Philips\GoGear SA4VBE Device Manager\GoGear_SA4VBE_DeviceManager.exe (Philips)

Startup: C:\Users\hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk [2012-07-27]

ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)

BootExecute: autocheck autochk * sdnclean64.exe

GroupPolicy: Beschränkung <======= ACHTUNG

GroupPolicy\User: Beschränkung <======= ACHTUNG

GroupPolicyUsers\S-1-5-21-1412286257-1942420214-3619319362-1007\User: Beschränkung <======= ACHTUNG
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{280df009-71d1-45e6-bca3-de9ca51bc6ef}: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{ec71dbf0-98cf-4b04-8ee2-cceb81b9b1a9}: [DhcpNameServer] 192.168.178.1
 

Internet Explorer:

==================

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKLM-x32 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-03] (Oracle Corporation)

BHO-x32: amazon -> {84B94901-3645-4D80-A6B7-4D0050B19455} -> C:\Program Files (x86)\Pricepirates7\IEButtonAmazonInterface.dll [2009-08-20] ()

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-03] (Oracle Corporation)

BHO-x32: Preispiraten -> {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} -> C:\Program Files (x86)\Pricepirates7\IEButtonPPInterface.dll [2009-08-20] ()

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

Toolbar: HKLM-x32 - Home Extension - {F090BE08-2E7E-4D60-8FAB-98ABFA425136} - C:\Program Files (x86)\Pricepirates7\HomeExtension.dll [2007-03-26] ()

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)
 

FireFox:

========

FF ProfilePath: C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default [2017-01-10]

FF Extension: (Philips GoGear Device Manager) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\gogear@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (German (de) Language Pack) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\langpack-de@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MSC Device Support) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\msc@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MTP Device Support) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\mtp@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\albumart@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\gonzo@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\philips-addon-manager@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\pinkmartini@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\purplerain@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\sharing@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\soundboard@songbirdnest.com [nicht gefunden]

FF ProfilePath: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default [2017-01-20]

FF user.js: detected! => C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\user.js [2016-03-04]

FF Homepage: Mozilla\Firefox\Profiles\cnn104yu.default -> hxxp://www.google.de

FF Extension: (Avira Browser Safety) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\abs@avira.com [2016-11-23] [ist nicht signiert]

FF Extension: (Brief) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\brief@mozdev.org.xpi [2016-06-12]

FF Extension: (Clipple) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\clipple@mooz.github.com.xpi [2016-02-17]

FF Extension: (ProxTube) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\ich@maltegoetz.de.xpi [2016-10-17]

FF Extension: (Download YouTube Videos, Fast And Simple) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\jid1-cHKBMlArKdIVEg@jetpack.xpi [2016-04-30]

FF Extension: (Vlc Kontextmenü) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlcplaylist@helgatauscher.de.xpi [2016-04-30]

FF Extension: (VLC Youtube Shortcut) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlc_shortcut@kosan.kosan.xpi [2016-12-01]

FF Extension: (All-in-One Sidebar) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2016-04-10]

FF Extension: (Amazon Startcenter) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{144D1513-0819-4538-AD26-D515AF443AE7} [2016-11-26]

FF Extension: (Home Extension) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259} [2016-11-26]

FF Extension: (Amazon Statusbar Button) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{32DD6873-2BC0-4E4B-B9A3-0E602AB0DC14} [2016-11-26]

FF Extension: (Real Player Plugin) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{5bde3c21-2fd4-4f4a-8726-253ac3af4675}.xpi [2016-05-19] [ist nicht signiert]

FF Extension: (NoScript) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-01-20]

FF Extension: (CSSHelper) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{89e65ea8-9e30-489d-8269-7ba28535378a}.xpi [2015-12-24] [ist nicht signiert]

FF Extension: (Clippings) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271} [2016-11-04]

FF Extension: (Biet-O-Matic Firefox Erweiterung) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{B0D70E72-2FC1-4b9f-A3D4-5921C854D906}.xpi [2012-12-08] [ist nicht signiert]

FF Extension: (Preispiraten) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C} [2016-01-16]

FF Extension: (Adblock Plus) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]

FF Extension: (Tab Mix Plus) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2017-01-14]

FF SearchPlugin: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\dudende-suche.xml [2012-07-29]

FF SearchPlugin: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\stadtbibliothek-hanshans.xml [2016-04-01]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2016-01-30] [ist nicht signiert]

FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on

FF Extension: (E-Web Print) - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2015-08-18] [ist nicht signiert]

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-11] ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [Keine Datei]

FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin_x86_64.dll [2016-03-25] (Synology)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-11] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1206147.dll [2013-11-25] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2015-04-08] (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)

FF Plugin-x32: @graphisoft.com/GDL Web Plug-in -> C:\Program Files (x86)\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-14] (Graphisoft SE)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-03] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-03] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin.dll [2016-03-25] (Synology)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @sun.com/npsopluginmi;version=1.0 -> C:\Program Files (x86)\OpenOffice.org 3\program [Keine Datei]

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\hans\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-03] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-08-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2016-04-05] (Apple Inc.)
 

Chrome: 

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default [2017-01-06]

CHR Extension: (Google Präsentationen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-09]

CHR Extension: (Google Docs) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-09]

CHR Extension: (Google Drive) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-29]

CHR Extension: (YouTube) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-29]

CHR Extension: (Google Cast) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-11-20]

CHR Extension: (Google-Suche) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]

CHR Extension: (Google Tabellen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-09]

CHR Extension: (Google Docs Offline) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-20]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-20]

CHR Extension: (Google Mail) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-09]

CHR Extension: (Chrome Media Router) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-20]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
 

==================== Dienste (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1089592 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1490296 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-07-28] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe [1473664 2012-07-28] (ASUSTeK Computer Inc.)

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)

R2 AXIS Camera Management; C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe [18432 2015-05-08] (Axis Communications AB) [Datei ist nicht signiert]

R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)

R2 EPSON_PM_RPCV4_06; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [152640 2013-04-15] (SEIKO EPSON CORPORATION)

R2 FoxitReaderService; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\FoxitConnectedPDFService.exe [1659592 2016-11-15] (Foxit Software Inc.)

R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

R2 MyEpson Portal Service; C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe [703984 2014-09-22] (SEIKO EPSON CORPORATION)

R2 SDScannerService; C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-11-18] (Microsoft Corporation)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2015-05-11] () [Datei ist nicht signiert]

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ======================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [151352 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [153904 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [78208 2016-06-04] (Avira Operations GmbH & Co. KG)

S3 GenericMount; C:\WINDOWS\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)

R3 ikbevent; C:\WINDOWS\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()

R3 imsevent; C:\WINDOWS\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

S3 WPRO_41_2001; C:\WINDOWS\System32\drivers\WPRO_41_2001.sys [34752 2013-01-28] ()

U3 idsvc; kein ImagePath
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-20 19:25 - 2017-01-20 19:26 - 00038833 _____ C:\Users\hans\Desktop\FRST.txt

2017-01-20 19:24 - 2017-01-20 19:25 - 00000000 ____D C:\FRST

2017-01-20 19:23 - 2017-01-20 19:24 - 02419712 _____ (Farbar) C:\Users\hans\Desktop\FRST64.exe

2017-01-20 19:03 - 2017-01-20 19:03 - 00001387 _____ C:\Users\hans\Desktop\Bearbeitet - Verknüpfung.lnk

2017-01-20 19:03 - 2017-01-20 19:03 - 00000475 _____ C:\Users\hans\Desktop\Trojaner.txt

2017-01-16 23:51 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170116-235155.backup

2017-01-14 19:14 - 2017-01-14 19:14 - 00000000 ____D C:\Users\hans\AppData\Roaming\Amanita-Design.Samorost3

2017-01-14 18:35 - 2017-01-14 18:38 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware

2017-01-10 23:50 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-235007.backup

2017-01-10 21:23 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-212324.backup

2017-01-10 20:16 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-201615.backup

2017-01-10 19:32 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll

2017-01-10 19:32 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2017-01-10 19:32 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2017-01-10 19:32 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2017-01-10 19:32 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll

2017-01-10 19:32 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2017-01-10 19:32 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe

2017-01-10 19:32 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2017-01-10 19:32 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2017-01-10 19:32 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll

2017-01-10 19:32 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2017-01-10 19:32 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll

2017-01-10 19:32 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe

2017-01-10 19:32 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe

2017-01-10 19:32 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll

2017-01-10 19:32 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2017-01-10 19:32 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2017-01-10 19:32 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2017-01-10 19:32 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll

2017-01-10 19:32 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe

2017-01-10 19:32 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2017-01-10 19:32 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2017-01-10 19:32 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2017-01-10 19:32 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll

2017-01-10 19:32 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2017-01-10 19:32 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2017-01-10 19:32 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll

2017-01-10 19:32 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2017-01-10 19:32 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2017-01-10 19:32 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2017-01-10 19:32 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2017-01-10 19:32 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:32 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2017-01-10 19:31 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2017-01-10 19:31 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll

2017-01-10 19:31 - 2016-12-21 08:45 - 00153952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcmiplugin.dll

2017-01-10 19:31 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2017-01-10 19:31 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2017-01-10 19:31 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2017-01-10 19:31 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2017-01-10 19:31 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll

2017-01-10 19:31 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll

2017-01-10 19:31 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2017-01-10 19:31 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe

2017-01-10 19:31 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2017-01-10 19:31 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2017-01-10 19:31 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll

2017-01-10 19:31 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2017-01-10 19:31 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll

2017-01-10 19:31 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll

2017-01-10 19:31 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll

2017-01-10 19:31 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2017-01-10 19:31 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll

2017-01-10 19:31 - 2016-12-21 06:03 - 00136544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqmigplugin.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll

2017-01-10 19:31 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2017-01-10 19:31 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll

2017-01-10 19:31 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2017-01-10 19:31 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2017-01-10 19:31 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe

2017-01-10 19:31 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll

2017-01-10 19:31 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys

2017-01-10 19:31 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2017-01-10 19:31 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll

2017-01-10 19:31 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll

2017-01-10 19:31 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2017-01-10 19:31 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll

2017-01-10 19:31 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2017-01-10 19:31 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll

2017-01-10 19:31 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2017-01-10 19:31 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2017-01-10 19:31 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2017-01-10 19:31 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2017-01-10 19:31 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2017-01-09 18:22 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170109-182203.backup

2017-01-07 15:05 - 2017-01-11 18:51 - 00263016 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2017-01-06 19:49 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170106-194925.backup

2017-01-04 20:25 - 2017-01-04 20:25 - 00001333 _____ C:\Users\hans\Desktop\OOSU10861.exe - Verknüpfung.lnk

2017-01-04 20:21 - 2017-01-04 20:21 - 00681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2017-01-04 18:35 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-183515.backup

2017-01-04 00:41 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004142.backup

2017-01-04 00:40 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004028.backup

2017-01-04 00:33 - 2017-01-04 00:33 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\ProcAlyzer Dumps

2017-01-04 00:27 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files\Common Files\AV

2017-01-04 00:27 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe

2017-01-04 00:26 - 2017-01-04 00:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2017-01-04 00:26 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files (x86)\SpybotSearchDestroy2

2017-01-04 00:26 - 2017-01-04 00:26 - 00001401 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2017-01-04 00:26 - 2017-01-04 00:26 - 00001389 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpybotSearchDestroy2

2017-01-04 00:26 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2017-01-03 20:05 - 2017-01-03 20:05 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH

2017-01-02 22:39 - 2017-01-02 22:39 - 00003270 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2

2017-01-02 22:38 - 2017-01-02 22:38 - 00000000 ____D C:\Users\Leo\AppData\Roaming\Skype

2016-12-28 19:03 - 2016-12-28 19:03 - 00001189 _____ C:\Users\hans\Desktop\MediathekView.lnk

2016-12-28 19:01 - 2016-12-29 20:58 - 00000000 ____D C:\Users\hans\.mediathek3

2016-12-28 18:58 - 2016-12-28 19:03 - 00000000 ____D C:\Program Files (x86)\MediathekView12

2016-12-28 18:55 - 2017-01-02 20:18 - 00000000 ____D C:\Users\hans\AppData\Roaming\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00001989 _____ C:\Users\Public\Desktop\TV-Browser.lnk

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\Program Files (x86)\TV-Browser

2016-12-27 18:27 - 2017-01-11 20:37 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\BotaniculaSaves

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\hans\Desktop\Samorost 3.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\hans\Desktop\Botanicula.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\hans\Desktop\Samorost 2.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\hans\Desktop\Machinarium.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000000 ____D C:\Users\hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-27 14:34 - 2016-12-27 14:34 - 00000000 ____D C:\Users\hans\AppData\Local\Chromium

2016-12-24 15:36 - 2017-01-03 19:45 - 00016524 ____H C:\Users\Leo\AppData\Local\IconCache.db

2016-12-24 15:34 - 2017-01-02 23:10 - 00000000 ____D C:\Users\Leo\AppData\Local\ConnectedDevicesPlatform

2016-12-24 15:34 - 2016-12-24 15:34 - 00004676 __RSH C:\Users\Leo\ntuser.pol

2016-12-24 15:34 - 2016-12-24 15:34 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000020 ___SH C:\Users\Leo\ntuser.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000000 ____D C:\Users\Leo\AppData\Local\Comms

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\hans\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\hans\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2016-12-23 19:56 - 2016-12-23 19:56 - 11346638 _____ C:\Users\hans\Downloads\Amazon-Music-Download_2016-12-23_19-56.zip
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-20 19:04 - 2012-11-06 22:55 - 00000000 ____D C:\Users\hans\AppData\Roaming\Notepad++

2017-01-20 19:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness

2017-01-20 18:37 - 2016-11-18 18:33 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2017-01-20 18:05 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps

2017-01-20 14:30 - 2012-07-27 20:37 - 00000000 _____ C:\WINDOWS\Path.idx

2017-01-19 18:18 - 2016-03-06 11:45 - 00000000 ____D C:\Program Files (x86)\Steam

2017-01-19 18:18 - 2012-07-27 19:31 - 01048576 _____ C:\WINDOWS\PE_Rom.dll

2017-01-19 18:17 - 2015-05-19 22:05 - 00000000 __SHD C:\Users\hans\IntelGraphicsProfiles

2017-01-17 19:54 - 2015-11-08 11:57 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\Registry CC_Cleaner

2017-01-17 19:52 - 2016-01-02 16:24 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk

2017-01-16 23:54 - 2015-10-15 18:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2017-01-16 21:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache

2017-01-14 19:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports

2017-01-14 18:47 - 2016-11-18 18:38 - 03159026 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2017-01-14 18:47 - 2016-07-16 23:51 - 01357240 _____ C:\WINDOWS\system32\perfh007.dat

2017-01-14 18:47 - 2016-07-16 23:51 - 00348444 _____ C:\WINDOWS\system32\perfc007.dat

2017-01-14 18:38 - 2016-11-18 18:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2017-01-14 18:38 - 2015-06-16 19:22 - 00000000 ____D C:\ProgramData\firebird

2017-01-14 18:35 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI

2017-01-14 17:36 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM

2017-01-11 18:52 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF

2017-01-11 18:52 - 2015-10-23 20:52 - 00000000 __RHD C:\Users\Public\AccountPictures

2017-01-11 18:51 - 2013-10-09 12:21 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2017-01-11 07:55 - 2016-11-18 18:39 - 00000000 ____D C:\Users\DefaultAppPool

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed

2017-01-10 21:01 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp

2017-01-10 20:59 - 2013-08-16 22:43 - 00000000 ____D C:\WINDOWS\system32\MRT

2017-01-10 20:57 - 2012-07-28 17:25 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2017-01-07 15:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Mcx1-DELFINE

2017-01-07 15:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo

2017-01-05 17:40 - 2010-11-21 04:27 - 00485032 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2017-01-04 01:47 - 2016-11-18 18:45 - 00003858 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2017-01-03 20:05 - 2012-07-28 16:00 - 00000000 ____D C:\Users\hans\AppData\Local\Downloaded Installations

2017-01-03 19:45 - 2016-12-03 14:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2017-01-03 19:45 - 2012-09-07 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2017-01-02 22:41 - 2015-12-03 19:27 - 00000000 ____D C:\Users\Leo\AppData\Local\Packages

2017-01-02 22:39 - 2016-03-06 11:43 - 00002418 _____ C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2017-01-02 22:39 - 2016-03-06 11:43 - 00000000 ___RD C:\Users\Leo\OneDrive

2017-01-02 22:38 - 2015-06-07 17:59 - 00000000 __SHD C:\Users\Leo\IntelGraphicsProfiles

2016-12-31 20:36 - 2014-01-25 15:21 - 00000000 ____D C:\Users\hans\AppData\Roaming\KeePass

2016-12-31 13:23 - 2016-12-10 13:37 - 00000000 ____D C:\ProgramData\Foxit Software

2016-12-31 13:23 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Documents

2016-12-31 13:14 - 2012-07-30 21:48 - 00000000 ____D C:\Users\hans\AppData\Roaming\Foxit Software

2016-12-31 12:57 - 2012-07-28 16:00 - 00000000 ____D C:\ProgramData\Sonos,_Inc

2016-12-28 19:03 - 2015-07-24 14:57 - 00000000 ____D C:\Users\hans\AppData\Roaming\vlc

2016-12-28 19:01 - 2016-11-18 18:39 - 00000000 ____D C:\Users\hans

2016-12-27 16:02 - 2016-03-06 11:57 - 00000000 ____D C:\Users\hans\AppData\Local\Steam

2016-12-27 14:32 - 2016-03-06 11:45 - 00001036 _____ C:\Users\Public\Desktop\Steam.lnk

2016-12-27 14:32 - 2016-03-06 11:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-24 15:42 - 2016-12-03 14:44 - 00000000 ____D C:\WINDOWS\Minidump

2016-12-24 15:36 - 2016-11-18 18:39 - 00524288 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TMContainer00000000000000000001.regtrans-ms

2016-12-24 15:36 - 2016-11-18 18:39 - 00065536 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TM.blf

2016-12-24 15:36 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo\AppData\Local

2016-12-24 15:34 - 2016-11-18 18:39 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Downloads\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Desktop\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Searches

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Contacts

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Videos

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Saved Games

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Pictures

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Music

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Links

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Favorites

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Downloads

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Documents

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Desktop

2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2016-12-22 20:53 - 2015-12-28 19:04 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\My Digital Editions
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2017-01-04 20:21 - 2017-01-04 20:21 - 0681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2015-11-01 17:56 - 2015-11-01 17:56 - 0000000 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\hans\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2015-05-25 10:28 - 2015-05-25 10:28 - 0000093 _____ () C:\Users\hans\AppData\Roaming\ARCompanion.log

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\hans\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2014-02-07 19:26 - 2014-02-07 19:26 - 0000044 _____ () C:\Users\hans\AppData\Roaming\WB.CFG

2012-09-23 14:57 - 2016-06-22 20:06 - 0012800 _____ () C:\Users\hans\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-12-29 11:00 - 2013-12-29 11:00 - 0000093 _____ () C:\Users\hans\AppData\Local\fusioncache.dat

2016-01-30 16:21 - 2016-01-30 16:47 - 0000026 _____ () C:\Users\hans\AppData\Local\isoworkshop.ini

2013-02-09 18:39 - 2013-02-09 18:40 - 0000600 _____ () C:\Users\hans\AppData\Local\PUTTY.RND

2012-07-28 01:07 - 2012-09-14 22:37 - 0007597 _____ () C:\Users\hans\AppData\Local\Resmon.ResmonCfg

2013-09-25 18:08 - 2016-01-30 16:12 - 0000085 ___SH () C:\ProgramData\.zreglib

2012-07-29 16:35 - 2012-07-29 18:52 - 0000297 _____ () C:\ProgramData\Gpu.log
 

Einige Dateien in TEMP:

====================

C:\Users\hans\AppData\Local\Temp\ginstall.dll
 
 

==================== Bamital & volsnap ======================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 

LastRegBack: 2017-01-14 18:48
 

==================== Ende von FRST.txt ============================

:hallo:

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort als Administrator zu starten!
Einige Programme, die wir hier verwenden, können unter Umständen von deinem Antiviren- oder Anti-Malwareprogramm fälschlicherweise als Bedrohung eingestuft werden. Die Sicherheitsprogramme können aufgrund eines bestimmten Programmverhaltens nicht zwischen "gut" oder "böse" unterscheiden und schlagen Alarm. Dabei handelt es sich um Fehlalarme, welche du getrost ignorieren kannst. Gegebenenfalls musst du deine Sicherheitssoftware vor der Ausführung eines Programms deaktivieren, damit unsere Bereinigungsvorgänge nicht beeinträchtigt werden.

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Danke für deine Mitarbeit!

Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel
- "Prefetch" Dateien
- Proxy
- Winsock
- Internet Explorer Richtlinien
- Chrome Richtlinien
Bestätige die Auswahl mit Ok.
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad.
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM nach dem Neustart, klicke auf Berichte.
Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von JRT,
die beiden neuen Logdateien von FRST.

Hallo Matthias,
erst einmal vorweg vielen Dank für Deine Hilfe!
Ich bin nach den Anweisungen in der Email vorgegangen. In dieser war unter Schritt 3 nichts enthalten, daher bin ich direkt zu Schritt 4 übergegangen.
Am Ende der Mail habe ich in der Gesamtliste nun gelesen, dass Du einen JRT-Log haben möchtest. Davon hatte ich bisher nichts gelesen, hab daraufhin hier im Board nachgesehen, und siehe da: Hier war im Gegensatz zur Mail unter Schritt 3 das Procedere mit JRT beschrieben.

Sollte ich daher, den Schritt 3 nachholen und den Schritt 4 wiederholen?
VG

Ok, habe jetzt einfach mal den 3. Schritt nachgeholt (JRT) und den Schritt 4 (FRST) wiederholt. Anbei die LOGs. Addition-LOG kommt infolge der Größe im Nachgang.

adwcleaner:

Code:

# AdwCleaner v6.042 - Bericht erstellt am 21/01/2017 um 14:08:06

# Aktualisiert am 06/01/2017 von Malwarebytes

# Datenbank : 2017-01-20.2 [Server]

# Betriebssystem : Windows 10 Pro  (X64)

# Benutzername : Joerg - DELFINE

# Gestartet von : C:\Users\Joerg\Desktop\AdwCleaner_6.042.exe

# Modus: Löschen

# Unterstützung : https://www.malwarebytes.com/support
 
 
 

***** [ Dienste ] *****
 
 
 

***** [ Ordner ] *****
 

[-] Ordner gelöscht: C:\Users\Joerg\AppData\Local\Geckofx
 
 

***** [ Dateien ] *****
 

[-] Datei gelöscht: C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\invalidprefs.js
 
 

***** [ DLL ] *****
 
 
 

***** [ WMI ] *****
 
 
 

***** [ Verknüpfungen ] *****
 
 
 

***** [ Aufgabenplanung ] *****
 
 
 

***** [ Registrierungsdatenbank ] *****
 

[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\Prod.cap

[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\Prod.cap

[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

[-] Schlüssel gelöscht: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\APN PIP

[-] Schlüssel gelöscht: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\mysearchdial.com

[-] Schlüssel gelöscht: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\PIP

[-] Schlüssel gelöscht: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\Softonic

[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\SweetIM

[#] Schlüssel mit Neustart gelöscht: HKCU\Software\APN PIP

[#] Schlüssel mit Neustart gelöscht: HKCU\Software\mysearchdial.com

[#] Schlüssel mit Neustart gelöscht: HKCU\Software\PIP

[#] Schlüssel mit Neustart gelöscht: HKCU\Software\Softonic

[-] Schlüssel gelöscht: HKLM\SOFTWARE\PIP

[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\SweetIM

[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\APN PIP

[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\mysearchdial.com

[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\PIP

[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Softonic
 
 

***** [ Browser ] *****
 

[-] Firefox Einstellungen bereinigt: "extensions.delta.admin" -  false

[-] Firefox Einstellungen bereinigt: "extensions.delta.aflt" -  "babsst"

[-] Firefox Einstellungen bereinigt: "extensions.delta.appId" -  "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"

[-] Firefox Einstellungen bereinigt: "extensions.delta.autoRvrt" -  "false"

[-] Firefox Einstellungen bereinigt: "extensions.delta.dfltLng" -  "de"

[-] Firefox Einstellungen bereinigt: "extensions.delta.excTlbr" -  false

[-] Firefox Einstellungen bereinigt: "extensions.delta.ffxUnstlRst" -  true

[-] Firefox Einstellungen bereinigt: "extensions.delta.id" -  "44584158000000000000b6dbc94b9bfc"

[-] Firefox Einstellungen bereinigt: "extensions.delta.instlDay" -  "15942"

[-] Firefox Einstellungen bereinigt: "extensions.delta.instlRef" -  "sst"

[-] Firefox Einstellungen bereinigt: "extensions.delta.newTab" -  false

[-] Firefox Einstellungen bereinigt: "extensions.delta.prdct" -  "delta"

[-] Firefox Einstellungen bereinigt: "extensions.delta.prtnrId" -  "delta"

[-] Firefox Einstellungen bereinigt: "extensions.delta.rvrt" -  "false"

[-] Firefox Einstellungen bereinigt: "extensions.delta.smplGrp" -  "none"

[-] Firefox Einstellungen bereinigt: "extensions.delta.tlbrId" -  "base"

[-] Firefox Einstellungen bereinigt: "extensions.delta.tlbrSrchUrl" -  ""

[-] Firefox Einstellungen bereinigt: "extensions.delta.vrsn" -  "1.8.24.6"

[-] Firefox Einstellungen bereinigt: "extensions.delta.vrsnTs" -  "1.8.24.620:01:51"

[-] Firefox Einstellungen bereinigt: "extensions.delta.vrsni" -  "1.8.24.6"

[-] Firefox Einstellungen bereinigt: "extensions.delta_i.babExt" -  ""

[-] Firefox Einstellungen bereinigt: "extensions.delta_i.babTrack" -  "affID=121564&tsp=4985"

[-] Firefox Einstellungen bereinigt: "extensions.delta_i.srcExt" -  "ss"

[-] Firefox Einstellungen bereinigt: "extensions.irmysearch.aflt" -  "irmsd0103"

[-] Firefox Einstellungen bereinigt: "extensions.irmysearch.cd" -  "2XzuyEtN2Y1L1Qzu0ByC0D0B0CzyyE0Bzy0B0F0CyEtCyDzztN0D0Tzu0CyByCzytN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R"

[-] Firefox Einstellungen bereinigt: "extensions.irmysearch.cr" -  "150302635"

[-] Firefox Einstellungen bereinigt: "extensions.irmysearch.instlRef" -  ""

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.AL" -  2

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.aflt" -  "irmsd0103"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.appId" -  "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.cd" -  "2XzuyEtN2Y1L1Qzu0ByC0D0B0CzyyE0Bzy0B0F0CyEtCyDzztN0D0Tzu0CyByCzytN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.cr" -  "150302635"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.dfltLng" -  ""

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.dfltSrch" -  true

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.dnsErr" -  true

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.excTlbr" -  false

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.hmpg" -  true

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.hmpgUrl" -  "hxxp://start.mysearchdial.com/?f=1&a=irmsd0103&cd=2XzuyEtN2Y1L1Qzu0ByC0D0B0CzyyE0Bzy0B0F0CyEtCyDzztN0D0Tzu0CyByCzytN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=150302635&ir="

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.id" -  "B6DBC94B9BFC4158"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.instlDay" -  "16108"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.instlRef" -  ""

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.newTabUrl" -  "hxxp://start.mysearchdial.com/?f=2&a=irmsd0103&cd=2XzuyEtN2Y1L1Qzu0ByC0D0B0CzyyE0Bzy0B0F0CyEtCyDzztN0D0Tzu0CyByCzytN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=150302635&ir="

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.prdct" -  "mysearchdial"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.prtnrId" -  "mysearchdial"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.srchPrvdr" -  "Mysearchdial"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.tlbrId" -  "base"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.tlbrSrchUrl" -  "hxxp://start.mysearchdial.com/?f=3&a=irmsd0103&cd=2XzuyEtN2Y1L1Qzu0ByC0D0B0CzyyE0Bzy0B0F0CyEtCyDzztN0D0Tzu0CyByCzytN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=150302635&ir=&q="

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.vrsn" -  "1.8.21.0"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial.vrsni" -  "1.8.21.0"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial_i.hmpg" -  true

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial_i.newTab" -  false

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial_i.smplGrp" -  "none"

[-] Firefox Einstellungen bereinigt: "extensions.mysearchdial_i.vrsnTs" -  "1.8.21.019:25:58"

[-] [C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gelöscht: mysearchdial.com
 
 

*************************
 

:: "Tracing" Schlüssel gelöscht

:: Winsock Einstellungen zurückgesetzt

:: "Prefetch" Dateien gelöscht

:: Proxy Einstellungen zurückgesetzt

:: Internet Explorer Richtlinien gelöscht

:: Chrome Richtlinien gelöscht
 

*************************
 

C:\AdwCleaner\AdwCleaner[C0].txt - [7825 Bytes] - [21/01/2017 14:08:06]

C:\AdwCleaner\AdwCleaner[S0].txt - [11138 Bytes] - [21/01/2017 14:06:24]
 

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [7972 Bytes] ##########

MBAM:

Code:

Malwarebytes

www.malwarebytes.com
 

-Protokolldetails-

Scan-Datum: 21.01.17

Scan-Zeit: 14:22

Protokolldatei: mbam.txt

Administrator: Ja
 

-Softwaredaten-

Version: 3.0.5.1299

Komponentenversion: 1.0.43

Version des Aktualisierungspakets: 1.0.1069

Lizenz: Testversion
 

-Systemdaten-

Betriebssystem: Windows 10

CPU: x64

Dateisystem: NTFS

Benutzer: DELFINE\Joerg
 

-Scan-Übersicht-

Scan-Typ: Bedrohungs-Scan

Ergebnis: Abgeschlossen

Gescannte Objekte: 535663

Abgelaufene Zeit: 2 Min., 58 Sek.
 

-Scan-Optionen-

Speicher: Aktiviert

Start: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

-Scan-Details-

Prozess: 0

(keine bösartigen Elemente erkannt)
 

Modul: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsschlüssel: 2

PUP.Optional.OpenCandy, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\OpenCandyHelperRunAsStandardUser39F652A7FEF04373A7D826A4FB8638DB, In Quarantäne, [646], [241417],1.0.1069

PUP.Optional.OpenCandy, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\OpenCandyHelperRunOnce7511DA7BB18F4EF0AC0ADBB00F8CFA7A, In Quarantäne, [646], [241417],1.0.1069
 

Registrierungswert: 0

(keine bösartigen Elemente erkannt)
 

Daten-Stream: 0

(keine bösartigen Elemente erkannt)
 

Ordner: 0

(keine bösartigen Elemente erkannt)
 

Datei: 0

(keine bösartigen Elemente erkannt)
 

Physischer Sektor: 0

(keine bösartigen Elemente erkannt)
 
 

(end)

JRT:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.1.0 (12.05.2016)

Operating System: Windows 10 Pro x64 

Ran by hans (Administrator) on 21.01.2017 at 15:14:41,29

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

File System: 2 
 

Successfully deleted: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\user.js (File) 

Successfully deleted: C:\Users\hans\AppData\Roaming\pdfforge (Folder) 
 
 
 

Registry: 6 
 

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} (Registry Key)

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84B94901-3645-4D80-A6B7-4D0050B19455} (Registry Key)

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E9E027BF-C3F3-4022-8F6B-8F6D39A59684} (Registry Key)

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84B94901-3645-4D80-A6B7-4D0050B19455} (Registry Key)

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E9E027BF-C3F3-4022-8F6B-8F6D39A59684} (Registry Key)

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{F090BE08-2E7E-4D60-8FAB-98ABFA425136} (Registry Value) 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 21.01.2017 at 15:15:46,03

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 18-01-2017

durchgeführt von hans (Administrator) auf DELFINE (21-01-2017 15:20:29)

Gestartet von C:\Users\hans\Desktop

Geladene Profile: hans &  (Verfügbare Profile: hans & Mcx1-DELFINE & Leo & DefaultAppPool)

Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(Axis Communications AB) C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe

(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\epson\MyEpson Portal\mepService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe

(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 

==================== Registry (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-26] (Logitech, Inc.)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [ASUS WiFi GO! FileTransfer Execute] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFile\WiFileTransfer.exe [1376896 2012-04-12] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917576 2016-12-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [407904 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153952 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AXIS Camera Management Service Control] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmAdmin.exe [1834160 2015-05-08] (Axis Communications AB)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Plugin Install] => C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe [86016 2016-04-05] ()

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: igfxdev.dll [X]

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000002] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\SpybotSearchDestroy2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [EPLTarget\P0000000000000002] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\SpybotSearchDestroy2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [EPLTarget\P0000000000000002] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\SpybotSearchDestroy2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141955985\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141955985\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141955985\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\...\RunOnce: [Uninstall 17.3.6381.0405\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\...\RunOnce: [Uninstall 17.3.6381.0405] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956158\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-04-18] (Deutsche Telekom AG)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2014-02-03]

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Philips GoGear SA4VBE Device Manager.lnk [2013-06-14]

ShortcutTarget: Philips GoGear SA4VBE Device Manager.lnk -> C:\Program Files (x86)\Philips\GoGear SA4VBE Device Manager\GoGear_SA4VBE_DeviceManager.exe (Philips)

Startup: C:\Users\hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk [2012-07-27]

ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{280df009-71d1-45e6-bca3-de9ca51bc6ef}: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{ec71dbf0-98cf-4b04-8ee2-cceb81b9b1a9}: [DhcpNameServer] 192.168.178.1
 

Internet Explorer:

==================

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKLM-x32 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-03] (Oracle Corporation)

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-03] (Oracle Corporation)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)
 

FireFox:

========

FF ProfilePath: C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default [2017-01-21]

FF Extension: (Philips GoGear Device Manager) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\gogear@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (German (de) Language Pack) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\langpack-de@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MSC Device Support) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\msc@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MTP Device Support) - C:\Users\hans\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\mtp@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\albumart@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\gonzo@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\philips-addon-manager@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\pinkmartini@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\purplerain@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\sharing@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\soundboard@songbirdnest.com [nicht gefunden]

FF ProfilePath: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default [2017-01-21]

FF Homepage: Mozilla\Firefox\Profiles\cnn104yu.default -> hxxp://www.google.de

FF NetworkProxy: Mozilla\Firefox\Profiles\cnn104yu.default -> type", 0

FF Extension: (Avira Browser Safety) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\abs@avira.com [2016-11-23] [ist nicht signiert]

FF Extension: (Brief) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\brief@mozdev.org.xpi [2016-06-12]

FF Extension: (Clipple) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\clipple@mooz.github.com.xpi [2016-02-17]

FF Extension: (ProxTube) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\ich@maltegoetz.de.xpi [2016-10-17]

FF Extension: (Download YouTube Videos, Fast And Simple) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\jid1-cHKBMlArKdIVEg@jetpack.xpi [2016-04-30]

FF Extension: (Vlc Kontextmenü) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlcplaylist@helgatauscher.de.xpi [2016-04-30]

FF Extension: (VLC Youtube Shortcut) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlc_shortcut@kosan.kosan.xpi [2016-12-01]

FF Extension: (All-in-One Sidebar) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2016-04-10]

FF Extension: (Amazon Startcenter) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{144D1513-0819-4538-AD26-D515AF443AE7} [2016-11-26]

FF Extension: (Home Extension) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259} [2016-11-26]

FF Extension: (Amazon Statusbar Button) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{32DD6873-2BC0-4E4B-B9A3-0E602AB0DC14} [2016-11-26]

FF Extension: (Real Player Plugin) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{5bde3c21-2fd4-4f4a-8726-253ac3af4675}.xpi [2016-05-19] [ist nicht signiert]

FF Extension: (NoScript) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-01-20]

FF Extension: (CSSHelper) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{89e65ea8-9e30-489d-8269-7ba28535378a}.xpi [2015-12-24] [ist nicht signiert]

FF Extension: (Clippings) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271} [2016-11-04]

FF Extension: (Biet-O-Matic Firefox Erweiterung) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{B0D70E72-2FC1-4b9f-A3D4-5921C854D906}.xpi [2012-12-08] [ist nicht signiert]

FF Extension: (Preispiraten) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C} [2016-01-16]

FF Extension: (Adblock Plus) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]

FF Extension: (Tab Mix Plus) - C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2017-01-14]

FF SearchPlugin: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\dudende-suche.xml [2012-07-29]

FF SearchPlugin: C:\Users\hans\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\stadtbibliothek-stadt.xml [2016-04-01]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2016-01-30] [ist nicht signiert]

FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on

FF Extension: (E-Web Print) - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2015-08-18] [ist nicht signiert]

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-11] ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [Keine Datei]

FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin_x86_64.dll [2016-03-25] (Synology)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-11] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1206147.dll [2013-11-25] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2015-04-08] (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)

FF Plugin-x32: @graphisoft.com/GDL Web Plug-in -> C:\Program Files (x86)\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-14] (Graphisoft SE)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-03] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-03] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin.dll [2016-03-25] (Synology)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @sun.com/npsopluginmi;version=1.0 -> C:\Program Files (x86)\OpenOffice.org 3\program [Keine Datei]

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\hans\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-03] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740: @sun.com/npsopluginmi;version=1.0 -> C:\Program Files (x86)\OpenOffice.org 3\program [Keine Datei]

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\hans\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-03] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452: @sun.com/npsopluginmi;version=1.0 -> C:\Program Files (x86)\OpenOffice.org 3\program [Keine Datei]

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\hans\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-03] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-08-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2016-04-05] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2016-04-05] (Apple Inc.)
 

Chrome: 

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default [2017-01-21]

CHR Extension: (Google Präsentationen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-09]

CHR Extension: (Google Docs) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-09]

CHR Extension: (Google Drive) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-29]

CHR Extension: (YouTube) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-29]

CHR Extension: (Google Cast) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-11-20]

CHR Extension: (Google-Suche) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]

CHR Extension: (Google Tabellen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-09]

CHR Extension: (Google Docs Offline) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-20]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-20]

CHR Extension: (Google Mail) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-09]

CHR Extension: (Chrome Media Router) - C:\Users\hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-20]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
 

==================== Dienste (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1089592 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1490296 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-07-28] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe [1473664 2012-07-28] (ASUSTeK Computer Inc.)

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)

R2 AXIS Camera Management; C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe [18432 2015-05-08] (Axis Communications AB) [Datei ist nicht signiert]

R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)

R2 EPSON_PM_RPCV4_06; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [152640 2013-04-15] (SEIKO EPSON CORPORATION)

R2 FoxitReaderService; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\FoxitConnectedPDFService.exe [1659592 2016-11-15] (Foxit Software Inc.)

R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)

R2 MyEpson Portal Service; C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe [703984 2014-09-22] (SEIKO EPSON CORPORATION)

R2 SDScannerService; C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-11-18] (Microsoft Corporation)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2015-05-11] () [Datei ist nicht signiert]

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ======================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [151352 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [153904 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [78208 2016-06-04] (Avira Operations GmbH & Co. KG)

S3 GenericMount; C:\WINDOWS\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)

R3 ikbevent; C:\WINDOWS\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()

R3 imsevent; C:\WINDOWS\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

S3 WPRO_41_2001; C:\WINDOWS\System32\drivers\WPRO_41_2001.sys [34752 2013-01-28] ()

U3 idsvc; kein ImagePath
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-21 15:20 - 2017-01-21 15:20 - 00044786 _____ C:\Users\hans\Desktop\FRST.txt

2017-01-21 15:15 - 2017-01-21 15:18 - 00001651 _____ C:\Users\hans\Desktop\JRT.txt

2017-01-21 15:10 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-151036.backup

2017-01-21 14:58 - 2017-01-21 15:14 - 01663040 _____ (Malwarebytes) C:\Users\hans\Desktop\JRT.exe

2017-01-21 14:40 - 2017-01-21 14:44 - 00102391 _____ C:\Users\hans\Desktop\Addition_1b.txt

2017-01-21 14:39 - 2017-01-21 14:43 - 00086783 _____ C:\Users\hans\Desktop\FRST_1b.txt

2017-01-21 14:28 - 2017-01-21 14:28 - 00001533 _____ C:\Users\hans\Desktop\mbam.txt

2017-01-21 14:20 - 2017-01-21 14:21 - 00091584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys

2017-01-21 14:20 - 2017-01-21 14:20 - 00176064 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys

2017-01-21 14:20 - 2017-01-21 14:20 - 00102856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys

2017-01-21 14:19 - 2017-01-21 14:19 - 00250816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2017-01-21 14:19 - 2017-01-21 14:19 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2017-01-21 14:19 - 2017-01-21 14:19 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\Program Files\Malwarebytes

2017-01-21 14:19 - 2016-12-14 12:55 - 00077416 _____ C:\WINDOWS\system32\Drivers\mbae64.sys

2017-01-21 14:13 - 2017-01-21 14:13 - 00001066 _____ C:\Users\hans\Desktop\AdwCleaner[C0].txt - Verknüpfung.lnk

2017-01-21 14:04 - 2017-01-21 14:08 - 00000000 ____D C:\AdwCleaner

2017-01-21 14:00 - 2017-01-21 14:00 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini

2017-01-21 13:58 - 2017-01-21 14:03 - 03988944 _____ C:\Users\hans\Desktop\AdwCleaner_6.042.exe

2017-01-20 21:03 - 2017-01-20 21:03 - 00019360 _____ C:\Users\hans\Desktop\Addition_1.7z

2017-01-20 20:58 - 2017-01-20 20:58 - 00989855 _____ C:\Users\hans\Desktop\AVSCAN-20170119-210753-35D54530_1.zip

2017-01-20 19:26 - 2017-01-21 14:36 - 00102416 _____ C:\Users\hans\Desktop\Addition_1a.txt

2017-01-20 19:25 - 2017-01-21 14:36 - 00086878 _____ C:\Users\hans\Desktop\FRST_1a.txt

2017-01-20 19:24 - 2017-01-21 15:20 - 00000000 ____D C:\FRST

2017-01-20 19:23 - 2017-01-20 19:24 - 02419712 _____ (Farbar) C:\Users\hans\Desktop\FRST64.exe

2017-01-20 19:03 - 2017-01-20 19:03 - 00000475 _____ C:\Users\hans\Desktop\Trojaner.txt

2017-01-16 23:51 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170116-235155.backup

2017-01-14 19:14 - 2017-01-14 19:14 - 00000000 ____D C:\Users\hans\AppData\Roaming\Amanita-Design.Samorost3

2017-01-14 18:35 - 2017-01-14 18:38 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware

2017-01-10 23:50 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-235007.backup

2017-01-10 21:23 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-212324.backup

2017-01-10 20:16 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-201615.backup

2017-01-10 19:32 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll

2017-01-10 19:32 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2017-01-10 19:32 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2017-01-10 19:32 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2017-01-10 19:32 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll

2017-01-10 19:32 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2017-01-10 19:32 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe

2017-01-10 19:32 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2017-01-10 19:32 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2017-01-10 19:32 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll

2017-01-10 19:32 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2017-01-10 19:32 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll

2017-01-10 19:32 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe

2017-01-10 19:32 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe

2017-01-10 19:32 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll

2017-01-10 19:32 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2017-01-10 19:32 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2017-01-10 19:32 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2017-01-10 19:32 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll

2017-01-10 19:32 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe

2017-01-10 19:32 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2017-01-10 19:32 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2017-01-10 19:32 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2017-01-10 19:32 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll

2017-01-10 19:32 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2017-01-10 19:32 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2017-01-10 19:32 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll

2017-01-10 19:32 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2017-01-10 19:32 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2017-01-10 19:32 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2017-01-10 19:32 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2017-01-10 19:32 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:32 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2017-01-10 19:31 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2017-01-10 19:31 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll

2017-01-10 19:31 - 2016-12-21 08:45 - 00153952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcmiplugin.dll

2017-01-10 19:31 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2017-01-10 19:31 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2017-01-10 19:31 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2017-01-10 19:31 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2017-01-10 19:31 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll

2017-01-10 19:31 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll

2017-01-10 19:31 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2017-01-10 19:31 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe

2017-01-10 19:31 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2017-01-10 19:31 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2017-01-10 19:31 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll

2017-01-10 19:31 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2017-01-10 19:31 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll

2017-01-10 19:31 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll

2017-01-10 19:31 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll

2017-01-10 19:31 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2017-01-10 19:31 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll

2017-01-10 19:31 - 2016-12-21 06:03 - 00136544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqmigplugin.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll

2017-01-10 19:31 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2017-01-10 19:31 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll

2017-01-10 19:31 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2017-01-10 19:31 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2017-01-10 19:31 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe

2017-01-10 19:31 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll

2017-01-10 19:31 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys

2017-01-10 19:31 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2017-01-10 19:31 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll

2017-01-10 19:31 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll

2017-01-10 19:31 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2017-01-10 19:31 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll

2017-01-10 19:31 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2017-01-10 19:31 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll

2017-01-10 19:31 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2017-01-10 19:31 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2017-01-10 19:31 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2017-01-10 19:31 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2017-01-10 19:31 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2017-01-09 18:22 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170109-182203.backup

2017-01-07 15:05 - 2017-01-11 18:51 - 00263016 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2017-01-06 19:49 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170106-194925.backup

2017-01-04 20:25 - 2017-01-04 20:25 - 00001333 _____ C:\Users\hans\Desktop\OOSU10861.exe - Verknüpfung.lnk

2017-01-04 20:21 - 2017-01-04 20:21 - 00681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2017-01-04 18:35 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-183515.backup

2017-01-04 00:41 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004142.backup

2017-01-04 00:40 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004028.backup

2017-01-04 00:33 - 2017-01-04 00:33 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\ProcAlyzer Dumps

2017-01-04 00:27 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files\Common Files\AV

2017-01-04 00:26 - 2017-01-04 00:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2017-01-04 00:26 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files (x86)\SpybotSearchDestroy2

2017-01-04 00:26 - 2017-01-04 00:26 - 00001401 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpybotSearchDestroy2

2017-01-04 00:26 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2017-01-03 20:05 - 2017-01-03 20:05 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH

2017-01-02 22:39 - 2017-01-02 22:39 - 00003270 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2

2017-01-02 22:38 - 2017-01-02 22:38 - 00000000 ____D C:\Users\Leo\AppData\Roaming\Skype

2016-12-28 19:03 - 2016-12-28 19:03 - 00001189 _____ C:\Users\hans\Desktop\MediathekView.lnk

2016-12-28 19:01 - 2016-12-29 20:58 - 00000000 ____D C:\Users\hans\.mediathek3

2016-12-28 18:58 - 2016-12-28 19:03 - 00000000 ____D C:\Program Files (x86)\MediathekView12

2016-12-28 18:55 - 2017-01-02 20:18 - 00000000 ____D C:\Users\hans\AppData\Roaming\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00001989 _____ C:\Users\Public\Desktop\TV-Browser.lnk

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\Program Files (x86)\TV-Browser

2016-12-27 18:27 - 2017-01-11 20:37 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\BotaniculaSaves

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\hans\Desktop\Samorost 3.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\hans\Desktop\Botanicula.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\hans\Desktop\Samorost 2.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\hans\Desktop\Machinarium.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000000 ____D C:\Users\hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-27 14:34 - 2016-12-27 14:34 - 00000000 ____D C:\Users\hans\AppData\Local\Chromium

2016-12-24 15:36 - 2017-01-03 19:45 - 00016524 ____H C:\Users\Leo\AppData\Local\IconCache.db

2016-12-24 15:34 - 2017-01-02 23:10 - 00000000 ____D C:\Users\Leo\AppData\Local\ConnectedDevicesPlatform

2016-12-24 15:34 - 2016-12-24 15:34 - 00004676 __RSH C:\Users\Leo\ntuser.pol

2016-12-24 15:34 - 2016-12-24 15:34 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000020 ___SH C:\Users\Leo\ntuser.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000000 ____D C:\Users\Leo\AppData\Local\Comms

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\hans\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\hans\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2016-12-23 19:56 - 2016-12-23 19:56 - 11346638 _____ C:\Users\hans\Downloads\Amazon-Music-Download_2016-12-23_19-56.zip
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-21 14:17 - 2016-11-18 18:38 - 03246596 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2017-01-21 14:17 - 2016-07-16 23:51 - 01404304 _____ C:\WINDOWS\system32\perfh007.dat

2017-01-21 14:17 - 2016-07-16 23:51 - 00361998 _____ C:\WINDOWS\system32\perfc007.dat

2017-01-21 14:16 - 2012-07-27 20:37 - 00000000 _____ C:\WINDOWS\Path.idx

2017-01-21 14:11 - 2016-03-06 11:45 - 00000000 ____D C:\Program Files (x86)\Steam

2017-01-21 14:11 - 2012-07-27 19:31 - 01048576 _____ C:\WINDOWS\PE_Rom.dll

2017-01-21 14:10 - 2015-05-19 22:05 - 00000000 __SHD C:\Users\hans\IntelGraphicsProfiles

2017-01-21 14:09 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM

2017-01-21 14:09 - 2015-06-16 19:22 - 00000000 ____D C:\ProgramData\firebird

2017-01-21 14:08 - 2016-11-18 18:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2017-01-21 14:08 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI

2017-01-21 14:07 - 2016-11-18 18:55 - 00000008 __RSH C:\Users\hans\ntuser.pol

2017-01-21 14:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\hans

2017-01-21 14:07 - 2013-12-27 15:25 - 00000008 __RSH C:\ProgramData\ntuser.pol

2017-01-21 14:00 - 2016-11-18 18:39 - 00000000 ____D C:\Users\DefaultAppPool

2017-01-20 19:04 - 2012-11-06 22:55 - 00000000 ____D C:\Users\hans\AppData\Roaming\Notepad++

2017-01-20 19:03 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness

2017-01-20 18:37 - 2016-11-18 18:33 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2017-01-20 18:05 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps

2017-01-17 19:54 - 2015-11-08 11:57 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\Registry CC_Cleaner

2017-01-16 23:54 - 2015-10-15 18:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2017-01-16 21:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache

2017-01-14 19:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports

2017-01-11 18:52 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF

2017-01-11 18:52 - 2015-10-23 20:52 - 00000000 __RHD C:\Users\Public\AccountPictures

2017-01-11 18:51 - 2013-10-09 12:21 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed

2017-01-10 21:01 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp

2017-01-10 20:59 - 2013-08-16 22:43 - 00000000 ____D C:\WINDOWS\system32\MRT

2017-01-10 20:57 - 2012-07-28 17:25 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2017-01-07 15:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Mcx1-DELFINE

2017-01-07 15:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo

2017-01-05 17:40 - 2010-11-21 04:27 - 00485032 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2017-01-04 01:47 - 2016-11-18 18:45 - 00003858 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2017-01-03 20:05 - 2012-07-28 16:00 - 00000000 ____D C:\Users\hans\AppData\Local\Downloaded Installations

2017-01-03 19:45 - 2016-12-03 14:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2017-01-03 19:45 - 2012-09-07 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2017-01-02 22:41 - 2015-12-03 19:27 - 00000000 ____D C:\Users\Leo\AppData\Local\Packages

2017-01-02 22:39 - 2016-03-06 11:43 - 00002418 _____ C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2017-01-02 22:39 - 2016-03-06 11:43 - 00000000 ___RD C:\Users\Leo\OneDrive

2017-01-02 22:38 - 2015-06-07 17:59 - 00000000 __SHD C:\Users\Leo\IntelGraphicsProfiles

2016-12-31 20:36 - 2014-01-25 15:21 - 00000000 ____D C:\Users\hans\AppData\Roaming\KeePass

2016-12-31 13:23 - 2016-12-10 13:37 - 00000000 ____D C:\ProgramData\Foxit Software

2016-12-31 13:23 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Documents

2016-12-31 13:14 - 2012-07-30 21:48 - 00000000 ____D C:\Users\hans\AppData\Roaming\Foxit Software

2016-12-31 12:57 - 2012-07-28 16:00 - 00000000 ____D C:\ProgramData\Sonos,_Inc

2016-12-28 19:03 - 2015-07-24 14:57 - 00000000 ____D C:\Users\hans\AppData\Roaming\vlc

2016-12-27 16:02 - 2016-03-06 11:57 - 00000000 ____D C:\Users\hans\AppData\Local\Steam

2016-12-27 14:32 - 2016-03-06 11:45 - 00001036 _____ C:\Users\Public\Desktop\Steam.lnk

2016-12-27 14:32 - 2016-03-06 11:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-24 15:42 - 2016-12-03 14:44 - 00000000 ____D C:\WINDOWS\Minidump

2016-12-24 15:36 - 2016-11-18 18:39 - 00524288 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TMContainer00000000000000000001.regtrans-ms

2016-12-24 15:36 - 2016-11-18 18:39 - 00065536 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TM.blf

2016-12-24 15:36 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo\AppData\Local

2016-12-24 15:34 - 2016-11-18 18:39 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Downloads\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Desktop\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Searches

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Contacts

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Videos

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Saved Games

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Pictures

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Music

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Links

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Favorites

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Downloads

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Documents

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Desktop

2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2016-12-22 20:53 - 2015-12-28 19:04 - 00000000 ____D C:\Users\hans\Aufnahmen\Documents\My Digital Editions
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2017-01-04 20:21 - 2017-01-04 20:21 - 0681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2015-11-01 17:56 - 2015-11-01 17:56 - 0000000 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\hans\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2015-05-25 10:28 - 2015-05-25 10:28 - 0000093 _____ () C:\Users\hans\AppData\Roaming\ARCompanion.log

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\hans\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2014-02-07 19:26 - 2014-02-07 19:26 - 0000044 _____ () C:\Users\hans\AppData\Roaming\WB.CFG

2012-09-23 14:57 - 2016-06-22 20:06 - 0012800 _____ () C:\Users\hans\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-12-29 11:00 - 2013-12-29 11:00 - 0000093 _____ () C:\Users\hans\AppData\Local\fusioncache.dat

2016-01-30 16:21 - 2016-01-30 16:47 - 0000026 _____ () C:\Users\hans\AppData\Local\isoworkshop.ini

2013-02-09 18:39 - 2013-02-09 18:40 - 0000600 _____ () C:\Users\hans\AppData\Local\PUTTY.RND

2012-07-28 01:07 - 2012-09-14 22:37 - 0007597 _____ () C:\Users\hans\AppData\Local\Resmon.ResmonCfg

2013-09-25 18:08 - 2016-01-30 16:12 - 0000085 ___SH () C:\ProgramData\.zreglib

2012-07-29 16:35 - 2012-07-29 18:52 - 0000297 _____ () C:\ProgramData\Gpu.log
 

Einige Dateien in TEMP:

====================

C:\Users\hans\AppData\Local\Temp\ginstall.dll
 
 

==================== Bamital & volsnap ======================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 

LastRegBack: 2017-01-14 18:48
 

==================== Ende von FRST.txt ============================

...und hier die letzte LOG (Addition):

Code:

ZusÃ¤tzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 18-01-2017

durchgefÃ¼hrt von hans (21-01-2017 15:20:46)

Gestartet von C:\Users\hans\Desktop

Windows 10 Pro Version 1607 (X64) (2016-11-18 17:46:59)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1412286257-1942420214-3619319362-500 - Administrator - Disabled)

ASPNET (S-1-5-21-1412286257-1942420214-3619319362-1006 - Limited - Enabled)

DefaultAccount (S-1-5-21-1412286257-1942420214-3619319362-503 - Limited - Disabled)

Gast (S-1-5-21-1412286257-1942420214-3619319362-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1412286257-1942420214-3619319362-1004 - Limited - Enabled)

hans (S-1-5-21-1412286257-1942420214-3619319362-1000 - Administrator - Enabled) => C:\Users\hans

Leo (S-1-5-21-1412286257-1942420214-3619319362-1007 - Limited - Enabled) => C:\Users\Leo

Mcx1-DELFINE (S-1-5-21-1412286257-1942420214-3619319362-1002 - Limited - Enabled) => C:\Users\Mcx1-DELFINE
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" kÃ¶nnen in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

AAVUpdateManager (HKLM-x32\...\{0D410F4D-9009-43F8-9DF1-BDADCE7FC43F}) (Version: 3.00.0000 - Akademische Arbeitsgemeinschaft)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)

Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.3 - Adobe Systems Incorporated)

Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 4.4 64-bit (HKLM\...\{11A955CD-4398-405A-886D-E464C3618FBF}) (Version: 4.4.1 - Adobe)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.6.147 - Adobe Systems, Inc.)

AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.04.02 - ASUSTeK Computer Inc.)

Amazon Kindle (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Amazon Kindle) (Version:  - Amazon)

Amazon Kindle (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Amazon Kindle) (Version:  - Amazon)

Amazon Kindle (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Amazon Kindle) (Version:  - Amazon)

Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Anno 1602 (HKLM-x32\...\ANNO1602) (Version:  - )

ape@map (HKLM-x32\...\{660ACE0D-40F7-47E0-BDF2-5ED0E0293BEC}) (Version: 3.6.0 - Onyx Technologie OG)

Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AquaSoft DiaShow 9 Ultimate (HKLM-x32\...\AquaSoft DiaShow 9 Ultimate) (Version: 9.5.16 - AquaSoft)

ArchiCAD 16 GER (HKLM\...\001FFF2FFF16FF00FF0201F01F02F000-R1) (Version: 16.0 - GRAPHISOFT)

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)

Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version:  - )

ASUS PC Diagnostics (HKLM-x32\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.2.5 - ASUSTeK Computer Inc.)

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.24.146 - Avira Operations GmbH & Co. KG)

Avira Connect (HKLM-x32\...\{707e8edf-9482-4417-ae39-c9b5fe605e87}) (Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG)

Avira Connect (x32 Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG) Hidden

AXIS Camera Companion 3.11 (HKLM\...\{A6FE3FFD-BD70-4FD6-A436-62417F0A81EB}_is1) (Version: 3.11.001 - Axis Communications AB)

Biet-O-Matic v2.14.8 (HKLM-x32\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)

Botanicula (HKLM\...\Steam App 207690) (Version:  - Amanita Design)

calibre 64bit (HKLM\...\{D8905AF6-9F72-4BD8-BF37-51C5760B3CD5}) (Version: 2.48.0 - Kovid Goyal)

CCleaner (HKLM\...\CCleaner) (Version: 5.26 - Piriform)

chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)

Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.2.100.14 - Citrix Systems, Inc.)

Coast Guard (HKLM-x32\...\Steam App 361200) (Version:  - Reality Twist GmbH)

Cuttermaran 1.70 (HKLM-x32\...\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}) (Version: 1.7.0 - toarnold)

Easy Photo Scan (HKLM-x32\...\{1A6DED1E-A024-455D-AA82-203D6B3B0CBC}) (Version: 1.00.0006 - Seiko Epson Corporation)

Epson Connect Printer Setup (HKLM-x32\...\{D9B1D51B-EB56-410D-AEB5-1CCFAC4B6C8C}) (Version: 1.3.0 - SEIKO EPSON CORPORATION)

Epson Easy Photo Print 2 (HKLM-x32\...\{07AA1C7F-E8CA-4FDC-B975-BC9EBC22B6DE}) (Version: 2.7.0.0 - SEIKO EPSON CORPORATION)

Epson Event Manager (HKLM-x32\...\{9F205E94-9E42-4486-A92A-DF3F6CB85444}) (Version: 3.10.0061 - Seiko Epson Corporation)

Epson E-Web Print (HKLM-x32\...\{6BF9F374-EC67-4808-A90C-F127DE6D989D}) (Version: 1.23.0000 - SEIKO EPSON CORPORATION)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)

EPSON XP-225 Series Printer Uninstall (HKLM\...\EPSON XP-225 Series) (Version:  - SEIKO EPSON Corporation)

EPSON-HandbÃ¼cher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.50.0.0 - SEIKO EPSON CORPORATION)

EpsonNet Print (HKLM\...\{15A0F113-BF2C-4C12-8AA8-42AE0D9AE1C9}) (Version: 3.1.2.0 - SEIKO EPSON Corporation)

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)

FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 8.1.4.1208 - Foxit Software Inc.)

Garmin BaseCamp (HKLM-x32\...\{23A4DBD1-D847-4957-995D-8B1CC527E2E2}) (Version: 4.6.2.0 - Garmin Ltd or its subsidiaries)

Garmin MapSource (HKLM-x32\...\{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}) (Version: 6.16.3 - Garmin Ltd or its subsidiaries)

Garmin USB Drivers (HKLM-x32\...\{510D2239-6C2E-457B-9590-485EC552D94D}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)

GoGear SA4VBE Device Manager (HKLM-x32\...\{E7CA2FE9-1BDB-455D-83A3-0B0D1466EAF9}) (Version: 1.00 - Ihr Firmenname)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)

Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)

Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)

Intel(R) Network Connections 20.0.10.0 (HKLM\...\PROSetDX) (Version: 20.0.10.0 - Intel)

Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)

Intel(R) Smart Connect Technology 2.0 x64 (HKLM\...\{54F8B6C7-9B25-4E85-A1E0-26CFB80DE787}) (Version: 2.0.1083.0 - Intel)

Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)

IntelÂ® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)

IntelÂ® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

IntelÂ® Watchdog Timer Driver (IntelÂ® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)

iTunes (HKLM\...\{76FF0F03-B707-4332-B5D1-A56C8303514E}) (Version: 11.0.4.4 - Apple Inc.)

Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)

JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)

JONA TA1 (HKLM-x32\...\JONA TA1_is1) (Version:  - JÃ¼bermann Verlag)

Kobo (HKLM-x32\...\Kobo) (Version: 4.0.5579 - Rakuten Kobo Inc.)

LameXP v4.07 (HKLM-x32\...\{FBD7A67D-D700-4043-B54F-DD106D00F308}) (Version: 4.07 Final-1 [Build #1286] - LoRd_MuldeR <mulder2@gmx.de>)

LibreOffice 4.1 Help Pack (German) (HKLM-x32\...\{43295475-62CA-4F25-B46C-43C59258780E}) (Version: 4.1.4.2 - The Document Foundation)

LibreOffice 4.3.7.2 (HKLM-x32\...\{8ED4A1FC-56CF-414C-A9AB-A37714AA9EA7}) (Version: 4.3.7.2 - The Document Foundation)

Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)

Machinarium (HKLM\...\Steam App 40700) (Version:  - Amanita Design)

Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)

Mediencenter 3.8.9799.6 (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Mediencenter) (Version: 3.8.9799.6 - Deutsche Telekom AG)

Mediencenter 3.8.9799.6 (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\Mediencenter) (Version: 3.8.9799.6 - Deutsche Telekom AG)

Mediencenter 3.8.9799.6 (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\Mediencenter) (Version: 3.8.9799.6 - Deutsche Telekom AG)

Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)

Mozilla Firefox 45.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 de)) (Version: 45.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.6.0.6200 - Mozilla)

Mozilla Thunderbird 45.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.6.0 (x86 de)) (Version: 45.6.0 - Mozilla)

Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian Heidenreich)

MyEpson Portal (HKLM-x32\...\MyEpson Portal) (Version:  - SEIKO EPSON Corporation)

MyEpson Portal (x32 Version: 1.1.1.0 - SEIKO EPSON CORPORATION) Hidden

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.2 - )

NVIDIA PhysX v8.05.26 (HKLM-x32\...\{11AE6807-50D2-4F59-82B3-2C3E695E94C2}) (Version: 8.05.26 - NVIDIA Corporation)

Online Plug-in (x32 Version: 14.2.100.14 - Citrix Systems, Inc.) Hidden

OnlineFotoservice (HKLM-x32\...\OnlineFotoservice) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)

paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.1.1 - pdfforge)

phase-6 2.3.4 (HKLM-x32\...\phase-6) (Version: 2.3.4 - phase-6)

Philips Media Convertor v1.2   (HKLM-x32\...\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}) (Version: 4.45 -  )

Photo Station Uploader (remove only) (HKLM-x32\...\Photo Station Uploader) (Version:  - Synology)

PHOTOfunSTUDIO 6.5 BD Edition (HKLM-x32\...\{AD5B7E20-00E1-4B7B-84DC-53F5CEFFA367}) (Version: 6.05.818 - Panasonic Corporation)

PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )

POIbase 2.0.22 (HKLM-x32\...\POIbase_is1) (Version:  - POIbase)

Preispiraten (HKLM-x32\...\{5384EA8A-FECA-4D6E-B7B4-3D4D9D47E5DF}) (Version: 6 - metaspinner net GmbH)

Preispiraten 7 (HKLM-x32\...\{D746E113-378A-45A2-8EB0-DF00BD2454DE}) (Version: 7.1.1.0 - metaspinner net GmbH)

Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 9.2 - Qualcomm Atheros)

QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)

Republic Heroes (HKLM-x32\...\{5612C844-55BC-4B77-82C2-A2E28962418E}) (Version: 1.00.0000 - LucasArts)

Samorost 2 (HKLM\...\Steam App 40720) (Version:  - Amanita Design)

Samorost 3 (HKLM\...\Steam App 421120) (Version:  - Amanita Design)

SeaTools for Windows (HKLM-x32\...\{98613C99-1399-416C-A07C-1EE1C585D872}) (Version: 1.2.0.6 - Seagate Technology)

Self-Service Plug-in (x32 Version: 4.2.100.5943 - Citrix Systems, Inc.) Hidden

Skypeâ„¢ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION)

Sonos Controller (HKLM-x32\...\{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}) (Version: 34.7.35161 - Sonos, Inc.)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Steuer-Ratgeber 2016-2017 (HKLM-x32\...\{2D99CB45-87EE-4834-BB15-5DD59A024E4C}) (Version: 16.11.6 - Wolters Kluwer Deutschland GmbH)

Steuer-Spar-ErklÃ¤rung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2010 (HKLM-x32\...\{CE23D66A-B4D8-468B-B932-41159FA54E14}) (Version: 15.18 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.19.11 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.14 - Wolters Kluwer Deutschland GmbH)

Steuer-Spar-ErklÃ¤rung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)

SteuerSparErklÃ¤rung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.42.175 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2016 (HKLM-x32\...\{D331D50C-C578-423B-8BC7-94D3133CE315}) (Version: 21.37.107 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2017  (HKLM-x32\...\{45815686-22F8-4D24-872D-E481A654B230}) (Version: 22.20.35 - Wolters Kluwer Deutschland GmbH)

SurveillancePlugin (HKLM-x32\...\{DD3D6671-165A-4823-AB2F-F73316EE0C71}) (Version: 1.0.0.934 - Synology)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )

TomTom MyDrive Connect 4.1.1.2797 (HKLM-x32\...\MyDriveConnect) (Version: 4.1.1.2797 - TomTom)

TV-Browser 3.4.4 (HKLM-x32\...\tvbrowser) (Version: 3.4.4 - TV-Browser Team)

Unity Web Player (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Unity Web Player (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Unity Web Player (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

XMedia Recode Version 3.3.5.7 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.5.7 - XMedia Recode)

Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG)

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\hans\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {0249BE9D-7295-48C9-8EA3-41C4636235D7} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {0817A928-B064-4348-858D-6102DAB0D531} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {085E3A32-ECDB-4286-93A6-BE96375339A6} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {0FCEB1D2-4C5F-43A9-9BB9-189967BC4C32} - System32\Tasks\{1857F86E-A91E-42F3-98CD-513ABEF090DF} => D:\Setup\Setup.exe

Task: {1930B07F-67A5-419A-B34A-063D0A9F256C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {1C3443F6-171D-4A09-83F7-F32D1478114C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {1DB28F69-B61F-4BA9-8695-DCE839D6FF72} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe [2011-09-09] ()

Task: {2038D09C-5622-43D7-8758-4C878C8A60D4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe

Task: {2A7EAD93-6364-4194-B89C-A305D34BB5EE} - System32\Tasks\{A0932F3B-7471-4D67-857B-092DD058D72E} => msiexec.exe /package "C:\Users\hans\Downloads\MicrosoftFixit50123.msi"

Task: {2B3DAD67-1F2B-47D9-979F-D9DCCCB9DAD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe

Task: {2BB73430-C81E-4FF3-9D0A-19019A784E95} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {2C49CF5F-8B53-4CC6-8DAA-D8D47C4C729B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {2C6F490F-329D-4E0D-8E9A-156FE30A0CD0} - System32\Tasks\{D9BC4299-7B8A-46FE-95D0-B0FB0F052CA8} => pcalua.exe -a C:\Users\hans\Downloads\irfanview_plugins_433_setup.exe -d C:\Users\hans\Downloads

Task: {32AE5F22-5189-4C51-9DAB-8840F5580A8A} - System32\Tasks\ASUS\i-Setup225236 => C:\Windows\Chipset\AsusSetup.exe [2010-09-08] (ASUSTeK Computer Inc.)

Task: {33135665-B856-4771-B1C0-995F02BDABFE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-01-10] (Microsoft Corporation)

Task: {33B04117-EF5A-4814-AEE4-7C88C14ADAB9} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {3A38A368-F25C-4142-8202-17C71E472428} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-DELFINE => C:\WINDOWS\ehome\McxTask.exe

Task: {3AFE325C-F25F-4804-89C3-74D568FFB074} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {3BF6D36E-AC15-4EFD-840B-EBBD5575D133} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "hxxp://www.roboform.com/uninstall.html?aaa=KICMJMOJLMJJHMMMMJOMCNMMJMOJIMCNLMOMJJOJCNNJJJOMJMCNOJPMKMJJMJLMNMNJLMOMPMLJJNJICMIMCNGMCNNMFMGMCNOMOMCNGMJMPMPMFMJMCNOMCNIMJMPMOMCNNMJNPICMPMFMFMOMPMJNHICMEKMICNJJCKJNBJCMFLAJKJNIIJJNKJCMJNNICMJNDJCMLJKJ"

Task: {3C1A87E2-487C-4F64-904B-98FA2CBD98E7} - System32\Tasks\{B2308464-6499-4ABC-929A-920DF196783A} => pcalua.exe -a C:\Users\hans\Downloads\Intel_MEI_V8001262_XPVistaWin7\setup.exe -d C:\Users\hans\Downloads\Intel_MEI_V8001262_XPVistaWin7

Task: {3D1299CA-6366-4630-9EDE-416941473940} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {3D55EEDE-13C3-4151-AE28-BC0E9F25B815} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)

Task: {3DE316FA-36A0-4E43-A65C-BA97CDCAD874} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {42A3DC6D-3D60-4101-8260-C4FA4D6DDA4C} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {49A6CF7B-717F-46E6-9D08-BF1D4BC16702} - System32\Tasks\EPSON XP-225 Series Update {400C43AB-2E87-4983-A887-86105496B879} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {4A50958A-A184-434E-9E12-8EAC3B86D9E1} - System32\Tasks\{CD547849-DBC6-4B5E-AB12-A6920D3B22CE} => D:\Setup\Setup.exe

Task: {4A573E16-E200-4F13-A290-25BEC00FBD22} - System32\Tasks\{911A89DB-DBD8-4A27-858E-C4642650E149} => pcalua.exe -a D:\Setup.exe -d D:\

Task: {4CF1F731-41FC-4216-B898-C521E67F32D4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {4EA532CD-77F3-47B4-9D5D-888BF06C06FB} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {4F94B588-442D-4357-ADF0-CF6CE0C72462} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {50C0C005-93EF-42E4-84A2-AAB670263950} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {528CABAF-43C9-4AE7-B180-3FDD73E01148} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {5297443F-2E27-4209-86E3-9315B15FBFBF} - System32\Tasks\{F321C931-35DF-4923-94CE-B26E767B491C} => D:\Setup\Setup.exe

Task: {54A56059-C42A-4057-81C8-8BCE697EC1F7} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {589F8A18-086F-4C5A-A2C2-634E5BBEFC25} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {598E6758-D5FD-435E-BF77-6E4F26749D99} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {5BA370C3-34A9-4DAC-8EE1-9962A0DE9E18} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {5C26B83E-986B-4626-BDD9-F77615EC0D4A} - System32\Tasks\ASUS\ASUS Network iControl Help Execute => C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetSvcHelpEntry.exe [2012-05-02] (ASUSTeK Computer Inc.)

Task: {6492A934-A224-48E9-A4D7-66553F0C1E45} - System32\Tasks\{B50D7758-3420-49B0-8664-92A5FB1F6CC9} => pcalua.exe -a C:\Users\hans\Downloads\IRST_V11101006_XPWin7\Install\setup.exe -d C:\Users\hans\Downloads\IRST_V11101006_XPWin7\Install

Task: {64CB2651-4108-408F-A02E-13600C88F694} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {65D515D0-F153-4DE1-887E-FA3FC1B06D18} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {66DC2431-A42B-43D2-904C-518845E25722} - System32\Tasks\EPSON XP-225 Series Update {001F270C-F9BB-470F-B086-11C7F0EF0C45} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {7A9B340A-D2F3-4EE4-8817-6A6C7ABD0905} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {7E7476F9-7924-4351-8879-DE143BE5C861} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {82CD644B-6699-4A98-8530-1DC3028DA2A5} - System32\Tasks\{0049431D-45DD-4925-B4D3-C8F7996C2C5F} => D:\Setup\Setup.exe

Task: {887D0F05-A015-462B-899F-00230E3D665E} - System32\Tasks\EPSON XP-225 Series Update {8E8C44D1-647B-4702-87C3-50BD8D890228} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {8CDC8717-D6E5-4E71-939C-26AD26E5716C} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe

Task: {8D1A707C-742F-43D1-9B39-61D39A92946A} - System32\Tasks\ASUS\ASUS DigiPowerControl Help => C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe [2012-03-06] (ASUSTeK Computer Inc.)

Task: {8FA53CBD-4278-4AF4-9E4C-A027261C9FE7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {987D7137-1BB0-4471-85DE-80DDD02C91C3} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {990ADD2E-3761-41EE-B369-18BB4398F8D9} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe

Task: {9BAA51D7-1BB0-4978-A852-2C7ECD84B6E6} - System32\Tasks\EPSON XP-225 Series Update {D4D7AC37-2892-4C94-87B6-70E2D581C285} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {9D62EB8A-EE4B-4AED-A74F-2188219A43B0} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe

Task: {A0F66942-84FE-4673-82C9-330DF19BF862} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\SpybotSearchDestroy2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {A54BDE5D-A31F-4891-9B21-B7070CA3E40C} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {A55FB450-1D64-42B4-8762-0C696CB4B384} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\hans\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe

Task: {AE7FC220-2C08-4928-9F1A-A9D80A9F21ED} - System32\Tasks\ASUS\ASUS WiFi GO! Server Execute => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe [2012-04-19] (ASUSTeK Computer Inc.)

Task: {B6A1F721-876D-41AD-9C0B-30D2B79446FA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\SpybotSearchDestroy2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {B71C4802-D847-40F6-BEEA-AC0CDA6DA5FC} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe

Task: {BB07BFF0-CE0F-46FC-B250-22BDD6033EF1} - System32\Tasks\{BFA096D1-2D1E-4E62-A764-91FA3BAB5A2B} => D:\Setup\Setup.exe

Task: {C183258E-D8AC-400E-9B40-61EA48128590} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {C307EB96-F435-4A95-8D4D-C02C361D0E44} - System32\Tasks\ASUS\i-Setup204402 => C:\Windows\Chipset\AsusSetup.exe [2010-09-08] (ASUSTeK Computer Inc.)

Task: {C41353BE-8F62-4E96-9B38-1BF1856EB93D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-11] (Adobe Systems Incorporated)

Task: {C41DF22E-22E0-423D-BC74-FB1E2D81E455} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {C5319865-C6CC-4B39-8C63-6EAA72C05F28} - System32\Tasks\{125039C6-08E7-4D3A-B032-A1C55F876595} => pcalua.exe -a C:\Users\hans\Downloads\Intel_USB3_V104225_Win7\Intel\SetupUSB3_Dell.exe -d C:\Users\hans\Downloads\Intel_USB3_V104225_Win7\Intel

Task: {CD9C0807-169B-4A49-BD91-F4F0B80165EA} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {E1518AFD-7206-4F48-8036-5443ACAF7C7B} - System32\Tasks\{7E7A9016-FAAC-4DA4-8547-F849B4804155} => D:\Setup\Setup.exe

Task: {E23AFAFC-35F8-4B25-9586-ED2C1030F76D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-21] (Piriform Ltd)

Task: {E2C1F8A8-B6FD-4C06-8EF6-84D63F4BA583} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

Task: {EF4C2A81-37BA-424D-A992-D95965244269} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {F1426AEF-C1DF-42BE-9061-5FA83A524639} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {FD23DDF3-51C0-45CC-A8B6-C52977A7CC8C} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {FEB5880F-C3AC-4C5A-9B81-7315BA6F9CA2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {001F270C-F9BB-470F-B086-11C7F0EF0C45}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{001F270C-F9BB-470F-B086-11C7F0EF0C45} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {400C43AB-2E87-4983-A887-86105496B879}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{400C43AB-2E87-4983-A887-86105496B879} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {8E8C44D1-647B-4702-87C3-50BD8D890228}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{8E8C44D1-647B-4702-87C3-50BD8D890228} /F:Update  SYSTEM ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {D4D7AC37-2892-4C94-87B6-70E2D581C285}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{D4D7AC37-2892-4C94-87B6-70E2D581C285} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
 

==================== VerknÃ¼pfungen =============================
 

(Die EintrÃ¤ge kÃ¶nnen gelistet werden, um sie zurÃ¼ckzusetzen oder zu entfernen.)
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2016-12-15 18:13 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2008-10-24 15:35 - 2008-10-24 15:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

2012-07-28 20:23 - 2012-07-28 20:23 - 00920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

2015-05-11 08:12 - 2015-05-11 08:12 - 00248736 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

2016-12-15 18:13 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll

2016-11-18 18:57 - 2016-11-18 18:57 - 01864384 _____ () C:\Users\hans\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll

2014-11-25 04:22 - 2014-11-25 04:22 - 00035328 _____ () C:\Program Files (x86)\Synology\Photo Station Uploader\ShellExtHandler.dll

2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll

2016-11-18 18:31 - 2016-11-18 18:31 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2017-01-10 19:31 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2017-01-10 19:31 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2012-07-28 20:23 - 2017-01-21 14:08 - 00031232 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll

2012-07-28 20:23 - 2010-06-29 09:58 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll

2017-01-04 00:26 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\snlThirdParty150.bpl

2017-01-04 00:26 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\snlFileFormats150.bpl

2017-01-04 00:26 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\DEC150.bpl

2017-01-04 00:26 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\sqlite3.dll

2017-01-04 00:26 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\av\BDSmartDB.dll

2012-07-27 22:18 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 

==================== VerknÃ¼pfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurÃ¼ckgesetzt oder entfernt.)
 
 

==================== Internet Explorer VertrauenswÃ¼rdig/EingeschrÃ¤nkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 

IE trusted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\apemap.com -> hxxp://apemap.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\europacasino.com -> www.europacasino.com

IE trusted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\apemap.com -> hxxp://apemap.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\europacasino.com -> www.europacasino.com

IE trusted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\apemap.com -> hxxp://apemap.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\europacasino.com -> www.europacasino.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141955985\...\europacasino.com -> www.europacasino.com
 

==================== Hosts Inhalt: ===============================
 

(Wenn benÃ¶tigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurÃ¼ckzusetzen.)
 

2009-07-14 03:34 - 2017-01-21 15:10 - 00000938 ____R C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix fÃ¼r diesen Bereich.)
 

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205696\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413404\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205717\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413426\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\hans\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\Control Panel\Desktop\\Wallpaper -> C:\Users\hans\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\Control Panel\Desktop\\Wallpaper -> C:\Users\hans\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141955985\Control Panel\Desktop\\Wallpaper -> 

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956045\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01212017141956158\Control Panel\Desktop\\Wallpaper -> 

DNS Servers: 192.168.178.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte EintrÃ¤ge ==
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO 6.5 BD Edition.lnk => C:\Windows\pss\PHOTOfunSTUDIO 6.5 BD Edition.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^hans^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Mediencenter.lnk => C:\Windows\pss\Mediencenter.lnk.Startup

MSCONFIG\startupfolder: C:^Users^hans^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Persbackup.lnk => C:\Windows\pss\Persbackup.lnk.Startup

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: Greenshot => C:\Program Files (x86)\Greenshot\Greenshot.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: QuickTime Plugin Install => C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

HKLM\...\StartupApproved\StartupFolder: => "phase-6 Reminder.lnk"

HKLM\...\StartupApproved\StartupFolder: => "Philips GoGear SA4VBE Device Manager.lnk"

HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"

HKLM\...\StartupApproved\Run: => "EvtMgr6"

HKLM\...\StartupApproved\Run: => "XboxStat"

HKLM\...\StartupApproved\Run32: => "AXIS Camera Management Service Control"

HKLM\...\StartupApproved\Run32: => "ConnectionCenter"

HKLM\...\StartupApproved\Run32: => "Redirector"

HKLM\...\StartupApproved\Run32: => "EEventManager"

HKLM\...\StartupApproved\Run32: => "ASUS WiFi GO! FileTransfer Execute"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "QuickTime Plugin Install"

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "Xvid"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "DAEMON Tools Lite"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000002"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000001"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "MyDriveConnect.exe"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "Xvid"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "DAEMON Tools Lite"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "EPLTarget\P0000000000000002"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "EPLTarget\P0000000000000001"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142205740\...\StartupApproved\Run: => "MyDriveConnect.exe"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "Xvid"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "DAEMON Tools Lite"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "EPLTarget\P0000000000000002"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "EPLTarget\P0000000000000001"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017142413452\...\StartupApproved\Run: => "MyDriveConnect.exe"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => LPort=139

FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808

FirewallRules: [{CFEA598E-2120-49BD-96EB-F0797B9EA7C8}] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe

FirewallRules: [{4C965A15-EEDE-47E3-BE20-17D816B75B7D}] => C:\Program Files (x86)\Steam\SteamApps\common\Coast Guard\Coastguard_1.0.6_PC.exe

FirewallRules: [{CDB0D96B-E705-4D90-B5EF-A1D1D9C3F3C8}] => C:\Program Files (x86)\Steam\SteamApps\common\Coast Guard\Coastguard_1.0.6_PC.exe

FirewallRules: [{2858D5BA-5A6B-4521-9837-907FE731E845}] => C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{6C0E01C2-82D4-4630-A346-D494D4BF9859}] => C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{B8A98421-2E17-48BF-9044-D9A72C76753B}] => C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{C3B9808A-18A2-4000-AA9E-10377986AFF5}] => C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [UDP Query User{3BC405A3-DBD1-4A99-A6E1-25BB589F47F5}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [TCP Query User{18FCC2DF-3675-435F-8C2F-AFC180AA8F9A}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [UDP Query User{6BD828FC-85B2-48F2-B7AC-C1D03ABE92F7}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [TCP Query User{B62BDB5D-59B9-49C2-A061-4660A76E4190}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [{76EB755A-C217-43B9-AB97-AB3CC5E71743}] => C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe

FirewallRules: [{CCE6530F-DE47-4769-A10D-27A7540B991E}] => C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe

FirewallRules: [{D12CF48D-EBD2-46CC-8155-9AA00557844B}] => D:\Network\EpsonNetSetup\ENEasyApp.exe

FirewallRules: [{4E668EC6-B1DC-409C-BECA-8124D618E1CF}] => D:\Network\EpsonNetSetup\ENEasyApp.exe

FirewallRules: [{00B2002E-FA13-4754-A981-7DB171C676DE}] => C:\Program Files (x86)\LucasArts\Republic Heroes\Republic Heroes.exe

FirewallRules: [{C87FC343-DCCB-4E95-ABDF-5572E80780C3}] => C:\Program Files (x86)\LucasArts\Republic Heroes\Republic Heroes.exe

FirewallRules: [UDP Query User{0FDA4A02-B43E-408F-8E26-AF9624B0F30C}E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [TCP Query User{2ABA1A74-557F-4E81-9D5B-1B1401564B2A}E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [{6C4922AE-E233-419B-8DBC-4B815F3876A3}] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [{93C98DA4-0F4C-4BD2-B7D0-6602A4343BA2}] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [UDP Query User{4D5F1667-5107-42B2-BB47-7504A4EEA166}C:\program files\axis communications\axis camera companion\cameracompanion.exe] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [TCP Query User{B0D1AADC-A38C-4367-812B-4FA7F451D03E}C:\program files\axis communications\axis camera companion\cameracompanion.exe] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [{BBA8BB8A-8C56-4186-9A17-F58B679B9330}] => LPort=55762

FirewallRules: [{128173FE-022E-49B3-9230-2BFE75578837}] => LPort=55762

FirewallRules: [{19740856-4ABF-4673-8D95-B8CE1E14596E}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{694695CC-2D3C-44C4-A20E-857210FD5B05}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{F78A78E0-6842-4FD1-846E-1055ACEDEC28}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1D3E53FC-FEB1-4D76-9B5F-CAF7D29BDD58}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{4A85EC4E-CA2A-477B-8209-123E1A2CC477}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{9B8F944B-779C-4D7C-B60C-E4430C7B1B2E}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{AC68BF19-DDD2-4BD0-B8AF-3D5707C8AAEB}] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [{ADA90A78-3D5E-48AF-9773-270DF8CFEA51}] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [UDP Query User{02D5DF53-C1B5-4179-9EE3-27F6898D6A5E}C:\program files (x86)\mozilla firefox\plugin-container.exe] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [TCP Query User{4EF02AFA-1136-41A6-BB32-936CCCB422B5}C:\program files (x86)\mozilla firefox\plugin-container.exe] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [{31B3ED73-72C6-46DC-83B1-8F0B0CB048EB}] => LPort=55762

FirewallRules: [{D2DC905A-8E48-495B-AC17-4137F8F6261A}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{F3E053F5-4F0D-4034-976F-8B8C5853734C}] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [{798B26A8-9282-4DBD-88FC-B040746D94C9}] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [UDP Query User{6E780017-A414-4393-9EB7-13B2FA88FC63}C:\program files\axis\iputility_4_03\iputility.exe] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [TCP Query User{82D02BC4-776E-4E18-8177-14D2745B15D1}C:\program files\axis\iputility_4_03\iputility.exe] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [UDP Query User{5BBB9608-DEB7-435C-9370-DBC64EF5650F}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => C:\program files (x86)\synology\photo station uploader\mediauploader.exe

FirewallRules: [TCP Query User{C7859D18-786F-4F43-A999-E718E3BC0598}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => C:\program files (x86)\synology\photo station uploader\mediauploader.exe

FirewallRules: [{81942376-FD3B-4197-A5A3-89CB0984D46C}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\GSQuickTimeServer\GSQTServer.exe

FirewallRules: [{9B131A22-6841-44D8-89CE-39BA585B3BE3}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\GSQuickTimeServer\GSQTServer.exe

FirewallRules: [{23C8C8A9-FC95-4C51-8F3C-E3CDB09152D9}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\ArchiCAD.exe

FirewallRules: [{1B92B901-0E0B-4D9A-A645-E4ECE9540FC7}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\ArchiCAD.exe

FirewallRules: [UDP Query User{2B527D4A-0979-457F-B058-075015E17305}C:\program files (x86)\synology\assistant\dsassistant.exe] => C:\program files (x86)\synology\assistant\dsassistant.exe

FirewallRules: [TCP Query User{105EAD33-28FC-4C63-B822-AB44F05655DE}C:\program files (x86)\synology\assistant\dsassistant.exe] => C:\program files (x86)\synology\assistant\dsassistant.exe

FirewallRules: [{75ED169F-8DB5-4722-AE89-62FBBE854CFC}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{1D998D3D-8223-4636-8E86-93BB795A5251}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [UDP Query User{58C69C3A-61EA-4304-B4AE-22645655BCFC}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [TCP Query User{865866B1-1E9C-4956-8759-D34CFC12010C}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [{9D3AAA88-B102-4C34-933E-DB87929112D2}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe

FirewallRules: [{929A6AAF-167E-43A7-A3EC-32CBABCBB555}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe

FirewallRules: [{7DFC10B0-0681-458B-A43D-EC50AF205D70}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe

FirewallRules: [{C6C41DC4-E8DF-4325-BE97-2E0A13C61E8B}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe

FirewallRules: [UDP Query User{9863F51A-9F33-4EED-947B-48DD508D4AE0}C:\program files (x86)\axis ip utility\iputility.exe] => C:\program files (x86)\axis ip utility\iputility.exe

FirewallRules: [TCP Query User{1B25536D-2C58-4612-9D5B-DB592E4A2180}C:\program files (x86)\axis ip utility\iputility.exe] => C:\program files (x86)\axis ip utility\iputility.exe

FirewallRules: [{26662F94-2CB6-4FC1-988F-6C1E507975F9}] => C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [UDP Query User{58C41409-AD2A-4345-949A-ADFA74409CDE}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [TCP Query User{B3C179A6-A120-4F10-AF01-6CD611E51EE1}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [{88ECABB1-1106-4C1E-9FAF-C87FFD18161C}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{52FBE9EE-8381-4817-A952-EDBB6F370CB6}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{4502015C-A434-41EE-95D7-A2D838B57A90}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [UDP Query User{DEEED9A7-9523-49B8-9244-507870026302}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [TCP Query User{09E65D64-70E4-41AA-952F-986512849EE9}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [{85A002EC-2129-446E-9994-A0648882749F}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe

FirewallRules: [{1F925845-E9BC-4367-8DB7-A17DF3158B6E}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe

FirewallRules: [{95E3DF19-75C5-4910-8600-E54DB2BA14B2}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe

FirewallRules: [{CF5845A4-DA21-4D17-A082-7784FF2BAC3F}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe

FirewallRules: [UDP Query User{5792E9B3-FFB7-4B7F-A380-AF689C88A395}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [TCP Query User{7A221A22-8A8D-4140-9606-39CC99A01605}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [{A26F450C-21E8-4DF8-8B62-70CB5E7E4567}] => LPort=1900

FirewallRules: [{34CC79E2-F383-4D87-8818-547E8D7F0200}] => LPort=2869

FirewallRules: [{D2DE30F6-F42D-42E8-B0D2-219826D24BB4}] => LPort=1900

FirewallRules: [{2CF937F4-5179-463C-AAEE-1F112CC58FF4}] => LPort=2869

FirewallRules: [{3E60C3E3-7427-4A42-A9A8-AF7054B81E72}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1F0D96FB-7BEB-4845-9196-91D7E06FE233}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1CDE3F3E-E8DA-4ED0-8D19-D71C70B58D15}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{5CCCE6DC-E887-4C7F-B150-29019F842CDF}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{F91DF143-BBF6-4B90-B3A4-7FEA128BD50E}] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [{E7FF8417-CAFF-4360-8B34-DA3705F1E73A}] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [TCP Query User{3CA283B0-2D1B-413D-B14C-2580B98122D6}C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe] => C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe

FirewallRules: [UDP Query User{D3AC3942-8448-4305-97FE-331E2A7BC1C4}C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe] => C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe

FirewallRules: [{05D4D977-A8CC-4B50-9A90-756CF1B3AB2B}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{21F58B97-C510-47B5-BD53-239CE0F71F4B}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{4283E0B8-392A-4FB4-B295-106215253441}C:\program files\calibre2\calibre.exe] => C:\program files\calibre2\calibre.exe

FirewallRules: [UDP Query User{BF3696CE-3FA7-49E5-833A-4D86A657822D}C:\program files\calibre2\calibre.exe] => C:\program files\calibre2\calibre.exe

FirewallRules: [{FF63FAD8-D474-44A4-AA51-F58A42C00306}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{DCC98276-F24F-448D-9EC9-620155D7A640}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{557627F4-27F5-49D6-9119-312F7D3128BE}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{64738188-1200-4C95-99BD-2C40DCB9EF65}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 3\Samorost3.exe

FirewallRules: [{AF2E70D4-7865-4CBA-BD8B-7AD73130B938}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 3\Samorost3.exe

FirewallRules: [{B32E2895-40E5-48D9-9186-86446853A75F}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 2\Samorost2.exe

FirewallRules: [{3B668DD2-CADE-4143-A9CA-3AF1CDFE4C19}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 2\Samorost2.exe

FirewallRules: [{ECE267E4-302C-42FB-B7E1-8AE558BA20BF}] => C:\Program Files (x86)\Steam\SteamApps\common\Machinarium\machinarium.exe

FirewallRules: [{0B884826-CB58-484E-AF4E-313A7A6CD39E}] => C:\Program Files (x86)\Steam\SteamApps\common\Machinarium\machinarium.exe

FirewallRules: [{4816642A-ADD8-4A47-A5CC-2A3122BB21CE}] => C:\Program Files (x86)\Steam\SteamApps\common\Botanicula\Botanicula.exe

FirewallRules: [{695EE251-1EB8-40B9-8AEB-88C571A80838}] => C:\Program Files (x86)\Steam\SteamApps\common\Botanicula\Botanicula.exe

FirewallRules: [{A37D5FA7-A129-4D8F-8732-97DDD989548A}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{2ABE9ADD-AAEF-460D-9301-037298C09095}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{DD2F7BE4-70B6-470D-ABB3-231089F1CF88}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

FirewallRules: [{CD16978F-0136-4BB0-B654-0B9EC1F81C71}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

FirewallRules: [{AEB41CB8-6BAB-4D98-883D-F9767B833EB5}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\java.exe

FirewallRules: [{5BFE816A-70B4-4D79-A040-59B116D149C8}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\java.exe

FirewallRules: [{57CD24E7-7BC5-48A0-9C88-57C46915E449}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\javaw.exe

FirewallRules: [{830A058F-2F77-4DB3-9E7D-05F42BF255A0}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\javaw.exe

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot-S&D 2 Tray Icon

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
 

==================== Wiederherstellungspunkte =========================
 

19-01-2017 21:16:22 Geplanter PrÃ¼fpunkt

21-01-2017 15:14:41 JRT Pre-Junkware Removal
 

==================== Fehlerhafte GerÃ¤te im GerÃ¤temanager =============
 
 

==================== FehlereintrÃ¤ge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (01/21/2017 03:14:42 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst wÃ¤hrend der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 

Error: (01/21/2017 02:15:41 PM) (Source: Microsoft-Windows-EFS) (EventID: 4401) (User: DELFINE)

Description: 7.488: Der EFS-DienstÂ*konnte keinen Benutzer fÃ¼r â€žUnternehmensdatenschutzâ€œ bereitstellen. Fehlercode: 0x80070005.
 

Error: (01/21/2017 12:23:57 PM) (Source: Microsoft-Windows-EFS) (EventID: 4401) (User: DELFINE)

Description: 7.488: Der EFS-DienstÂ*konnte keinen Benutzer fÃ¼r â€žUnternehmensdatenschutzâ€œ bereitstellen. Fehlercode: 0x80070005.
 

Error: (01/20/2017 06:42:07 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: Die Open-Prozedur fÃ¼r den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten fÃ¼r diesen Dienst sind nicht verfÃ¼gbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
 

Error: (01/20/2017 07:31:31 AM) (Source: ESENT) (EventID: 489) (User: )

Description: CCleaner64 (12536) Der Versuch, die Datei "C:\Users\hans\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" fÃ¼r den Lesezugriff zu Ã¶ffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Ã–ffnen von Dateien.
 

Error: (01/19/2017 09:16:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst wÃ¤hrend der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 

Error: (01/19/2017 06:34:52 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: Die Open-Prozedur fÃ¼r den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten fÃ¼r diesen Dienst sind nicht verfÃ¼gbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
 

Error: (01/19/2017 06:17:48 PM) (Source: Microsoft-Windows-EFS) (EventID: 4401) (User: DELFINE)

Description: 7.488: Der EFS-DienstÂ*konnte keinen Benutzer fÃ¼r â€žUnternehmensdatenschutzâ€œ bereitstellen. Fehlercode: 0x80070005.
 

Error: (01/17/2017 08:04:48 PM) (Source: Perflib) (EventID: 1008) (User: )

Description: Die Open-Prozedur fÃ¼r den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten fÃ¼r diesen Dienst sind nicht verfÃ¼gbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
 

Error: (01/17/2017 07:50:52 PM) (Source: Microsoft-Windows-EFS) (EventID: 4401) (User: DELFINE)

Description: 7.488: Der EFS-DienstÂ*konnte keinen Benutzer fÃ¼r â€žUnternehmensdatenschutzâ€œ bereitstellen. Fehlercode: 0x80070005.
 
 

Systemfehler:

=============

Error: (01/21/2017 02:22:59 PM) (Source: DCOM) (EventID: 10010) (User: DELFINE)

Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 

Error: (01/21/2017 02:20:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 02:20:59 PM) (Source: DCOM) (EventID: 10010) (User: DELFINE)

Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 

Error: (01/21/2017 02:18:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 02:12:58 PM) (Source: DCOM) (EventID: 10010) (User: DELFINE)

Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 

Error: (01/21/2017 02:11:13 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 02:10:58 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 02:10:48 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÃ„T)

Description: Durch die Berechtigungseinstellungen fÃ¼r "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÃ„T\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" fÃ¼r die COM-Serveranwendung mit der CLSID 

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

 und der APPID 

{F72671A9-012C-4725-9D2F-2A4D32D65169}

 im Anwendungscontainer "Nicht verfÃ¼gbar" (SID: Nicht verfÃ¼gbar) gewÃ¤hrt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool fÃ¼r Komponentendienste geÃ¤ndert werden.
 

Error: (01/21/2017 02:08:59 PM) (Source: Service Control Manager) (EventID: 7016) (User: )

Description: Der Dienst "chip1click" hat einen ungÃ¼ltigen aktuellen Status gemeldet: 0
 

Error: (01/21/2017 02:08:59 PM) (Source: Service Control Manager) (EventID: 7016) (User: )

Description: Der Dienst "chip1click" hat einen ungÃ¼ltigen aktuellen Status gemeldet: 0
 
 

CodeIntegrity:

===================================

  Date: 2017-01-15 19:41:51.878

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.850

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.820

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.793

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.765

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.738

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.703

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.647

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.605

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.560

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz

Prozentuale Nutzung des RAM: 18%

Installierter physikalischer RAM: 16067.15 MB

Verfügbarer physikalischer RAM: 13165.4 MB

Summe virtueller Speicher: 32451.15 MB

Verfügbarer virtueller Speicher: 29071.05 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:214.14 GB) (Free:82.67 GB) NTFS

Drive e: () (Removable) (Total:59.61 GB) (Free:46.66 GB) FAT32

Drive x: (Volume) (Fixed) (Total:931.39 GB) (Free:418.82 GB) NTFS

Drive y: (Volume) (Fixed) (Total:931.39 GB) (Free:280.24 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 85B79A05)
 

Partition: GPT.
 

========================================================

Disk: 1 (Size: 931.5 GB) (Disk ID: 85B79A0A)
 

Partition: GPT.
 

========================================================

Disk: 2 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 2106B09D)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=214.1 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
 

========================================================

Disk: 8 (Size: 59.6 GB) (Disk ID: 00000000)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Hallo Matthias,
...als Zusatzinfo wären ev. noch folgende Angaben von Interesse:

Als "Schutzprogramme" habe ich bei mir laufen
- die Windows-Firewall
- Windows-Defender
- Avira free Antivirus
- Spybot Search and Destroy, freeware

Das ist wahrscheinlich in einigen Punkten suboptimales Doppelgemoppel.
Und Avira sowie SS&D werden ja auch kritisiert...
Was wäre denn annähernd ok? Vor lauter Tipps und "Panikmache" installiert unsereins ja doch einfach so drauf los ;>)
VG

Servus,

wir entfernen die letzten Reste und kontrollieren nochmal alles. :)

Hinweis: Der Suchlauf mit ESET kann länger dauern.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

start

CloseProcesses:

Task: {0817A928-B064-4348-858D-6102DAB0D531} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {0FCEB1D2-4C5F-43A9-9BB9-189967BC4C32} - System32\Tasks\{1857F86E-A91E-42F3-98CD-513ABEF090DF} => D:\Setup\Setup.exe

Task: {1930B07F-67A5-419A-B34A-063D0A9F256C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {1C3443F6-171D-4A09-83F7-F32D1478114C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {2C49CF5F-8B53-4CC6-8DAA-D8D47C4C729B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {4A50958A-A184-434E-9E12-8EAC3B86D9E1} - System32\Tasks\{CD547849-DBC6-4B5E-AB12-A6920D3B22CE} => D:\Setup\Setup.exe

Task: {4A573E16-E200-4F13-A290-25BEC00FBD22} - System32\Tasks\{911A89DB-DBD8-4A27-858E-C4642650E149} => pcalua.exe -a D:\Setup.exe -d D:\

Task: {4CF1F731-41FC-4216-B898-C521E67F32D4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {8FA53CBD-4278-4AF4-9E4C-A027261C9FE7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {BB07BFF0-CE0F-46FC-B250-22BDD6033EF1} - System32\Tasks\{BFA096D1-2D1E-4E62-A764-91FA3BAB5A2B} => D:\Setup\Setup.exe

Task: {E1518AFD-7206-4F48-8036-5443ACAF7C7B} - System32\Tasks\{7E7A9016-FAAC-4DA4-8547-F849B4804155} => D:\Setup\Setup.exe

Task: {FEB5880F-C3AC-4C5A-9B81-7315BA6F9CA2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

FirewallRules: [{A37D5FA7-A129-4D8F-8732-97DDD989548A}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{2ABE9ADD-AAEF-460D-9301-037298C09095}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{DD2F7BE4-70B6-470D-ABB3-231089F1CF88}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

FirewallRules: [{CD16978F-0136-4BB0-B654-0B9EC1F81C71}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

RemoveProxy:

CMD: ipconfig /flushdns

CMD: netsh winsock reset

EmptyTemp:

end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

Starte die HitmanPro.exe
Klicke auf
Entferne den Haken bei
Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

und auf
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
und speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von ESET,
die Logdatei von HitmanPro,
die beiden neuen Logdateien von FRST,
die Beantwortung der gestellten Fragen.

Hallo Matthias,

vorweg: Der Rechner scheint wie zuvor ganz normal zu laufen.
Anlass, Euch um Hilfe zu bitten, waren die genannten Meldungen von Avira mit den (bisher inaktiven?) 5 Trojanern (innerhalb von Backup-Zip-Dateien in ungeöffneten Mail-Anhängen versteckt; soweit ich das beurteilen kann).
Bin gespannt auf Deine Einschätzung.

Anbei wie gewünscht die Log-Dateien.
Das Addition-Log schicke ich wg. deren Größe gesondert.

von FRST-Fix:

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 18-01-2017

durchgeführt von Joerg (21-01-2017 22:02:56) Run:1

Gestartet von C:\Users\Joerg\Desktop

Geladene Profile: Joerg & Mcx1-DELFINE & Leo &  (Verfügbare Profile: Joerg & Mcx1-DELFINE & Leo & DefaultAppPool)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

start

CloseProcesses:

Task: {0817A928-B064-4348-858D-6102DAB0D531} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {0FCEB1D2-4C5F-43A9-9BB9-189967BC4C32} - System32\Tasks\{1857F86E-A91E-42F3-98CD-513ABEF090DF} => D:\Setup\Setup.exe

Task: {1930B07F-67A5-419A-B34A-063D0A9F256C} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {1C3443F6-171D-4A09-83F7-F32D1478114C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {2C49CF5F-8B53-4CC6-8DAA-D8D47C4C729B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {4A50958A-A184-434E-9E12-8EAC3B86D9E1} - System32\Tasks\{CD547849-DBC6-4B5E-AB12-A6920D3B22CE} => D:\Setup\Setup.exe

Task: {4A573E16-E200-4F13-A290-25BEC00FBD22} - System32\Tasks\{911A89DB-DBD8-4A27-858E-C4642650E149} => pcalua.exe -a D:\Setup.exe -d D:\

Task: {4CF1F731-41FC-4216-B898-C521E67F32D4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {8FA53CBD-4278-4AF4-9E4C-A027261C9FE7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {BB07BFF0-CE0F-46FC-B250-22BDD6033EF1} - System32\Tasks\{BFA096D1-2D1E-4E62-A764-91FA3BAB5A2B} => D:\Setup\Setup.exe

Task: {E1518AFD-7206-4F48-8036-5443ACAF7C7B} - System32\Tasks\{7E7A9016-FAAC-4DA4-8547-F849B4804155} => D:\Setup\Setup.exe

Task: {FEB5880F-C3AC-4C5A-9B81-7315BA6F9CA2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

FirewallRules: [{A37D5FA7-A129-4D8F-8732-97DDD989548A}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{2ABE9ADD-AAEF-460D-9301-037298C09095}] => C:\Program Files (x86)\TV-Browser\tvbrowser.exe

FirewallRules: [{DD2F7BE4-70B6-470D-ABB3-231089F1CF88}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

FirewallRules: [{CD16978F-0136-4BB0-B654-0B9EC1F81C71}] => C:\Program Files (x86)\TV-Browser\tvbrowser_noDD.exe

RemoveProxy:

CMD: ipconfig /flushdns

CMD: netsh winsock reset

EmptyTemp:

end

*****************
 

Prozesse erfolgreich geschlossen.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0817A928-B064-4348-858D-6102DAB0D531} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0817A928-B064-4348-858D-6102DAB0D531} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0FCEB1D2-4C5F-43A9-9BB9-189967BC4C32} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0FCEB1D2-4C5F-43A9-9BB9-189967BC4C32} => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{1857F86E-A91E-42F3-98CD-513ABEF090DF} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1857F86E-A91E-42F3-98CD-513ABEF090DF} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1930B07F-67A5-419A-B34A-063D0A9F256C} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1930B07F-67A5-419A-B34A-063D0A9F256C} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1C3443F6-171D-4A09-83F7-F32D1478114C} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1C3443F6-171D-4A09-83F7-F32D1478114C} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2C49CF5F-8B53-4CC6-8DAA-D8D47C4C729B} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C49CF5F-8B53-4CC6-8DAA-D8D47C4C729B} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4A50958A-A184-434E-9E12-8EAC3B86D9E1} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A50958A-A184-434E-9E12-8EAC3B86D9E1} => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{CD547849-DBC6-4B5E-AB12-A6920D3B22CE} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{CD547849-DBC6-4B5E-AB12-A6920D3B22CE} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4A573E16-E200-4F13-A290-25BEC00FBD22} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A573E16-E200-4F13-A290-25BEC00FBD22} => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{911A89DB-DBD8-4A27-858E-C4642650E149} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{911A89DB-DBD8-4A27-858E-C4642650E149} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4CF1F731-41FC-4216-B898-C521E67F32D4} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4CF1F731-41FC-4216-B898-C521E67F32D4} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8FA53CBD-4278-4AF4-9E4C-A027261C9FE7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8FA53CBD-4278-4AF4-9E4C-A027261C9FE7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BB07BFF0-CE0F-46FC-B250-22BDD6033EF1} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BB07BFF0-CE0F-46FC-B250-22BDD6033EF1} => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{BFA096D1-2D1E-4E62-A764-91FA3BAB5A2B} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BFA096D1-2D1E-4E62-A764-91FA3BAB5A2B} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E1518AFD-7206-4F48-8036-5443ACAF7C7B} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1518AFD-7206-4F48-8036-5443ACAF7C7B} => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{7E7A9016-FAAC-4DA4-8547-F849B4804155} => erfolgreich verschoben

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7E7A9016-FAAC-4DA4-8547-F849B4804155} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FEB5880F-C3AC-4C5A-9B81-7315BA6F9CA2} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FEB5880F-C3AC-4C5A-9B81-7315BA6F9CA2} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => Schlüssel erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A37D5FA7-A129-4D8F-8732-97DDD989548A} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2ABE9ADD-AAEF-460D-9301-037298C09095} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DD2F7BE4-70B6-470D-ABB3-231089F1CF88} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{CD16978F-0136-4BB0-B654-0B9EC1F81C71} => Wert erfolgreich entfernt
 

========= RemoveProxy: =========
 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017161819861\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017161819861\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017162626746\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01212017162626746\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
 
 

========= Ende von RemoveProxy: =========
 
 

========= ipconfig /flushdns =========
 
 

Windows-IP-Konfiguration
 

Der DNS-Aufl”sungscache wurde geleert.
 

========= Ende von CMD: =========
 
 

========= netsh winsock reset =========
 
 

Der Winsock-Katalog wurde zurckgesetzt.

Sie mssen den Computer neu starten, um den Vorgang abzuschlieáen.
 
 

========= Ende von CMD: =========
 
 

=========== EmptyTemp: ==========
 

BITS transfer queue => 1685408 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 68328370 B

Java, Flash, Steam htmlcache => 6895200 B

Windows/system/drivers => 101408 B

Edge => 0 B

Chrome => 447488 B

Firefox => 83147333 B

Opera => 0 B
 

Temp, IE cache, history, cookies, recent:

Default => 6168 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 29578 B

NetworkService => 21576 B

Joerg => 32228505 B

Mcx1-DELFINE => 1853 B

Leo => 22213893 B

DefaultAppPool => 6168 B
 

RecycleBin => 3542786 B

EmptyTemp: => 208.5 MB temporäre Dateien entfernt.
 

================================
 
 

Das System musste neu gestartet werden.
 

==== Ende von Fixlog 22:03:09 ====

von ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=d56c86f0591b834a986f85ce93a9e3ca

# end=init

# utc_time=2017-01-21 09:10:59

# local_time=2017-01-21 10:10:59 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# osver=6.2.9200 NT 

Update Init

Update Download

Update Finalize

Updated modules version: 32144

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=d56c86f0591b834a986f85ce93a9e3ca

# end=updated

# utc_time=2017-01-21 09:15:32

# local_time=2017-01-21 10:15:32 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# osver=6.2.9200 NT 

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=d56c86f0591b834a986f85ce93a9e3ca

# engine=32144

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2017-01-22 10:27:45

# local_time=2017-01-22 11:27:45 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1='Avira Antivirus'

# compatibility_mode=1815 16777213 100 97 68570 77579810 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 76723 16411481 0 0

# scanned=487166

# found=0

# cleaned=0

# scan_time=47532

von HitmanPro:

Code:



        Code:


        
HitmanPro 3.7.15.281

www.hitmanpro.com
 

   Computer name . . . . : DELFINE

   Windows . . . . . . . : 10.0.0.14393.X64/8

   User name . . . . . . : DELFINE\Joerg

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2017-01-22 12:35:14

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 1m 38s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 4
 

   Objects scanned . . . : 2.782.921

   Files scanned . . . . : 92.016

   Remnants scanned  . . : 736.024 files / 1.954.881 keys
 

Suspicious files ____________________________________________________________
 

   C:\Users\Joerg\Desktop\FRST64.exe

      Size . . . . . . . : 2.419.712 bytes

      Age  . . . . . . . : 1.7 days (2017-01-20 19:23:12)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : A6F5705974D580CD90356F383715E682E824FFE3E81E121AA97181C7CD7414AC

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.
 
 

Potential Unwanted Programs _________________________________________________
 

   HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)

   HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)

   HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)

FRST von FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 22-01-2017

durchgeführt von Joerg (Administrator) auf DELFINE (22-01-2017 12:41:48)

Gestartet von C:\Users\Joerg\Desktop

Geladene Profile: Joerg & Mcx1-DELFINE & Leo & DefaultAppPool (Verfügbare Profile: Joerg & Mcx1-DELFINE & Leo & DefaultAppPool)

Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe

(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe

(Axis Communications AB) C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AsDLNAServerReal.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Dominik Reichl) E:\KeePass-2.35\KeePass.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 

==================== Registry (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-26] (Logitech, Inc.)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [ASUS WiFi GO! FileTransfer Execute] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFile\WiFileTransfer.exe [1376896 2012-04-12] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [917576 2016-12-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [407904 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153952 2015-04-08] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AXIS Camera Management Service Control] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmAdmin.exe [1834160 2015-05-08] (Axis Communications AB)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Plugin Install] => C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe [86016 2016-04-05] ()

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)

Winlogon\Notify\igfxcui: igfxdev.dll [X]

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [EPLTarget\P0000000000000002] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINFE.EXE [298560 2013-12-16] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\SpybotSearchDestroy2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\RunOnce: [Uninstall 17.3.6381.0405\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\RunOnce: [Uninstall 17.3.6381.0405] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Leo\AppData\Local\Microsoft\OneDrive\17.3.6381.0405"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2014-02-03]

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Philips GoGear SA4VBE Device Manager.lnk [2013-06-14]

ShortcutTarget: Philips GoGear SA4VBE Device Manager.lnk -> C:\Program Files (x86)\Philips\GoGear SA4VBE Device Manager\GoGear_SA4VBE_DeviceManager.exe (Philips)

Startup: C:\Users\Joerg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk [2012-07-27]

ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{280df009-71d1-45e6-bca3-de9ca51bc6ef}: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{ec71dbf0-98cf-4b04-8ee2-cceb81b9b1a9}: [DhcpNameServer] 192.168.178.1
 

Internet Explorer:

==================

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKLM-x32 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {1F0C0E4A-72C8-4560-9612-27AD083921F1} URL = hxxp://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=search&search={searchTerms}

SearchScopes: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN

BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-21] (Oracle Corporation)

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-26] (Logitech, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-21] (Oracle Corporation)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2015-07-31] (Seiko Epson Corporation)

Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2015-04-08] (Citrix Systems, Inc.)
 

FireFox:

========

FF ProfilePath: C:\Users\Joerg\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default [2017-01-21]

FF Extension: (Philips GoGear Device Manager) - C:\Users\Joerg\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\gogear@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (German (de) Language Pack) - C:\Users\Joerg\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\langpack-de@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MSC Device Support) - C:\Users\Joerg\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\msc@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (MTP Device Support) - C:\Users\Joerg\AppData\Roaming\Songbird2\Profiles\f8yv4x3u.default\Extensions\mtp@songbirdnest.com [2013-06-11] [ist nicht signiert]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\albumart@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\gonzo@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\philips-addon-manager@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\pinkmartini@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\purplerain@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\sharing@songbirdnest.com [nicht gefunden]

FF Extension: (Kein Name) - C:\Program Files (x86)\Songbird\extensions\soundboard@songbirdnest.com [nicht gefunden]

FF ProfilePath: C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default [2017-01-22]

FF Homepage: Mozilla\Firefox\Profiles\cnn104yu.default -> hxxp://www.google.de

FF Extension: (Avira Browser Safety) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\abs@avira.com.xpi [2017-01-21]

FF Extension: (Brief) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\brief@mozdev.org.xpi [2016-06-12]

FF Extension: (Clipple) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\clipple@mooz.github.com.xpi [2016-02-17]

FF Extension: (ProxTube) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\ich@maltegoetz.de.xpi [2016-10-17]

FF Extension: (Download YouTube Videos, Fast And Simple) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\jid1-cHKBMlArKdIVEg@jetpack.xpi [2016-04-30]

FF Extension: (Ebay & Amazon Search Menu Add-on) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\jid1-XZ3VqwTEfisocw@jetpack.xpi [2017-01-21]

FF Extension: (Vlc Kontextmenü) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlcplaylist@helgatauscher.de.xpi [2016-04-30]

FF Extension: (VLC Youtube Shortcut) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\vlc_shortcut@kosan.kosan.xpi [2016-12-01]

FF Extension: (All-in-One Sidebar) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2017-01-21]

FF Extension: (Home Extension) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259} [2016-11-26]

FF Extension: (NoScript) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-01-20]

FF Extension: (Adblock Plus) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]

FF Extension: (Tab Mix Plus) - C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2017-01-14]

FF SearchPlugin: C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\dudende-suche.xml [2012-07-29]

FF SearchPlugin: C:\Users\Joerg\AppData\Roaming\Mozilla\Firefox\Profiles\cnn104yu.default\searchplugins\stadtbibliothek-stadt.xml [2016-04-01]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2016-01-30] [ist nicht signiert]

FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on

FF Extension: (E-Web Print) - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2015-08-18] [ist nicht signiert]

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-11] ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [Keine Datei]

FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin_x86_64.dll [2016-03-25] (Synology)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-11] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1206147.dll [2013-11-25] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2015-04-08] (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)

FF Plugin-x32: @graphisoft.com/GDL Web Plug-in -> C:\Program Files (x86)\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-14] (Graphisoft SE)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-21] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-21] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.934\npSurveillancePlugin.dll [2016-03-25] (Synology)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @sun.com/npsopluginmi;version=1.0 -> C:\Program Files (x86)\OpenOffice.org 3\program [Keine Datei]

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Joerg\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-03] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-1412286257-1942420214-3619319362-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2015-09-08] (Tracker Software Products (Canada) Ltd.)
 

Chrome: 

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default [2017-01-21]

CHR Extension: (Google Präsentationen) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-09]

CHR Extension: (Google Docs) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-09]

CHR Extension: (Google Drive) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-29]

CHR Extension: (YouTube) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-29]

CHR Extension: (Google Cast) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-11-20]

CHR Extension: (Google-Suche) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]

CHR Extension: (Google Tabellen) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-09]

CHR Extension: (Google Docs Offline) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-20]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-20]

CHR Extension: (Google Mail) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-09]

CHR Extension: (Chrome Media Router) - C:\Users\Joerg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-20]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
 

==================== Dienste (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1089592 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [476736 2016-12-15] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1490296 2016-12-15] (Avira Operations GmbH & Co. KG)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-07-28] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.04\AsusFanControlService.exe [1473664 2012-07-28] (ASUSTeK Computer Inc.)

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)

R2 AXIS Camera Management; C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe [18432 2015-05-08] (Axis Communications AB) [Datei ist nicht signiert]

R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)

R2 EPSON_PM_RPCV4_06; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [152640 2013-04-15] (SEIKO EPSON CORPORATION)

R2 FoxitReaderService; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\FoxitConnectedPDFService.exe [1659592 2016-11-15] (Foxit Software Inc.)

R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)

R2 SDScannerService; C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\SpybotSearchDestroy2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-11-18] (Microsoft Corporation)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2015-05-11] () [Datei ist nicht signiert]

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ======================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [151352 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [153904 2016-12-15] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [35488 2015-12-01] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [78208 2016-06-04] (Avira Operations GmbH & Co. KG)

S3 GenericMount; C:\WINDOWS\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)

R3 ikbevent; C:\WINDOWS\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()

R3 imsevent; C:\WINDOWS\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

S3 WPRO_41_2001; C:\WINDOWS\System32\drivers\WPRO_41_2001.sys [34752 2013-01-28] ()

U3 idsvc; kein ImagePath
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-22 12:38 - 2017-01-22 12:38 - 00000000 ____D C:\Users\Joerg\Desktop\FRST-OlderVersion

2017-01-22 12:34 - 2017-01-22 12:37 - 00000000 ____D C:\ProgramData\HitmanPro

2017-01-22 12:32 - 2017-01-22 12:33 - 11581544 _____ (SurfRight B.V.) C:\Users\Joerg\Desktop\HitmanPro_x64.exe

2017-01-21 22:09 - 2017-01-21 22:10 - 02870984 _____ (ESET) C:\Users\Joerg\Desktop\esetsmartinstaller_deu.exe

2017-01-21 22:02 - 2017-01-21 22:03 - 00011900 _____ C:\Users\Joerg\Desktop\Fixlog.txt

2017-01-21 22:02 - 2017-01-21 22:02 - 00121453 _____ C:\Users\Joerg\Desktop\Addition2.txt

2017-01-21 22:02 - 2017-01-21 22:02 - 00087418 _____ C:\Users\Joerg\Desktop\FRST2.txt

2017-01-21 20:00 - 2017-01-22 12:25 - 00000000 ____D C:\Users\Joerg\AppData\LocalLow\Mozilla

2017-01-21 19:51 - 2017-01-21 19:51 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\Oracle

2017-01-21 19:50 - 2017-01-21 19:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2017-01-21 19:50 - 2017-01-21 19:49 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll

2017-01-21 16:40 - 2017-01-21 15:10 - 00000938 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-164047.backup

2017-01-21 16:17 - 2017-01-21 15:10 - 00000938 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-161757.backup

2017-01-21 16:04 - 2017-01-21 15:10 - 00000938 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-160439.backup

2017-01-21 16:02 - 2017-01-21 15:10 - 00000938 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-160235.backup

2017-01-21 15:41 - 2017-01-21 15:10 - 00000938 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20170121-154119.backup

2017-01-21 15:20 - 2017-01-22 12:41 - 00034811 _____ C:\Users\Joerg\Desktop\FRST.txt

2017-01-21 15:20 - 2017-01-21 21:59 - 00121453 _____ C:\Users\Joerg\Desktop\Addition.txt

2017-01-21 15:15 - 2017-01-21 15:18 - 00001651 _____ C:\Users\Joerg\Desktop\JRT.txt

2017-01-21 15:10 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170121-151036.backup

2017-01-21 14:58 - 2017-01-21 15:14 - 01663040 _____ (Malwarebytes) C:\Users\Joerg\Desktop\JRT.exe

2017-01-21 14:40 - 2017-01-21 14:44 - 00102391 _____ C:\Users\Joerg\Desktop\Addition_1b.txt

2017-01-21 14:39 - 2017-01-21 14:43 - 00086783 _____ C:\Users\Joerg\Desktop\FRST_1b.txt

2017-01-21 14:28 - 2017-01-21 14:28 - 00001533 _____ C:\Users\Joerg\Desktop\mbam.txt

2017-01-21 14:20 - 2017-01-21 22:04 - 00102856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys

2017-01-21 14:20 - 2017-01-21 22:04 - 00091584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys

2017-01-21 14:20 - 2017-01-21 15:28 - 00176064 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys

2017-01-21 14:19 - 2017-01-21 22:04 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2017-01-21 14:19 - 2017-01-21 22:03 - 00250816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2017-01-21 14:19 - 2017-01-21 14:19 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2017-01-21 14:19 - 2017-01-21 14:19 - 00000000 ____D C:\Program Files\Malwarebytes

2017-01-21 14:19 - 2016-12-14 12:55 - 00077416 _____ C:\WINDOWS\system32\Drivers\mbae64.sys

2017-01-21 14:13 - 2017-01-21 14:13 - 00001066 _____ C:\Users\Joerg\Desktop\AdwCleaner[C0].txt - Verknüpfung.lnk

2017-01-21 14:04 - 2017-01-21 14:08 - 00000000 ____D C:\AdwCleaner

2017-01-21 14:00 - 2017-01-21 14:00 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini

2017-01-21 13:58 - 2017-01-21 14:03 - 03988944 _____ C:\Users\Joerg\Desktop\AdwCleaner_6.042.exe

2017-01-20 21:03 - 2017-01-20 21:03 - 00019360 _____ C:\Users\Joerg\Desktop\Addition_1.7z

2017-01-20 20:58 - 2017-01-20 20:58 - 00989855 _____ C:\Users\Joerg\Desktop\AVSCAN-20170119-210753-35D54530_1.zip

2017-01-20 19:26 - 2017-01-21 14:36 - 00102416 _____ C:\Users\Joerg\Desktop\Addition_1a.txt

2017-01-20 19:25 - 2017-01-21 14:36 - 00086878 _____ C:\Users\Joerg\Desktop\FRST_1a.txt

2017-01-20 19:24 - 2017-01-22 12:41 - 00000000 ____D C:\FRST

2017-01-20 19:23 - 2017-01-22 12:38 - 02420736 _____ (Farbar) C:\Users\Joerg\Desktop\FRST64.exe

2017-01-20 19:03 - 2017-01-20 19:03 - 00000475 _____ C:\Users\Joerg\Desktop\Trojaner.txt

2017-01-16 23:51 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170116-235155.backup

2017-01-14 19:14 - 2017-01-14 19:14 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\Amanita-Design.Samorost3

2017-01-14 18:35 - 2017-01-14 18:38 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware

2017-01-10 23:50 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-235007.backup

2017-01-10 21:23 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-212324.backup

2017-01-10 20:16 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170110-201615.backup

2017-01-10 19:32 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll

2017-01-10 19:32 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2017-01-10 19:32 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll

2017-01-10 19:32 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2017-01-10 19:32 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2017-01-10 19:32 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2017-01-10 19:32 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll

2017-01-10 19:32 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2017-01-10 19:32 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2017-01-10 19:32 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe

2017-01-10 19:32 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2017-01-10 19:32 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2017-01-10 19:32 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2017-01-10 19:32 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll

2017-01-10 19:32 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll

2017-01-10 19:32 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2017-01-10 19:32 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll

2017-01-10 19:32 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll

2017-01-10 19:32 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe

2017-01-10 19:32 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe

2017-01-10 19:32 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll

2017-01-10 19:32 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2017-01-10 19:32 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2017-01-10 19:32 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2017-01-10 19:32 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll

2017-01-10 19:32 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll

2017-01-10 19:32 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll

2017-01-10 19:32 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe

2017-01-10 19:32 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2017-01-10 19:32 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2017-01-10 19:32 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2017-01-10 19:32 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll

2017-01-10 19:32 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2017-01-10 19:32 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2017-01-10 19:32 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2017-01-10 19:32 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2017-01-10 19:32 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll

2017-01-10 19:32 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2017-01-10 19:32 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll

2017-01-10 19:32 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2017-01-10 19:32 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll

2017-01-10 19:32 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2017-01-10 19:32 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2017-01-10 19:32 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2017-01-10 19:32 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2017-01-10 19:32 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2017-01-10 19:32 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:32 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2017-01-10 19:31 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2017-01-10 19:31 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll

2017-01-10 19:31 - 2016-12-21 08:45 - 00153952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcmiplugin.dll

2017-01-10 19:31 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2017-01-10 19:31 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2017-01-10 19:31 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2017-01-10 19:31 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2017-01-10 19:31 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll

2017-01-10 19:31 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll

2017-01-10 19:31 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll

2017-01-10 19:31 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2017-01-10 19:31 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe

2017-01-10 19:31 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2017-01-10 19:31 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2017-01-10 19:31 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2017-01-10 19:31 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll

2017-01-10 19:31 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2017-01-10 19:31 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll

2017-01-10 19:31 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll

2017-01-10 19:31 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll

2017-01-10 19:31 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2017-01-10 19:31 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2017-01-10 19:31 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll

2017-01-10 19:31 - 2016-12-21 06:03 - 00136544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqmigplugin.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2017-01-10 19:31 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll

2017-01-10 19:31 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2017-01-10 19:31 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2017-01-10 19:31 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll

2017-01-10 19:31 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll

2017-01-10 19:31 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2017-01-10 19:31 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll

2017-01-10 19:31 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2017-01-10 19:31 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2017-01-10 19:31 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2017-01-10 19:31 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2017-01-10 19:31 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll

2017-01-10 19:31 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe

2017-01-10 19:31 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe

2017-01-10 19:31 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll

2017-01-10 19:31 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys

2017-01-10 19:31 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2017-01-10 19:31 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2017-01-10 19:31 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll

2017-01-10 19:31 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2017-01-10 19:31 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll

2017-01-10 19:31 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2017-01-10 19:31 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll

2017-01-10 19:31 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2017-01-10 19:31 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll

2017-01-10 19:31 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll

2017-01-10 19:31 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2017-01-10 19:31 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2017-01-10 19:31 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll

2017-01-10 19:31 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll

2017-01-10 19:31 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2017-01-10 19:31 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll

2017-01-10 19:31 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2017-01-10 19:31 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2017-01-10 19:31 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2017-01-10 19:31 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2017-01-10 19:31 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2017-01-09 18:22 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170109-182203.backup

2017-01-07 15:05 - 2017-01-11 18:51 - 00263016 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2017-01-06 19:49 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170106-194925.backup

2017-01-04 20:25 - 2017-01-04 20:25 - 00001333 _____ C:\Users\Joerg\Desktop\OOSU10861.exe - Verknüpfung.lnk

2017-01-04 20:21 - 2017-01-04 20:21 - 00681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2017-01-04 18:35 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-183515.backup

2017-01-04 00:41 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004142.backup

2017-01-04 00:40 - 2014-05-19 21:15 - 00450709 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20170104-004028.backup

2017-01-04 00:33 - 2017-01-04 00:33 - 00000000 ____D C:\Users\Joerg\Aufnahmen\Documents\ProcAlyzer Dumps

2017-01-04 00:27 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files\Common Files\AV

2017-01-04 00:26 - 2017-01-04 00:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2017-01-04 00:26 - 2017-01-04 00:27 - 00000000 ____D C:\Program Files (x86)\SpybotSearchDestroy2

2017-01-04 00:26 - 2017-01-04 00:26 - 00001401 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking

2017-01-04 00:26 - 2017-01-04 00:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpybotSearchDestroy2

2017-01-04 00:26 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2017-01-03 20:05 - 2017-01-03 20:05 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH

2017-01-02 22:39 - 2017-01-02 22:39 - 00003270 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2

2017-01-02 22:38 - 2017-01-02 22:38 - 00000000 ____D C:\Users\Leo\AppData\Roaming\Skype

2016-12-28 19:03 - 2016-12-28 19:03 - 00001189 _____ C:\Users\Joerg\Desktop\MediathekView.lnk

2016-12-28 19:01 - 2016-12-29 20:58 - 00000000 ____D C:\Users\Joerg\.mediathek3

2016-12-28 18:58 - 2016-12-28 19:03 - 00000000 ____D C:\Program Files (x86)\MediathekView12

2016-12-28 18:55 - 2017-01-21 20:17 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00001989 _____ C:\Users\Public\Desktop\TV-Browser.lnk

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TV-Browser

2016-12-28 18:55 - 2016-12-28 18:55 - 00000000 ____D C:\Program Files (x86)\TV-Browser

2016-12-27 18:27 - 2017-01-11 20:37 - 00000000 ____D C:\Users\Joerg\Aufnahmen\Documents\BotaniculaSaves

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\Joerg\Desktop\Samorost 3.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000222 _____ C:\Users\Joerg\Desktop\Botanicula.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\Joerg\Desktop\Samorost 2.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000221 _____ C:\Users\Joerg\Desktop\Machinarium.url

2016-12-27 15:13 - 2016-12-27 15:13 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-27 14:34 - 2016-12-27 14:34 - 00000000 ____D C:\Users\Joerg\AppData\Local\Chromium

2016-12-24 15:36 - 2017-01-03 19:45 - 00016524 ____H C:\Users\Leo\AppData\Local\IconCache.db

2016-12-24 15:34 - 2017-01-02 23:10 - 00000000 ____D C:\Users\Leo\AppData\Local\ConnectedDevicesPlatform

2016-12-24 15:34 - 2016-12-24 15:34 - 00004676 __RSH C:\Users\Leo\ntuser.pol

2016-12-24 15:34 - 2016-12-24 15:34 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000020 ___SH C:\Users\Leo\ntuser.ini

2016-12-24 15:34 - 2016-12-24 15:34 - 00000000 ____D C:\Users\Leo\AppData\Local\Comms

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\Joerg\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2016-12-24 12:49 - 2016-12-24 12:49 - 00000000 _____ C:\Users\Joerg\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2016-12-23 19:56 - 2016-12-23 19:56 - 11346638 _____ C:\Users\Joerg\Downloads\Amazon-Music-Download_2016-12-23_19-56.zip
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2017-01-22 12:25 - 2016-11-18 18:33 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2017-01-22 10:51 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps

2017-01-22 10:51 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness

2017-01-21 22:11 - 2016-11-18 18:38 - 03421736 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2017-01-21 22:11 - 2016-07-16 23:51 - 01498432 _____ C:\WINDOWS\system32\perfh007.dat

2017-01-21 22:11 - 2016-07-16 23:51 - 00389106 _____ C:\WINDOWS\system32\perfc007.dat

2017-01-21 22:09 - 2012-07-27 20:37 - 00000000 _____ C:\WINDOWS\Path.idx

2017-01-21 22:04 - 2015-05-19 22:05 - 00000000 __SHD C:\Users\Joerg\IntelGraphicsProfiles

2017-01-21 22:04 - 2012-07-27 19:31 - 01048576 _____ C:\WINDOWS\PE_Rom.dll

2017-01-21 22:03 - 2016-11-18 18:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2017-01-21 22:03 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI

2017-01-21 22:03 - 2015-10-15 18:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2017-01-21 22:03 - 2015-06-16 19:22 - 00000000 ____D C:\ProgramData\firebird

2017-01-21 19:55 - 2013-08-24 10:17 - 00000000 ____D C:\Program Files (x86)\QuickTime

2017-01-21 19:50 - 2013-12-07 15:08 - 00000000 ____D C:\ProgramData\Oracle

2017-01-21 19:49 - 2013-06-24 22:31 - 00000000 ____D C:\Program Files (x86)\Java

2017-01-21 16:15 - 2015-08-18 14:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON

2017-01-21 16:15 - 2015-08-18 14:22 - 00000000 ____D C:\Program Files (x86)\epson

2017-01-21 16:15 - 2015-08-18 14:17 - 00000000 ____D C:\ProgramData\Epson

2017-01-21 16:07 - 2016-03-06 11:45 - 00000000 ____D C:\Program Files (x86)\Steam

2017-01-21 14:09 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM

2017-01-21 14:07 - 2016-11-18 18:55 - 00000008 __RSH C:\Users\Joerg\ntuser.pol

2017-01-21 14:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Joerg

2017-01-21 14:07 - 2013-12-27 15:25 - 00000008 __RSH C:\ProgramData\ntuser.pol

2017-01-21 14:00 - 2016-11-18 18:39 - 00000000 ____D C:\Users\DefaultAppPool

2017-01-20 19:04 - 2012-11-06 22:55 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\Notepad++

2017-01-17 19:54 - 2015-11-08 11:57 - 00000000 ____D C:\Users\Joerg\Aufnahmen\Documents\Registry CC_Cleaner

2017-01-16 21:12 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache

2017-01-14 19:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports

2017-01-11 18:52 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF

2017-01-11 18:52 - 2015-10-23 20:52 - 00000000 __RHD C:\Users\Public\AccountPictures

2017-01-11 18:51 - 2013-10-09 12:21 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2017-01-11 07:55 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning

2017-01-11 07:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed

2017-01-11 01:47 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed

2017-01-10 21:01 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp

2017-01-10 20:59 - 2013-08-16 22:43 - 00000000 ____D C:\WINDOWS\system32\MRT

2017-01-10 20:57 - 2012-07-28 17:25 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2017-01-07 15:07 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Mcx1-DELFINE

2017-01-05 17:40 - 2010-11-21 04:27 - 00485032 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2017-01-04 01:47 - 2016-11-18 18:45 - 00003858 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2017-01-03 20:05 - 2012-07-28 16:00 - 00000000 ____D C:\Users\Joerg\AppData\Local\Downloaded Installations

2017-01-03 19:45 - 2016-12-03 14:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2017-01-03 19:45 - 2012-09-07 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2017-01-02 22:41 - 2015-12-03 19:27 - 00000000 ____D C:\Users\Leo\AppData\Local\Packages

2017-01-02 22:39 - 2016-03-06 11:43 - 00002418 _____ C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2017-01-02 22:39 - 2016-03-06 11:43 - 00000000 ___RD C:\Users\Leo\OneDrive

2017-01-02 22:38 - 2015-06-07 17:59 - 00000000 __SHD C:\Users\Leo\IntelGraphicsProfiles

2016-12-31 20:36 - 2014-01-25 15:21 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\KeePass

2016-12-31 13:23 - 2016-12-10 13:37 - 00000000 ____D C:\ProgramData\Foxit Software

2016-12-31 13:23 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Documents

2016-12-31 13:14 - 2012-07-30 21:48 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\Foxit Software

2016-12-31 12:57 - 2012-07-28 16:00 - 00000000 ____D C:\ProgramData\Sonos,_Inc

2016-12-28 19:03 - 2015-07-24 14:57 - 00000000 ____D C:\Users\Joerg\AppData\Roaming\vlc

2016-12-27 16:02 - 2016-03-06 11:57 - 00000000 ____D C:\Users\Joerg\AppData\Local\Steam

2016-12-27 14:32 - 2016-03-06 11:45 - 00001036 _____ C:\Users\Public\Desktop\Steam.lnk

2016-12-27 14:32 - 2016-03-06 11:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2016-12-24 15:42 - 2016-12-03 14:44 - 00000000 ____D C:\WINDOWS\Minidump

2016-12-24 15:36 - 2016-11-18 18:39 - 00524288 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TMContainer00000000000000000001.regtrans-ms

2016-12-24 15:36 - 2016-11-18 18:39 - 00065536 ___SH C:\Users\Leo\NTUSER.DAT{22c1e74d-adb5-11e6-a28c-dd852ca2b43d}.TM.blf

2016-12-24 15:36 - 2016-11-18 18:39 - 00000000 ____D C:\Users\Leo\AppData\Local

2016-12-24 15:34 - 2016-11-18 18:39 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Downloads\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000282 ___SH C:\Users\Leo\Desktop\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000174 ___SH C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Searches

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\Contacts

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2016-12-24 15:34 - 2015-05-03 14:21 - 00000000 ___RD C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Videos

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Saved Games

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Pictures

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Music

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Links

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Favorites

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Downloads

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Documents

2016-12-24 15:34 - 2015-05-03 14:20 - 00000000 ___RD C:\Users\Leo\Desktop

2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2017-01-04 20:21 - 2017-01-04 20:21 - 0681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10861.exe

2015-11-01 17:56 - 2015-11-01 17:56 - 0000000 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\Joerg\AppData\Roaming\5a873492-3d40-49ab-846a-bc059a202348.storage

2015-05-25 10:28 - 2015-05-25 10:28 - 0000093 _____ () C:\Users\Joerg\AppData\Roaming\ARCompanion.log

2016-12-24 12:49 - 2016-12-24 12:49 - 0000000 _____ () C:\Users\Joerg\AppData\Roaming\f0aa1a7e-4626-4653-9ccb-fec05ba6b9ce.storage

2014-02-07 19:26 - 2014-02-07 19:26 - 0000044 _____ () C:\Users\Joerg\AppData\Roaming\WB.CFG

2012-09-23 14:57 - 2016-06-22 20:06 - 0012800 _____ () C:\Users\Joerg\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-12-29 11:00 - 2013-12-29 11:00 - 0000093 _____ () C:\Users\Joerg\AppData\Local\fusioncache.dat

2016-01-30 16:21 - 2016-01-30 16:47 - 0000026 _____ () C:\Users\Joerg\AppData\Local\isoworkshop.ini

2013-02-09 18:39 - 2013-02-09 18:40 - 0000600 _____ () C:\Users\Joerg\AppData\Local\PUTTY.RND

2012-07-28 01:07 - 2012-09-14 22:37 - 0007597 _____ () C:\Users\Joerg\AppData\Local\Resmon.ResmonCfg

2013-09-25 18:08 - 2016-01-30 16:12 - 0000085 ___SH () C:\ProgramData\.zreglib

2012-07-29 16:35 - 2012-07-29 18:52 - 0000297 _____ () C:\ProgramData\Gpu.log
 

==================== Bamital & volsnap ======================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 

LastRegBack: 2017-01-21 18:56
 

==================== Ende von FRST.txt ============================

...und hier das Addition-Log als Nachzügler:

von Addition:

Code:

ZusÃ¤tzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 22-01-2017

durchgefÃ¼hrt von Joerg (22-01-2017 12:42:08)

Gestartet von C:\Users\Joerg\Desktop

Windows 10 Pro Version 1607 (X64) (2016-11-18 17:46:59)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1412286257-1942420214-3619319362-500 - Administrator - Disabled)

ASPNET (S-1-5-21-1412286257-1942420214-3619319362-1006 - Limited - Enabled)

DefaultAccount (S-1-5-21-1412286257-1942420214-3619319362-503 - Limited - Disabled)

Gast (S-1-5-21-1412286257-1942420214-3619319362-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1412286257-1942420214-3619319362-1004 - Limited - Enabled)

Joerg (S-1-5-21-1412286257-1942420214-3619319362-1000 - Administrator - Enabled) => C:\Users\Joerg

Leo (S-1-5-21-1412286257-1942420214-3619319362-1007 - Limited - Enabled) => C:\Users\Leo

Mcx1-DELFINE (S-1-5-21-1412286257-1942420214-3619319362-1002 - Limited - Enabled) => C:\Users\Mcx1-DELFINE
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" kÃ¶nnen in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

AAVUpdateManager (HKLM-x32\...\{0D410F4D-9009-43F8-9DF1-BDADCE7FC43F}) (Version: 3.00.0000 - Akademische Arbeitsgemeinschaft)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)

Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.3 - Adobe Systems Incorporated)

Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 4.4 64-bit (HKLM\...\{11A955CD-4398-405A-886D-E464C3618FBF}) (Version: 4.4.1 - Adobe)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.6.147 - Adobe Systems, Inc.)

AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.04.02 - ASUSTeK Computer Inc.)

Amazon Kindle (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\Amazon Kindle) (Version:  - Amazon)

Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Anno 1602 (HKLM-x32\...\ANNO1602) (Version:  - )

ape@map (HKLM-x32\...\{660ACE0D-40F7-47E0-BDF2-5ED0E0293BEC}) (Version: 3.6.0 - Onyx Technologie OG)

Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AquaSoft DiaShow 9 Ultimate (HKLM-x32\...\AquaSoft DiaShow 9 Ultimate) (Version: 9.5.16 - AquaSoft)

ArchiCAD 16 GER (HKLM\...\001FFF2FFF16FF00FF0201F01F02F000-R1) (Version: 16.0 - GRAPHISOFT)

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)

Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version:  - )

ASUS PC Diagnostics (HKLM-x32\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.2.5 - ASUSTeK Computer Inc.)

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.24.146 - Avira Operations GmbH & Co. KG)

Avira Connect (HKLM-x32\...\{707e8edf-9482-4417-ae39-c9b5fe605e87}) (Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG)

Avira Connect (x32 Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG) Hidden

AXIS Camera Companion 3.11 (HKLM\...\{A6FE3FFD-BD70-4FD6-A436-62417F0A81EB}_is1) (Version: 3.11.001 - Axis Communications AB)

Biet-O-Matic v2.14.8 (HKLM-x32\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)

Botanicula (HKLM\...\Steam App 207690) (Version:  - Amanita Design)

calibre 64bit (HKLM\...\{D8905AF6-9F72-4BD8-BF37-51C5760B3CD5}) (Version: 2.48.0 - Kovid Goyal)

CCleaner (HKLM\...\CCleaner) (Version: 5.26 - Piriform)

chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)

Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.2.100.14 - Citrix Systems, Inc.)

Coast Guard (HKLM-x32\...\Steam App 361200) (Version:  - Reality Twist GmbH)

Cuttermaran 1.70 (HKLM-x32\...\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}) (Version: 1.7.0 - toarnold)

Easy Photo Scan (HKLM-x32\...\{1A6DED1E-A024-455D-AA82-203D6B3B0CBC}) (Version: 1.00.0006 - Seiko Epson Corporation)

Epson Connect Printer Setup (HKLM-x32\...\{D9B1D51B-EB56-410D-AEB5-1CCFAC4B6C8C}) (Version: 1.3.0 - SEIKO EPSON CORPORATION)

Epson Easy Photo Print 2 (HKLM-x32\...\{07AA1C7F-E8CA-4FDC-B975-BC9EBC22B6DE}) (Version: 2.7.0.0 - SEIKO EPSON CORPORATION)

Epson Event Manager (HKLM-x32\...\{9F205E94-9E42-4486-A92A-DF3F6CB85444}) (Version: 3.10.0061 - Seiko Epson Corporation)

Epson E-Web Print (HKLM-x32\...\{6BF9F374-EC67-4808-A90C-F127DE6D989D}) (Version: 1.23.0000 - SEIKO EPSON CORPORATION)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)

EPSON XP-225 Series Printer Uninstall (HKLM\...\EPSON XP-225 Series) (Version:  - SEIKO EPSON Corporation)

EPSON-HandbÃ¼cher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.50.0.0 - SEIKO EPSON CORPORATION)

EpsonNet Print (HKLM\...\{15A0F113-BF2C-4C12-8AA8-42AE0D9AE1C9}) (Version: 3.1.2.0 - SEIKO EPSON Corporation)

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)

FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 8.1.4.1208 - Foxit Software Inc.)

Garmin BaseCamp (HKLM-x32\...\{23A4DBD1-D847-4957-995D-8B1CC527E2E2}) (Version: 4.6.2.0 - Garmin Ltd or its subsidiaries)

Garmin MapSource (HKLM-x32\...\{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}) (Version: 6.16.3 - Garmin Ltd or its subsidiaries)

Garmin USB Drivers (HKLM-x32\...\{510D2239-6C2E-457B-9590-485EC552D94D}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)

GoGear SA4VBE Device Manager (HKLM-x32\...\{E7CA2FE9-1BDB-455D-83A3-0B0D1466EAF9}) (Version: 1.00 - Ihr Firmenname)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)

Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)

Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)

Intel(R) Network Connections 20.0.10.0 (HKLM\...\PROSetDX) (Version: 20.0.10.0 - Intel)

Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)

Intel(R) Smart Connect Technology 2.0 x64 (HKLM\...\{54F8B6C7-9B25-4E85-A1E0-26CFB80DE787}) (Version: 2.0.1083.0 - Intel)

Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)

IntelÂ® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)

IntelÂ® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

IntelÂ® Watchdog Timer Driver (IntelÂ® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)

iTunes (HKLM\...\{76FF0F03-B707-4332-B5D1-A56C8303514E}) (Version: 11.0.4.4 - Apple Inc.)

Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)

Kobo (HKLM-x32\...\Kobo) (Version: 4.0.5579 - Rakuten Kobo Inc.)

LameXP v4.07 (HKLM-x32\...\{FBD7A67D-D700-4043-B54F-DD106D00F308}) (Version: 4.07 Final-1 [Build #1286] - LoRd_MuldeR <mulder2@gmx.de>)

LibreOffice 4.1 Help Pack (German) (HKLM-x32\...\{43295475-62CA-4F25-B46C-43C59258780E}) (Version: 4.1.4.2 - The Document Foundation)

LibreOffice 4.3.7.2 (HKLM-x32\...\{8ED4A1FC-56CF-414C-A9AB-A37714AA9EA7}) (Version: 4.3.7.2 - The Document Foundation)

Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)

Machinarium (HKLM\...\Steam App 40700) (Version:  - Amanita Design)

Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)

Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)

Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.6.0.6200 - Mozilla)

Mozilla Thunderbird 45.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.6.0 (x86 de)) (Version: 45.6.0 - Mozilla)

Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian Heidenreich)

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.2 - )

NVIDIA PhysX v8.05.26 (HKLM-x32\...\{11AE6807-50D2-4F59-82B3-2C3E695E94C2}) (Version: 8.05.26 - NVIDIA Corporation)

Online Plug-in (x32 Version: 14.2.100.14 - Citrix Systems, Inc.) Hidden

OnlineFotoservice (HKLM-x32\...\OnlineFotoservice) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)

paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.1.1 - pdfforge)

phase-6 2.3.4 (HKLM-x32\...\phase-6) (Version: 2.3.4 - phase-6)

Philips Media Convertor v1.2   (HKLM-x32\...\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}) (Version: 4.45 -  )

Photo Station Uploader (remove only) (HKLM-x32\...\Photo Station Uploader) (Version:  - Synology)

PHOTOfunSTUDIO 6.5 BD Edition (HKLM-x32\...\{AD5B7E20-00E1-4B7B-84DC-53F5CEFFA367}) (Version: 6.05.818 - Panasonic Corporation)

PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )

POIbase 2.0.22 (HKLM-x32\...\POIbase_is1) (Version:  - POIbase)

Preispiraten (HKLM-x32\...\{5384EA8A-FECA-4D6E-B7B4-3D4D9D47E5DF}) (Version: 6 - metaspinner net GmbH)

Preispiraten 7 (HKLM-x32\...\{D746E113-378A-45A2-8EB0-DF00BD2454DE}) (Version: 7.1.1.0 - metaspinner net GmbH)

Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 9.2 - Qualcomm Atheros)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)

Republic Heroes (HKLM-x32\...\{5612C844-55BC-4B77-82C2-A2E28962418E}) (Version: 1.00.0000 - LucasArts)

Samorost 2 (HKLM\...\Steam App 40720) (Version:  - Amanita Design)

Samorost 3 (HKLM\...\Steam App 421120) (Version:  - Amanita Design)

SeaTools for Windows (HKLM-x32\...\{98613C99-1399-416C-A07C-1EE1C585D872}) (Version: 1.2.0.6 - Seagate Technology)

Self-Service Plug-in (x32 Version: 4.2.100.5943 - Citrix Systems, Inc.) Hidden

Skypeâ„¢ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION)

Sonos Controller (HKLM-x32\...\{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}) (Version: 34.7.35161 - Sonos, Inc.)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Steuer-Ratgeber 2016-2017 (HKLM-x32\...\{2D99CB45-87EE-4834-BB15-5DD59A024E4C}) (Version: 16.11.6 - Wolters Kluwer Deutschland GmbH)

Steuer-Spar-ErklÃ¤rung 2009 (HKLM-x32\...\{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}) (Version: 14.01.0000 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2010 (HKLM-x32\...\{CE23D66A-B4D8-468B-B932-41159FA54E14}) (Version: 15.18 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2011 (HKLM-x32\...\{9F5FD796-86F0-4360-85F8-D54C0F5411EB}) (Version: 16.19.11 - Akademische Arbeitsgemeinschaft Verlag)

Steuer-Spar-ErklÃ¤rung 2012 (HKLM-x32\...\{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}) (Version: 17.14 - Wolters Kluwer Deutschland GmbH)

Steuer-Spar-ErklÃ¤rung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.11.11 - Wolters Kluwer Deutschland GmbH)

SteuerSparErklÃ¤rung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.14.99 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.42.175 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2016 (HKLM-x32\...\{D331D50C-C578-423B-8BC7-94D3133CE315}) (Version: 21.37.107 - Akademische Arbeitsgemeinschaft)

SteuerSparErklÃ¤rung 2017  (HKLM-x32\...\{45815686-22F8-4D24-872D-E481A654B230}) (Version: 22.20.35 - Wolters Kluwer Deutschland GmbH)

SurveillancePlugin (HKLM-x32\...\{DD3D6671-165A-4823-AB2F-F73316EE0C71}) (Version: 1.0.0.934 - Synology)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )

TomTom MyDrive Connect 4.1.1.2797 (HKLM-x32\...\MyDriveConnect) (Version: 4.1.1.2797 - TomTom)

TV-Browser 3.4.4 (HKLM-x32\...\tvbrowser) (Version: 3.4.4 - TV-Browser Team)

Unity Web Player (HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

XMedia Recode Version 3.3.5.7 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.5.7 - XMedia Recode)

Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {0249BE9D-7295-48C9-8EA3-41C4636235D7} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {085E3A32-ECDB-4286-93A6-BE96375339A6} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {1DB28F69-B61F-4BA9-8695-DCE839D6FF72} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe [2011-09-09] ()

Task: {2038D09C-5622-43D7-8758-4C878C8A60D4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe

Task: {2A7EAD93-6364-4194-B89C-A305D34BB5EE} - System32\Tasks\{A0932F3B-7471-4D67-857B-092DD058D72E} => msiexec.exe /package "C:\Users\Joerg\Downloads\MicrosoftFixit50123.msi"

Task: {2B3DAD67-1F2B-47D9-979F-D9DCCCB9DAD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe

Task: {2BB73430-C81E-4FF3-9D0A-19019A784E95} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {2C6F490F-329D-4E0D-8E9A-156FE30A0CD0} - System32\Tasks\{D9BC4299-7B8A-46FE-95D0-B0FB0F052CA8} => pcalua.exe -a C:\Users\Joerg\Downloads\irfanview_plugins_433_setup.exe -d C:\Users\Joerg\Downloads

Task: {32AE5F22-5189-4C51-9DAB-8840F5580A8A} - System32\Tasks\ASUS\i-Setup225236 => C:\Windows\Chipset\AsusSetup.exe [2010-09-08] (ASUSTeK Computer Inc.)

Task: {33135665-B856-4771-B1C0-995F02BDABFE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-01-10] (Microsoft Corporation)

Task: {33B04117-EF5A-4814-AEE4-7C88C14ADAB9} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {3A38A368-F25C-4142-8202-17C71E472428} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-DELFINE => C:\WINDOWS\ehome\McxTask.exe

Task: {3AFE325C-F25F-4804-89C3-74D568FFB074} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {3BF6D36E-AC15-4EFD-840B-EBBD5575D133} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "hxxp://www.roboform.com/uninstall.html?aaa=KICMJMOJLMJJHMMMMJOMCNMMJMOJIMCNLMOMJJOJCNNJJJOMJMCNOJPMKMJJMJLMNMNJLMOMPMLJJNJICMIMCNGMCNNMFMGMCNOMOMCNGMJMPMPMFMJMCNOMCNIMJMPMOMCNNMJNPICMPMFMFMOMPMJNHICMEKMICNJJCKJNBJCMFLAJKJNIIJJNKJCMJNNICMJNDJCMLJKJ"

Task: {3C1A87E2-487C-4F64-904B-98FA2CBD98E7} - System32\Tasks\{B2308464-6499-4ABC-929A-920DF196783A} => pcalua.exe -a C:\Users\Joerg\Downloads\Intel_MEI_V8001262_XPVistaWin7\setup.exe -d C:\Users\Joerg\Downloads\Intel_MEI_V8001262_XPVistaWin7

Task: {3D1299CA-6366-4630-9EDE-416941473940} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {3D55EEDE-13C3-4151-AE28-BC0E9F25B815} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)

Task: {3DE316FA-36A0-4E43-A65C-BA97CDCAD874} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {42A3DC6D-3D60-4101-8260-C4FA4D6DDA4C} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {49A6CF7B-717F-46E6-9D08-BF1D4BC16702} - System32\Tasks\EPSON XP-225 Series Update {400C43AB-2E87-4983-A887-86105496B879} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {4EA532CD-77F3-47B4-9D5D-888BF06C06FB} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {4F94B588-442D-4357-ADF0-CF6CE0C72462} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {50C0C005-93EF-42E4-84A2-AAB670263950} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {528CABAF-43C9-4AE7-B180-3FDD73E01148} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {5297443F-2E27-4209-86E3-9315B15FBFBF} - System32\Tasks\{F321C931-35DF-4923-94CE-B26E767B491C} => D:\Setup\Setup.exe

Task: {54A56059-C42A-4057-81C8-8BCE697EC1F7} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {589F8A18-086F-4C5A-A2C2-634E5BBEFC25} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {598E6758-D5FD-435E-BF77-6E4F26749D99} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {5BA370C3-34A9-4DAC-8EE1-9962A0DE9E18} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {5C26B83E-986B-4626-BDD9-F77615EC0D4A} - System32\Tasks\ASUS\ASUS Network iControl Help Execute => C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetSvcHelpEntry.exe [2012-05-02] (ASUSTeK Computer Inc.)

Task: {6492A934-A224-48E9-A4D7-66553F0C1E45} - System32\Tasks\{B50D7758-3420-49B0-8664-92A5FB1F6CC9} => pcalua.exe -a C:\Users\Joerg\Downloads\IRST_V11101006_XPWin7\Install\setup.exe -d C:\Users\Joerg\Downloads\IRST_V11101006_XPWin7\Install

Task: {64CB2651-4108-408F-A02E-13600C88F694} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {65D515D0-F153-4DE1-887E-FA3FC1B06D18} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {66DC2431-A42B-43D2-904C-518845E25722} - System32\Tasks\EPSON XP-225 Series Update {001F270C-F9BB-470F-B086-11C7F0EF0C45} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {7A9B340A-D2F3-4EE4-8817-6A6C7ABD0905} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {7E7476F9-7924-4351-8879-DE143BE5C861} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {82CD644B-6699-4A98-8530-1DC3028DA2A5} - System32\Tasks\{0049431D-45DD-4925-B4D3-C8F7996C2C5F} => D:\Setup\Setup.exe

Task: {887D0F05-A015-462B-899F-00230E3D665E} - System32\Tasks\EPSON XP-225 Series Update {8E8C44D1-647B-4702-87C3-50BD8D890228} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {8CDC8717-D6E5-4E71-939C-26AD26E5716C} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1412286257-1942420214-3619319362-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe

Task: {8D1A707C-742F-43D1-9B39-61D39A92946A} - System32\Tasks\ASUS\ASUS DigiPowerControl Help => C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe [2012-03-06] (ASUSTeK Computer Inc.)

Task: {987D7137-1BB0-4471-85DE-80DDD02C91C3} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {990ADD2E-3761-41EE-B369-18BB4398F8D9} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe

Task: {9BAA51D7-1BB0-4978-A852-2C7ECD84B6E6} - System32\Tasks\EPSON XP-225 Series Update {D4D7AC37-2892-4C94-87B6-70E2D581C285} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)

Task: {9D62EB8A-EE4B-4AED-A74F-2188219A43B0} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe

Task: {A0F66942-84FE-4673-82C9-330DF19BF862} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\SpybotSearchDestroy2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {A54BDE5D-A31F-4891-9B21-B7070CA3E40C} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {A55FB450-1D64-42B4-8762-0C696CB4B384} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\Joerg\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe

Task: {AE7FC220-2C08-4928-9F1A-A9D80A9F21ED} - System32\Tasks\ASUS\ASUS WiFi GO! Server Execute => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe [2012-04-19] (ASUSTeK Computer Inc.)

Task: {B6A1F721-876D-41AD-9C0B-30D2B79446FA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\SpybotSearchDestroy2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {B71C4802-D847-40F6-BEEA-AC0CDA6DA5FC} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe

Task: {C183258E-D8AC-400E-9B40-61EA48128590} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {C307EB96-F435-4A95-8D4D-C02C361D0E44} - System32\Tasks\ASUS\i-Setup204402 => C:\Windows\Chipset\AsusSetup.exe [2010-09-08] (ASUSTeK Computer Inc.)

Task: {C41353BE-8F62-4E96-9B38-1BF1856EB93D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-11] (Adobe Systems Incorporated)

Task: {C41DF22E-22E0-423D-BC74-FB1E2D81E455} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {C5319865-C6CC-4B39-8C63-6EAA72C05F28} - System32\Tasks\{125039C6-08E7-4D3A-B032-A1C55F876595} => pcalua.exe -a C:\Users\Joerg\Downloads\Intel_USB3_V104225_Win7\Intel\SetupUSB3_Dell.exe -d C:\Users\Joerg\Downloads\Intel_USB3_V104225_Win7\Intel

Task: {CD9C0807-169B-4A49-BD91-F4F0B80165EA} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {E23AFAFC-35F8-4B25-9586-ED2C1030F76D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-21] (Piriform Ltd)

Task: {E2C1F8A8-B6FD-4C06-8EF6-84D63F4BA583} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

Task: {EF4C2A81-37BA-424D-A992-D95965244269} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe

Task: {F1426AEF-C1DF-42BE-9061-5FA83A524639} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe

Task: {FD23DDF3-51C0-45CC-A8B6-C52977A7CC8C} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {001F270C-F9BB-470F-B086-11C7F0EF0C45}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{001F270C-F9BB-470F-B086-11C7F0EF0C45} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {400C43AB-2E87-4983-A887-86105496B879}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{400C43AB-2E87-4983-A887-86105496B879} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {8E8C44D1-647B-4702-87C3-50BD8D890228}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{8E8C44D1-647B-4702-87C3-50BD8D890228} /F:Update  SYSTEM ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

Task: C:\WINDOWS\Tasks\EPSON XP-225 Series Update {D4D7AC37-2892-4C94-87B6-70E2D581C285}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNFE.EXE :/EXE:{D4D7AC37-2892-4C94-87B6-70E2D581C285} /F:Update  WORKGROUP\DELFINE$ ÄŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
 

==================== VerknÃ¼pfungen =============================
 

(Die EintrÃ¤ge kÃ¶nnen gelistet werden, um sie zurÃ¼ckzusetzen oder zu entfernen.)
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2016-12-15 18:13 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2008-10-24 15:35 - 2008-10-24 15:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

2012-07-28 20:23 - 2012-07-28 20:23 - 00920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

2015-05-11 08:12 - 2015-05-11 08:12 - 00248736 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

2016-12-15 18:13 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll

2016-11-18 18:57 - 2016-11-18 18:57 - 01864384 _____ () C:\Users\Joerg\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll

2014-11-25 04:22 - 2014-11-25 04:22 - 00035328 _____ () C:\Program Files (x86)\Synology\Photo Station Uploader\ShellExtHandler.dll

2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll

2016-11-18 18:31 - 2016-11-18 18:31 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2017-01-10 19:31 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2017-01-10 19:31 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2017-01-10 19:31 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2017-01-10 19:31 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2012-07-28 20:23 - 2017-01-21 22:03 - 00031232 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll

2012-07-28 20:23 - 2010-06-29 09:58 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll

2017-01-04 00:26 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\snlThirdParty150.bpl

2017-01-04 00:26 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\snlFileFormats150.bpl

2017-01-04 00:26 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\DEC150.bpl

2017-01-04 00:26 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\sqlite3.dll

2017-01-04 00:26 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\SpybotSearchDestroy2\av\BDSmartDB.dll

2012-07-28 20:18 - 2012-03-30 17:49 - 00557056 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\MirrorOpSender.dll

2012-07-28 20:18 - 2011-08-16 18:31 - 00229376 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\AudioProjection.dll

2012-07-28 20:18 - 2012-03-03 12:39 - 00184320 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\DLCapPP.dll

2012-07-28 20:18 - 2010-12-14 16:46 - 00067584 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\CoreAudioCap.dll

2012-07-28 20:18 - 2011-08-09 13:52 - 00425984 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\awiscale.DLL

2012-07-28 20:18 - 2012-01-18 21:39 - 00073728 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\IsSupported.dll

2012-07-28 20:18 - 2012-01-12 15:44 - 00475136 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFiGO_HookKey.dll

2012-07-28 20:18 - 2012-04-17 19:35 - 00712704 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiMoveHelp.dll

2012-07-28 20:18 - 2012-04-18 17:15 - 00659456 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\PhoneCtrlAPI.dll

2012-07-27 19:30 - 2011-12-28 18:13 - 00043520 ____N () C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\HookKey32.dll

2012-07-27 19:30 - 2011-09-07 22:23 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\pngio.dll

2012-07-28 20:24 - 2012-05-10 15:38 - 00786432 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\func.dll

2012-07-28 20:24 - 2010-10-05 07:22 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\pngio.dll

2012-07-27 22:18 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

2016-11-18 18:57 - 2016-11-18 18:57 - 01383616 _____ () C:\Users\Joerg\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 

==================== VerknÃ¼pfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurÃ¼ckgesetzt oder entfernt.)
 
 

==================== Internet Explorer VertrauenswÃ¼rdig/EingeschrÃ¤nkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com

IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com

IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com

IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com

IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com

IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com

IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com

IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com

IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net

IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net

IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info

IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
 

Da befinden sich 7924 mehr Seiten.
 

IE trusted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\apemap.com -> hxxp://apemap.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\007guard.com -> install.007guard.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\008k.com -> www.008k.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\00hq.com -> www.00hq.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\010402.com -> 010402.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\0scan.com -> www.0scan.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\1001namen.com -> www.1001namen.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\10sek.com -> www.10sek.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\12-26.net -> user1.12-26.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\12-27.net -> user1.12-27.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\123fporn.info -> www.123fporn.info

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\123simsen.com -> www.123simsen.com
 

Da befinden sich 7925 mehr Seiten.
 

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\007guard.com -> install.007guard.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\008k.com -> www.008k.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\00hq.com -> www.00hq.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\010402.com -> 010402.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\0scan.com -> www.0scan.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\1001namen.com -> www.1001namen.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\10sek.com -> www.10sek.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\12-26.net -> user1.12-26.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\12-27.net -> user1.12-27.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\123fporn.info -> www.123fporn.info

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\...\123simsen.com -> www.123simsen.com
 

Da befinden sich 7925 mehr Seiten.
 

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\007guard.com -> install.007guard.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\008k.com -> www.008k.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\00hq.com -> www.00hq.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\010402.com -> 010402.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\0scan.com -> www.0scan.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\1001namen.com -> www.1001namen.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\10sek.com -> www.10sek.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\12-26.net -> user1.12-26.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\12-27.net -> user1.12-27.net

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\123fporn.info -> www.123fporn.info

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\...\123simsen.com -> www.123simsen.com
 

Da befinden sich 7924 mehr Seiten.
 

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\007guard.com -> install.007guard.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\008k.com -> www.008k.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\00hq.com -> www.00hq.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\010402.com -> 010402.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\0scan.com -> www.0scan.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\1001namen.com -> www.1001namen.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\10sek.com -> www.10sek.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\12-26.net -> user1.12-26.net

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\12-27.net -> user1.12-27.net

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\123fporn.info -> www.123fporn.info

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\123simsen.com -> www.123simsen.com
 

Da befinden sich 7924 mehr Seiten.
 
 

==================== Hosts Inhalt: ===============================
 

(Wenn benÃ¶tigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurÃ¼ckzusetzen.)
 

2009-07-14 03:34 - 2017-01-21 15:10 - 00000938 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix fÃ¼r diesen Bereich.)
 

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Joerg\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1412286257-1942420214-3619319362-1002\Control Panel\Desktop\\Wallpaper -> 

HKU\S-1-5-21-1412286257-1942420214-3619319362-1007\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Control Panel\Desktop\\Wallpaper -> 

DNS Servers: 192.168.178.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte EintrÃ¤ge ==
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO 6.5 BD Edition.lnk => C:\Windows\pss\PHOTOfunSTUDIO 6.5 BD Edition.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Joerg^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Mediencenter.lnk => C:\Windows\pss\Mediencenter.lnk.Startup

MSCONFIG\startupfolder: C:^Users^Joerg^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Persbackup.lnk => C:\Windows\pss\Persbackup.lnk.Startup

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: Greenshot => C:\Program Files (x86)\Greenshot\Greenshot.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: QuickTime Plugin Install => C:\Program Files (x86)\QuickTime\Plugins\DeleteMe1.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

HKLM\...\StartupApproved\StartupFolder: => "phase-6 Reminder.lnk"

HKLM\...\StartupApproved\StartupFolder: => "Philips GoGear SA4VBE Device Manager.lnk"

HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"

HKLM\...\StartupApproved\Run: => "EvtMgr6"

HKLM\...\StartupApproved\Run: => "XboxStat"

HKLM\...\StartupApproved\Run32: => "AXIS Camera Management Service Control"

HKLM\...\StartupApproved\Run32: => "ConnectionCenter"

HKLM\...\StartupApproved\Run32: => "Redirector"

HKLM\...\StartupApproved\Run32: => "EEventManager"

HKLM\...\StartupApproved\Run32: => "ASUS WiFi GO! FileTransfer Execute"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "QuickTime Plugin Install"

HKLM\...\StartupApproved\Run32: => "QuickTime Task"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "Xvid"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "DAEMON Tools Lite"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000002"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000000"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "EPLTarget\P0000000000000001"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "MyDriveConnect.exe"

HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\...\StartupApproved\Run: => "Steam"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => LPort=139

FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808

FirewallRules: [{CFEA598E-2120-49BD-96EB-F0797B9EA7C8}] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe

FirewallRules: [{4C965A15-EEDE-47E3-BE20-17D816B75B7D}] => C:\Program Files (x86)\Steam\SteamApps\common\Coast Guard\Coastguard_1.0.6_PC.exe

FirewallRules: [{CDB0D96B-E705-4D90-B5EF-A1D1D9C3F3C8}] => C:\Program Files (x86)\Steam\SteamApps\common\Coast Guard\Coastguard_1.0.6_PC.exe

FirewallRules: [{2858D5BA-5A6B-4521-9837-907FE731E845}] => C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{6C0E01C2-82D4-4630-A346-D494D4BF9859}] => C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{B8A98421-2E17-48BF-9044-D9A72C76753B}] => C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{C3B9808A-18A2-4000-AA9E-10377986AFF5}] => C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [UDP Query User{3BC405A3-DBD1-4A99-A6E1-25BB589F47F5}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [TCP Query User{18FCC2DF-3675-435F-8C2F-AFC180AA8F9A}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [UDP Query User{6BD828FC-85B2-48F2-B7AC-C1D03ABE92F7}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [TCP Query User{B62BDB5D-59B9-49C2-A061-4660A76E4190}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [{76EB755A-C217-43B9-AB97-AB3CC5E71743}] => C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe

FirewallRules: [{CCE6530F-DE47-4769-A10D-27A7540B991E}] => C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe

FirewallRules: [{D12CF48D-EBD2-46CC-8155-9AA00557844B}] => D:\Network\EpsonNetSetup\ENEasyApp.exe

FirewallRules: [{4E668EC6-B1DC-409C-BECA-8124D618E1CF}] => D:\Network\EpsonNetSetup\ENEasyApp.exe

FirewallRules: [{00B2002E-FA13-4754-A981-7DB171C676DE}] => C:\Program Files (x86)\LucasArts\Republic Heroes\Republic Heroes.exe

FirewallRules: [{C87FC343-DCCB-4E95-ABDF-5572E80780C3}] => C:\Program Files (x86)\LucasArts\Republic Heroes\Republic Heroes.exe

FirewallRules: [UDP Query User{0FDA4A02-B43E-408F-8E26-AF9624B0F30C}E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [TCP Query User{2ABA1A74-557F-4E81-9D5B-1B1401564B2A}E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => E:\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [{6C4922AE-E233-419B-8DBC-4B815F3876A3}] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [{93C98DA4-0F4C-4BD2-B7D0-6602A4343BA2}] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [UDP Query User{4D5F1667-5107-42B2-BB47-7504A4EEA166}C:\program files\axis communications\axis camera companion\cameracompanion.exe] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [TCP Query User{B0D1AADC-A38C-4367-812B-4FA7F451D03E}C:\program files\axis communications\axis camera companion\cameracompanion.exe] => C:\program files\axis communications\axis camera companion\cameracompanion.exe

FirewallRules: [{BBA8BB8A-8C56-4186-9A17-F58B679B9330}] => LPort=55762

FirewallRules: [{128173FE-022E-49B3-9230-2BFE75578837}] => LPort=55762

FirewallRules: [{19740856-4ABF-4673-8D95-B8CE1E14596E}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{694695CC-2D3C-44C4-A20E-857210FD5B05}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{F78A78E0-6842-4FD1-846E-1055ACEDEC28}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1D3E53FC-FEB1-4D76-9B5F-CAF7D29BDD58}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{4A85EC4E-CA2A-477B-8209-123E1A2CC477}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{9B8F944B-779C-4D7C-B60C-E4430C7B1B2E}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{AC68BF19-DDD2-4BD0-B8AF-3D5707C8AAEB}] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [{ADA90A78-3D5E-48AF-9773-270DF8CFEA51}] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [UDP Query User{02D5DF53-C1B5-4179-9EE3-27F6898D6A5E}C:\program files (x86)\mozilla firefox\plugin-container.exe] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [TCP Query User{4EF02AFA-1136-41A6-BB32-936CCCB422B5}C:\program files (x86)\mozilla firefox\plugin-container.exe] => C:\program files (x86)\mozilla firefox\plugin-container.exe

FirewallRules: [{31B3ED73-72C6-46DC-83B1-8F0B0CB048EB}] => LPort=55762

FirewallRules: [{D2DC905A-8E48-495B-AC17-4137F8F6261A}] => C:\Program Files\Axis Communications\AXIS Camera Management 4\AcmService.exe

FirewallRules: [{F3E053F5-4F0D-4034-976F-8B8C5853734C}] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [{798B26A8-9282-4DBD-88FC-B040746D94C9}] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [UDP Query User{6E780017-A414-4393-9EB7-13B2FA88FC63}C:\program files\axis\iputility_4_03\iputility.exe] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [TCP Query User{82D02BC4-776E-4E18-8177-14D2745B15D1}C:\program files\axis\iputility_4_03\iputility.exe] => C:\program files\axis\iputility_4_03\iputility.exe

FirewallRules: [UDP Query User{5BBB9608-DEB7-435C-9370-DBC64EF5650F}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => C:\program files (x86)\synology\photo station uploader\mediauploader.exe

FirewallRules: [TCP Query User{C7859D18-786F-4F43-A999-E718E3BC0598}C:\program files (x86)\synology\photo station uploader\mediauploader.exe] => C:\program files (x86)\synology\photo station uploader\mediauploader.exe

FirewallRules: [{81942376-FD3B-4197-A5A3-89CB0984D46C}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\GSQuickTimeServer\GSQTServer.exe

FirewallRules: [{9B131A22-6841-44D8-89CE-39BA585B3BE3}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\GSQuickTimeServer\GSQTServer.exe

FirewallRules: [{23C8C8A9-FC95-4C51-8F3C-E3CDB09152D9}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\ArchiCAD.exe

FirewallRules: [{1B92B901-0E0B-4D9A-A645-E4ECE9540FC7}] => C:\Program Files\GRAPHISOFT\ArchiCAD 16\ArchiCAD.exe

FirewallRules: [UDP Query User{2B527D4A-0979-457F-B058-075015E17305}C:\program files (x86)\synology\assistant\dsassistant.exe] => C:\program files (x86)\synology\assistant\dsassistant.exe

FirewallRules: [TCP Query User{105EAD33-28FC-4C63-B822-AB44F05655DE}C:\program files (x86)\synology\assistant\dsassistant.exe] => C:\program files (x86)\synology\assistant\dsassistant.exe

FirewallRules: [{75ED169F-8DB5-4722-AE89-62FBBE854CFC}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{1D998D3D-8223-4636-8E86-93BB795A5251}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [UDP Query User{58C69C3A-61EA-4304-B4AE-22645655BCFC}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [TCP Query User{865866B1-1E9C-4956-8759-D34CFC12010C}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [{9D3AAA88-B102-4C34-933E-DB87929112D2}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe

FirewallRules: [{929A6AAF-167E-43A7-A3EC-32CBABCBB555}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x86\FarmingSimulator2013Game.exe

FirewallRules: [{7DFC10B0-0681-458B-A43D-EC50AF205D70}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe

FirewallRules: [{C6C41DC4-E8DF-4325-BE97-2E0A13C61E8B}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\x64\FarmingSimulator2013Game.exe

FirewallRules: [UDP Query User{9863F51A-9F33-4EED-947B-48DD508D4AE0}C:\program files (x86)\axis ip utility\iputility.exe] => C:\program files (x86)\axis ip utility\iputility.exe

FirewallRules: [TCP Query User{1B25536D-2C58-4612-9D5B-DB592E4A2180}C:\program files (x86)\axis ip utility\iputility.exe] => C:\program files (x86)\axis ip utility\iputility.exe

FirewallRules: [{26662F94-2CB6-4FC1-988F-6C1E507975F9}] => C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [UDP Query User{58C41409-AD2A-4345-949A-ADFA74409CDE}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [TCP Query User{B3C179A6-A120-4F10-AF01-6CD611E51EE1}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin

FirewallRules: [{88ECABB1-1106-4C1E-9FAF-C87FFD18161C}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{52FBE9EE-8381-4817-A952-EDBB6F370CB6}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{4502015C-A434-41EE-95D7-A2D838B57A90}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [UDP Query User{DEEED9A7-9523-49B8-9244-507870026302}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [TCP Query User{09E65D64-70E4-41AA-952F-986512849EE9}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [{85A002EC-2129-446E-9994-A0648882749F}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe

FirewallRules: [{1F925845-E9BC-4367-8DB7-A17DF3158B6E}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe

FirewallRules: [{95E3DF19-75C5-4910-8600-E54DB2BA14B2}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe

FirewallRules: [{CF5845A4-DA21-4D17-A082-7784FF2BAC3F}] => C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe

FirewallRules: [UDP Query User{5792E9B3-FFB7-4B7F-A380-AF689C88A395}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [TCP Query User{7A221A22-8A8D-4140-9606-39CC99A01605}C:\program files (x86)\sonos\sonos.exe] => C:\program files (x86)\sonos\sonos.exe

FirewallRules: [{A26F450C-21E8-4DF8-8B62-70CB5E7E4567}] => LPort=1900

FirewallRules: [{34CC79E2-F383-4D87-8818-547E8D7F0200}] => LPort=2869

FirewallRules: [{D2DE30F6-F42D-42E8-B0D2-219826D24BB4}] => LPort=1900

FirewallRules: [{2CF937F4-5179-463C-AAEE-1F112CC58FF4}] => LPort=2869

FirewallRules: [{3E60C3E3-7427-4A42-A9A8-AF7054B81E72}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1F0D96FB-7BEB-4845-9196-91D7E06FE233}] => C:\Program Files (x86)\ASUS\AI Suite II\Wi-Fi GO!\AssistTools\WiFi GO! Server.exe

FirewallRules: [{1CDE3F3E-E8DA-4ED0-8D19-D71C70B58D15}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{5CCCE6DC-E887-4C7F-B150-29019F842CDF}] => C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

FirewallRules: [{F91DF143-BBF6-4B90-B3A4-7FEA128BD50E}] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [{E7FF8417-CAFF-4360-8B34-DA3705F1E73A}] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [TCP Query User{3CA283B0-2D1B-413D-B14C-2580B98122D6}C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe] => C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe

FirewallRules: [UDP Query User{D3AC3942-8448-4305-97FE-331E2A7BC1C4}C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe] => C:\program files (x86)\lucasarts\republic heroes\republic heroes.exe

FirewallRules: [{05D4D977-A8CC-4B50-9A90-756CF1B3AB2B}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{21F58B97-C510-47B5-BD53-239CE0F71F4B}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{4283E0B8-392A-4FB4-B295-106215253441}C:\program files\calibre2\calibre.exe] => C:\program files\calibre2\calibre.exe

FirewallRules: [UDP Query User{BF3696CE-3FA7-49E5-833A-4D86A657822D}C:\program files\calibre2\calibre.exe] => C:\program files\calibre2\calibre.exe

FirewallRules: [{FF63FAD8-D474-44A4-AA51-F58A42C00306}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{DCC98276-F24F-448D-9EC9-620155D7A640}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{557627F4-27F5-49D6-9119-312F7D3128BE}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{64738188-1200-4C95-99BD-2C40DCB9EF65}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 3\Samorost3.exe

FirewallRules: [{AF2E70D4-7865-4CBA-BD8B-7AD73130B938}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 3\Samorost3.exe

FirewallRules: [{B32E2895-40E5-48D9-9186-86446853A75F}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 2\Samorost2.exe

FirewallRules: [{3B668DD2-CADE-4143-A9CA-3AF1CDFE4C19}] => C:\Program Files (x86)\Steam\SteamApps\common\Samorost 2\Samorost2.exe

FirewallRules: [{ECE267E4-302C-42FB-B7E1-8AE558BA20BF}] => C:\Program Files (x86)\Steam\SteamApps\common\Machinarium\machinarium.exe

FirewallRules: [{0B884826-CB58-484E-AF4E-313A7A6CD39E}] => C:\Program Files (x86)\Steam\SteamApps\common\Machinarium\machinarium.exe

FirewallRules: [{4816642A-ADD8-4A47-A5CC-2A3122BB21CE}] => C:\Program Files (x86)\Steam\SteamApps\common\Botanicula\Botanicula.exe

FirewallRules: [{695EE251-1EB8-40B9-8AEB-88C571A80838}] => C:\Program Files (x86)\Steam\SteamApps\common\Botanicula\Botanicula.exe

FirewallRules: [{AEB41CB8-6BAB-4D98-883D-F9767B833EB5}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\java.exe

FirewallRules: [{5BFE816A-70B4-4D79-A040-59B116D149C8}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\java.exe

FirewallRules: [{57CD24E7-7BC5-48A0-9C88-57C46915E449}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\javaw.exe

FirewallRules: [{830A058F-2F77-4DB3-9E7D-05F42BF255A0}] => C:\Program Files (x86)\Java\jre1.8.0_101\bin\javaw.exe

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot-S&D 2 Tray Icon

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\SpybotSearchDestroy2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
 

==================== Wiederherstellungspunkte =========================
 

19-01-2017 21:16:22 Geplanter PrÃ¼fpunkt

21-01-2017 15:14:41 JRT Pre-Junkware Removal
 

==================== Fehlerhafte GerÃ¤te im GerÃ¤temanager =============
 
 

==================== FehlereintrÃ¤ge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (01/22/2017 12:28:08 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/22/2017 12:27:49 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/22/2017 12:27:09 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "c:\program files (x86)\eset\eset online scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:11:58 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:11:34 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:10:52 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Users\Joerg\Desktop\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:10:49 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "c:\users\joerg\desktop\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:10:19 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Users\Joerg\Desktop\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:10:18 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Users\Joerg\Desktop\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 

Error: (01/21/2017 10:09:13 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts fÃ¼r "C:\Users\Joerg\Desktop\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .

Eine fÃ¼r die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.
 
 

Systemfehler:

=============

Error: (01/21/2017 11:39:51 PM) (Source: DCOM) (EventID: 10010) (User: DELFINE)

Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 

Error: (01/21/2017 11:37:51 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 11:37:51 PM) (Source: DCOM) (EventID: 10010) (User: DELFINE)

Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 

Error: (01/21/2017 11:35:51 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Plattformdienst fÃ¼r verbundene GerÃ¤te" wurde mit folgendem Fehler beendet: 

Unbekannter Fehler
 

Error: (01/21/2017 10:18:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÃ„T)

Description: Durch die Berechtigungseinstellungen fÃ¼r "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÃ„T\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" fÃ¼r die COM-Serveranwendung mit der CLSID 

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

 und der APPID 

{F72671A9-012C-4725-9D2F-2A4D32D65169}

 im Anwendungscontainer "Nicht verfÃ¼gbar" (SID: Nicht verfÃ¼gbar) gewÃ¤hrt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool fÃ¼r Komponentendienste geÃ¤ndert werden.
 

Error: (01/21/2017 10:15:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

Der Treiber konnte nicht geladen werden.
 

Error: (01/21/2017 10:15:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

Der Treiber konnte nicht geladen werden.
 

Error: (01/21/2017 10:15:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

Der Treiber konnte nicht geladen werden.
 

Error: (01/21/2017 10:14:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

Der Treiber konnte nicht geladen werden.
 

Error: (01/21/2017 10:14:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

Der Treiber konnte nicht geladen werden.
 
 

CodeIntegrity:

===================================

  Date: 2017-01-15 19:41:51.878

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.850

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.820

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.793

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.765

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.738

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.703

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.647

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.605

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2017-01-15 19:41:51.560

  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz

Prozentuale Nutzung des RAM: 19%

Installierter physikalischer RAM: 16067.15 MB

Verfügbarer physikalischer RAM: 12928.17 MB

Summe virtueller Speicher: 32451.15 MB

Verfügbarer virtueller Speicher: 28744.64 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:214.14 GB) (Free:82.73 GB) NTFS

Drive e: () (Removable) (Total:59.61 GB) (Free:46.66 GB) FAT32

Drive x: (Volume) (Fixed) (Total:931.39 GB) (Free:418.82 GB) NTFS

Drive y: (Volume) (Fixed) (Total:931.39 GB) (Free:280.24 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 85B79A05)
 

Partition: GPT.
 

========================================================

Disk: 1 (Size: 931.5 GB) (Disk ID: 85B79A0A)
 

Partition: GPT.
 

========================================================

Disk: 2 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 2106B09D)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=214.1 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
 

========================================================

Disk: 8 (Size: 59.6 GB) (Disk ID: 00000000)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Servus,

am Besten wäre es, wenn du alle Backups unter
Y:\DELFINE\
selbst (per Hand) löscht und neue anlegst. :)

Reste entfernen
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

start

CloseProcesses:

DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

Unlock: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions

CMD: reg delete "HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions" /v {4D2D3B0F-69BE-477A-90F5-FDDB05357975} /f

Reboot:

end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird!

Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis:
DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
[/url] Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	Microsoft Security Essentials	ESET
	http://filepony.de/icon/emsisoft_anti_malware.png	http://filepony.de/icon/microsoft_se...essentials.png	http://deeprybka.trojaner-board.de/eset/esetmd.png

Microsoft Security Essentials (MSE) / Windows Defender (WD) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE/WD entschieden hast, brauchst du nicht extra MSE/WD zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür.

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/adblock_firefox.pngAdblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren.
http://filepony.de/icon/noscript.png NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:

Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Lade keine Software von Chip, Softonic oder SourceForge. Die dort angebotene Software wird häufig mit einem sog. "Installer" verteilt, mit dem man sich nur unerwünschte Software oder Adware installiert.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Selbst Microsoft unterstützt sog. Registry-Cleaner nicht. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Hallo Matthias,

anbei die Fixlog.txt (ich gebe nachher noch Rückinfo):

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 22-01-2017

durchgeführt von Joerg (23-01-2017 19:33:07) Run:2

Gestartet von C:\Users\Joerg\Desktop

Geladene Profile: Joerg & Mcx1-DELFINE & Leo & DefaultAppPool (Verfügbare Profile: Joerg & Mcx1-DELFINE & Leo & DefaultAppPool)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

start

CloseProcesses:

DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

Unlock: HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions

CMD: reg delete "HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions" /v {4D2D3B0F-69BE-477A-90F5-FDDB05357975} /f

Reboot:

end

         

*****************
 

Prozesse erfolgreich geschlossen.

HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} => Schlüssel erfolgreich entfernt

"HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions" => Schlüssel wurde entsperrt
 

========= reg delete "HKU\S-1-5-21-1412286257-1942420214-3619319362-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions" /v {4D2D3B0F-69BE-477A-90F5-FDDB05357975} /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 

========= Ende von CMD: =========
 
 
 

Das System musste neu gestartet werden.
 

==== Ende von Fixlog 19:33:08 ====

ok, ich warte auf die Rückinfo. :)

Ich bin froh, dass wir helfen konnten :abklatsch:

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! :)

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.