Windows Defender stndig automatisch deaktiviert "Von einem anderen AV-Programm berwacht"
Hallo ihr Lieben,
Gestern habe ich mir durch einen dummen, dummen Fehler Malware von einer dubiosen Seite hruntergeladen (Herstellerseite nicht erreichbar -> Google-Ergebnis darunter genommen -> Malware).
Erstes Symptom waren einige unerwnschte Programme (u.a. Trotux) und die Deaktivierung von Windows Defender ("durch eine Gruppenrichtlinie gesperrt").
In meiner Panik habe ich erstmal viele Schadsoftware-Entfernungsprogramme im und auerhalb des abgesicherten Modus ablaufen lassen. Zuerst Malwarebytes Anti-Malware, dann noch etliche (ich bin nicht stolz drauf) andere Programme, die ich hier im Forum fand, bei denen nicht stand, dass ich sie nur auf Anweisung benutzen sollte, zB Spybot, TDSS-Killer, Windows All-in-One Repair, Emsisoft Emergency Kit, Adw Cleaner.
Einige habe ich mehrmals drberlaufen lassen und meistens wurden auch Dinge gefunden, weswegen ich unsicher bin, welche Logfiles ich nun posten soll.
Zwischendurch (von gestern auf heute) hat der Defender dann wieder normal funktioniert. Aktuelles Problem: Windows Defender lsst sich nicht aktivieren. ber den Umweg Systemsteuerung > Sicherheit und Wartung > "Jetzt aktivieren" ist er fr zwei Sekunden aktiv und springt dann wieder in den "gelben Modus" und sagt "Von einem anderen AV-Programm berwacht", was aber nicht stimmt.
Ich poste nun einfach mal die FRST-Logfile und die erste Log von MBAM nach dem Befall:
FRST: Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-03-2017
durchgefhrt von Michel (Administrator) auf MICHEL-PC (08-03-2017 21:33:59)
Gestartet von D:\Users\Michel\Desktop
Geladene Profile: Michel (Verfgbare Profile: Michel & DefaultAppPool)
Platform: Windows 10 Home Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung fr Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Sandboxie Holdings, LLC) D:\Program Files\Sandboxie\SbieSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) D:\ADF2016.106\bin\intelmpi\bin\smpd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dropbox, Inc.) C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(Ruiware) D:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurckgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16407296 2015-10-08] (Realtek Semiconductor)
HKLM\...\Run: [IgfxTray] => C:\windows\system32\igfxtray.exe [402520 2016-05-27] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM-x32\...\Run: [USB3MON] => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
HKLM-x32\...\Run: [SDTray] => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\Run: [Dropbox Update] => C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-07] (Dropbox, Inc.)
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\Run: [WinPatrol] => D:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1231240 2016-11-14] (Ruiware)
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\MountPoints2: {4b0918bf-c0c0-11e3-a3bc-806e6f6e6963} - "E:\autorun.exe"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATILOE.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-810 Series"
ShellExecuteHooks: Kein Name - {8D0F0CA6-FFDA-11E6-8C16-64006A5CFC23} - C:\Users\Michel\AppData\Roaming\Atafother\Higerk.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\FileSyncShell.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\FileSyncShell.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Michel\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\FileSyncShell.dll [2017-03-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt.14.0.dll [2017-03-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt.14.0.dll [2017-03-06] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2014-06-11]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurckgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{84e11cae-5c3b-491f-a493-03dbdfc4b2c7}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{ead6c754-9863-4a89-b4e7-50014814ba49}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschrnkung <======= ACHTUNG
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschrnkung <======= ACHTUNG
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.kiebel.de
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.kiebel.de
SearchScopes: HKLM -> DefaultScope {3F7DE2EB-CB6E-447A-9B48-7074C17521AF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM -> {3F7DE2EB-CB6E-447A-9B48-7074C17521AF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {3F7DE2EB-CB6E-447A-9B48-7074C17521AF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {3F7DE2EB-CB6E-447A-9B48-7074C17521AF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2730625136-293335315-2397054045-1001 -> DefaultScope {3F7DE2EB-CB6E-447A-9B48-7074C17521AF} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-01-23] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-11-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-23] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-20] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default [2017-03-08]
FF Homepage: Mozilla\Firefox\Profiles\1dktvl07.default -> hxxp://www.wired.com/category/science/
FF Extension: (Ghostery) - C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default\Extensions\firefox@ghostery.com.xpi [2017-02-11]
FF Extension: (Adblock Plus) - C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF Extension: (SHA-1 deprecation staged rollout) - C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default\features\{10d2ad0e-9f6c-44d0-a313-ed31ec670b6f}\disableSHA1rollout@mozilla.org.xpi [2017-03-03]
FF SearchPlugin: C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default\searchplugins\ixquick-https.xml [2014-12-30]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-23] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-23] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> D:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> D:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-04-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2017-03-07]
Chrome:
=======
CHR DefaultProfile: ChromeDefaultData
CHR HomePage: ChromeDefaultData -> hxxps://www.google.com/
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.trotux.com/search/?q={searchTerms}&z=c8cdb5b9597f7b0ca0e2486g8z9bab4bcb8w4e3gcm&from=isr&uid=SamsungXSSDX840XEVOX120GB_S1D5NSBF230651A&type=sp
CHR DefaultSearchKeyword: ChromeDefaultData -> trotux
CHR Profile: C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-03-07] <==== ACHTUNG
CHR Extension: (Google Docs) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-24]
CHR Extension: (Google Drive) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-06-13]
CHR Extension: (YouTube) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-13]
CHR Extension: (Google-Suche) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-09-24]
CHR Extension: (Google Docs Offline) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-06-13]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-06-13]
CHR Extension: (Google Mail) - C:\Users\Michel\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-24]
CHR HKLM\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2017-01-17] (Microsoft Corporation)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG) [Datei ist nicht signiert]
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX) [Datei ist nicht signiert]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [374360 2016-05-27] (Intel Corporation)
R2 impi_smpd; D:\ADF2016.106\bin\intelmpi\bin\smpd.exe [2673816 2015-07-15] (Intel Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-12-29] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
S4 Origin Client Service; D:\Program Files (x86)\Origin\OriginClientService.exe [1930608 2015-03-30] (Electronic Arts)
R2 SbieSvc; D:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
R2 SDScannerService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [246472 2015-09-18] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S4 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [672024 2015-02-26] (Wacom Technology, Corp.)
S2 SpeedupService; "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 AirplaneModeHid; C:\WINDOWS\system32\DRIVERS\AirplaneModeHid.sys [43944 2017-02-24] (Insyde Corporation)
R2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [310728 2016-03-17] ()
R1 epp; C:\EEK\bin64\epp.sys [115216 2017-01-03] (Emsisoft Ltd)
S3 EtronSTOR; C:\WINDOWS\System32\Drivers\EtronSTOR.sys [32512 2012-06-13] (Etron Technology Inc)
S3 FLxHCIh; C:\WINDOWS\system32\drivers\FLxHCIh.sys [77480 2013-02-25] (Fresco Logic)
R0 FPWinIo; C:\WINDOWS\System32\drivers\FPWinIo.sys [83688 2013-08-08] (Egis Technology Inc.)
S3 irstrtdv; C:\WINDOWS\system32\drivers\irstrtdv.sys [43800 2012-07-20] (Intel Corporation)
S3 lehidmini; C:\WINDOWS\system32\drivers\leath_hid.sys [39704 2012-12-21] (Atheros)
R2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [42696 2016-03-17] ()
R3 ManyCam; C:\WINDOWS\system32\DRIVERS\mcvidrv.sys [42016 2013-11-27] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\WINDOWS\system32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
S3 MTsensor; C:\WINDOWS\system32\drivers\ASACPI.sys [15416 2009-05-14] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3343872 2016-07-16] (Intel Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvcvwu.inf_amd64_ce404631a9227a5b\nvlddmkm.sys [14190520 2017-01-17] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 PSI; C:\WINDOWS\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-18] (Realtek )
S3 rusb3hub; C:\WINDOWS\system32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
S3 rusb3xhc; C:\WINDOWS\system32\drivers\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R3 SbieDrv; D:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [44216 2015-09-18] (Synaptics Incorporated)
S1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [121824 2016-07-21] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
U3 idsvc; kein ImagePath
S0 pubksplt; System32\drivers\tbdembdl.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-03-08 21:33 - 2017-03-08 21:34 - 00024177 _____ D:\Users\Michel\Desktop\FRST.txt
2017-03-08 21:33 - 2017-03-08 21:33 - 00000000 ____D C:\FRST
2017-03-08 21:32 - 2017-03-08 21:33 - 02423808 _____ (Farbar) D:\Users\Michel\Desktop\FRST64.exe
2017-03-08 21:27 - 2017-03-08 21:27 - 00010094 _____ D:\Users\Michel\Desktop\mbam-log-2017-03-07.txt
2017-03-08 21:16 - 2017-03-08 21:16 - 00000000 ____D C:\WINDOWS\LastGood
2017-03-08 20:17 - 2017-03-08 20:17 - 00000000 ____D C:\ProgramData\Emsisoft
2017-03-08 20:10 - 2017-03-08 20:10 - 00000000 ____D C:\ProgramData\McAfee
2017-03-08 19:58 - 2017-03-08 19:59 - 15085760 _____ (Microsoft Corporation) D:\Users\Michel\Downloads\MSEInstall(1).exe
2017-03-08 19:57 - 2017-03-08 19:57 - 12256600 _____ (Microsoft Corporation) D:\Users\Michel\Downloads\MSEInstall.exe
2017-03-08 18:31 - 2017-03-08 18:33 - 313018368 _____ D:\Users\Michel\Downloads\kav_rescue_10.iso
2017-03-08 18:11 - 2017-01-23 21:18 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-03-08 17:28 - 2017-03-08 17:29 - 00093852 _____ C:\TDSSKiller.3.1.0.12_08.03.2017_17.28.38_log.txt
2017-03-08 17:14 - 2017-03-08 20:24 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-03-08 17:03 - 2017-03-08 17:03 - 01512368 _____ (Ruiware) D:\Users\Michel\Downloads\wpsetup.exe
2017-03-08 17:03 - 2017-03-08 17:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2017-03-08 17:03 - 2017-03-08 17:03 - 00000000 ____D C:\ProgramData\InstallMate
2017-03-08 16:57 - 2017-03-08 21:04 - 00000000 ____D C:\EEK
2017-03-08 16:53 - 2017-03-08 16:57 - 287415200 _____ D:\Users\Michel\Downloads\EmsisoftEmergencyKit.exe
2017-03-08 16:39 - 2017-03-08 17:29 - 00000000 ____D C:\TDSSKiller_Quarantine
2017-03-08 16:38 - 2017-03-08 16:40 - 00178296 _____ C:\TDSSKiller.3.1.0.12_08.03.2017_16.38.57_log.txt
2017-03-07 20:01 - 2017-03-07 20:01 - 00000000 ____D C:\Program Files\Common Files\AV
2017-03-07 20:01 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) D:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2017-03-07 18:10 - 2017-03-07 18:10 - 00000000 ____D C:\Program Files (x86)\{D814EA0D-5004-47A9-8633-DFFECBB48407}
2017-03-07 17:41 - 2017-03-07 20:01 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-07 17:40 - 2017-03-07 20:40 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-07 17:40 - 2017-03-07 17:40 - 00001261 _____ D:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2017-03-07 17:40 - 2017-03-07 17:40 - 00001119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2017-03-07 17:40 - 2017-03-07 17:40 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-07 17:40 - 2017-03-07 17:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2017-03-07 17:40 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2017-03-07 16:24 - 2017-03-07 16:24 - 00000000 ___RD C:\Sandbox
2017-03-07 16:00 - 2017-03-08 16:00 - 00001910 _____ C:\WINDOWS\Sandboxie.ini
2017-03-07 16:00 - 2017-03-08 11:08 - 00000981 _____ D:\Users\Michel\Desktop\Sandboxed Web Browser.lnk
2017-03-07 16:00 - 2017-03-07 16:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-07 15:59 - 2017-03-07 15:59 - 08974992 _____ (Sandboxie Holdings, LLC) D:\Users\Michel\Downloads\SandboxieInstall.exe
2017-03-07 15:36 - 2017-03-07 15:36 - 00003646 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-03-07 15:30 - 2017-03-07 15:30 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-MICHEL-PC-Windows-10-Home-(64-bit).dat
2017-03-07 15:30 - 2017-03-07 15:30 - 00000000 ____D C:\RegBackup
2017-03-07 15:06 - 2017-03-07 15:06 - 00191134 _____ C:\WINDOWS\Tweaking.com - Windows Repair Setup Log.txt
2017-03-07 15:05 - 2017-03-07 15:06 - 32823032 _____ (Tweaking.com) D:\Users\Michel\Downloads\tweaking.com_windows_repair_aio_setup.exe
2017-03-07 15:04 - 2017-03-07 15:04 - 00000000 ____D D:\Users\Michel\Downloads\tweaking.com_windows_repair_aio
2017-03-07 15:03 - 2017-03-07 15:03 - 19731263 _____ D:\Users\Michel\Downloads\tweaking.com_windows_repair_aio.zip
2017-03-07 14:53 - 2017-03-07 14:53 - 00448512 _____ (OldTimer Tools) D:\Users\Michel\Desktop\TFC.exe
2017-03-07 14:39 - 2017-03-07 14:49 - 00098018 _____ C:\TDSSKiller.3.1.0.12_07.03.2017_14.39.54_log.txt
2017-03-07 14:38 - 2017-03-07 14:39 - 04747704 _____ (AO Kaspersky Lab) D:\Users\Michel\Desktop\tdsskiller.exe
2017-03-07 13:18 - 2017-03-07 13:18 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_avusbflt_01011.Wdf
2017-03-07 13:14 - 2017-03-07 15:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-03-07 13:14 - 2017-03-07 15:45 - 00000000 ____D D:\Users\Public\Speedup Sessions
2017-03-07 13:14 - 2017-03-07 13:14 - 04771240 _____ (Avira Operations GmbH & Co. KG) D:\Users\Michel\Downloads\avira_de_fass0_58bea1e5b79a2__ws.exe
2017-03-07 13:14 - 2017-03-07 13:14 - 00000000 ____D C:\WINDOWS\System32\Tasks\Avira
2017-03-07 12:31 - 2017-03-07 12:31 - 00000000 ____D D:\Users\Michel\Desktop\Backup
2017-03-07 12:13 - 2017-03-08 17:17 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-03-07 12:13 - 2017-03-07 12:13 - 00003248 _____ C:\WINDOWS\System32\Tasks\{C3EACEB5-CBD8-4A52-BC5B-ECDC142929FD}
2017-03-07 12:11 - 2017-03-07 12:17 - 00000000 ____D C:\WINDOWS\system32\SSL
2017-03-07 12:10 - 2017-03-08 20:27 - 00000000 ____D C:\Program Files (x86)\Keqersjoole
2017-03-07 12:10 - 2017-03-07 12:10 - 00006048 _____ C:\WINDOWS\System32\Tasks\Ghesoing Host
2017-03-06 13:04 - 2017-03-06 13:04 - 00072823 _____ D:\Users\Michel\Downloads\Nutzungsbedingungen_Elektronisches_Postfach.PDF
2017-03-06 12:11 - 2017-03-06 12:11 - 00000000 ____D C:\Program Files (x86)\7-Zip
2017-03-06 11:08 - 2017-03-06 11:11 - 00000000 ____D D:\Users\Michel\Desktop\Alle i386
2017-03-06 11:00 - 2017-03-06 11:01 - 00000000 ____D D:\Users\Michel\Desktop\XP-Setup
2017-03-05 23:12 - 2017-03-05 23:17 - 00000000 ____D D:\Users\Michel\Downloads\Anstalt The Game
2017-02-28 15:33 - 2017-03-01 17:32 - 00008176 _____ D:\Users\Michel\Desktop\SP Up Records.xlsx
2017-02-28 12:53 - 2017-02-28 12:53 - 00001543 _____ D:\Users\Michel\Desktop\AssassinsCreed_Game.exe - Verknpfung.lnk
2017-02-28 11:39 - 2017-02-28 11:39 - 00000000 ____D C:\ProgramData\Ubisoft
2017-02-24 01:25 - 2017-02-24 01:25 - 00043944 _____ (Insyde Corporation) C:\WINDOWS\system32\Drivers\AirplaneModeHid.sys
2017-02-11 21:29 - 2017-02-11 21:29 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2017-02-11 21:29 - 2016-12-29 14:10 - 00001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2017-02-11 21:29 - 2016-09-09 19:25 - 00269600 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2017-02-11 21:29 - 2016-09-09 19:25 - 00261920 _____ C:\WINDOWS\system32\vulkan-1.dll
2017-02-11 21:29 - 2016-09-09 19:25 - 00110880 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2017-02-11 21:29 - 2016-09-09 19:24 - 00125216 _____ C:\WINDOWS\system32\vulkaninfo.exe
2017-02-09 02:50 - 2017-02-09 02:53 - 00000000 ____D D:\Users\Michel\Downloads\DRUCKEN
2017-02-07 03:28 - 2017-02-07 03:28 - 00018322 _____ D:\Users\Michel\Desktop\ggg.nuts
2017-02-07 01:44 - 2017-02-07 01:45 - 22319703 _____ (NosVidz) D:\Users\Michel\Desktop\Ultima Tool.exe
==================== Ein Monat: Genderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-03-08 21:26 - 2014-06-11 22:27 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-08 21:19 - 2016-09-30 23:32 - 01975334 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-08 21:19 - 2016-07-16 23:51 - 00861310 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-08 21:19 - 2016-07-16 23:51 - 00172898 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-08 21:17 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-08 21:16 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-08 21:14 - 2016-09-30 23:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-08 21:14 - 2016-09-30 23:31 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-03-08 21:14 - 2016-09-30 23:31 - 00000000 ____D C:\ProgramData\NVIDIA
2017-03-08 21:13 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-03-08 21:05 - 2014-08-21 22:28 - 00000000 ____D D:\Users\Michel\Downloads\Sonstige
2017-03-08 19:44 - 2016-09-30 23:30 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-08 18:11 - 2015-02-01 14:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-08 18:06 - 2016-09-30 23:32 - 00000000 ____D C:\Users\Michel
2017-03-08 17:22 - 2014-08-04 22:48 - 00000000 ____D C:\Program Files (x86)\Google
2017-03-08 15:38 - 2017-02-05 19:45 - 00001013 _____ D:\Users\Michel\Desktop\NosTale.lnk
2017-03-08 14:11 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-08 14:11 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-07 18:55 - 2017-01-29 22:49 - 00003280 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-03-07 15:49 - 2015-04-07 06:17 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-07 15:41 - 2016-09-30 23:30 - 00377008 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-03-07 15:40 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-07 15:36 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-03-07 14:50 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-03-07 12:50 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\appcompat
2017-03-07 12:25 - 2015-09-24 02:27 - 00000946 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2017-03-07 11:56 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2017-03-06 19:11 - 2016-09-30 23:39 - 00004072 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-03-06 19:11 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-06 19:11 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-05 22:54 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-03 13:50 - 2016-09-30 23:31 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-03-01 09:24 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-03-01 09:23 - 2014-04-12 19:31 - 00000000 ____D C:\Program Files\Microsoft Office 15
2017-02-28 11:25 - 2014-04-10 15:19 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-02-28 11:24 - 2010-11-21 04:27 - 00485032 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-02-23 23:31 - 2016-03-10 18:29 - 00001057 _____ D:\Users\Michel\Desktop\OriginPro 2016G 64Bit.lnk
2017-02-23 21:38 - 2013-12-02 18:36 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-02-23 21:34 - 2013-12-02 18:36 - 138020592 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-02-11 21:29 - 2016-09-30 23:31 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-02-11 21:29 - 2014-04-10 15:29 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-02-06 20:48 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-02-06 20:48 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-02-24 03:44 - 2017-02-24 03:44 - 0000863 _____ () C:\Users\Michel\AppData\Local\recently-used.xbel
2015-09-04 22:40 - 2015-09-04 22:40 - 0000017 _____ () C:\Users\Michel\AppData\Local\resmon.resmoncfg
2016-09-26 23:57 - 2016-09-26 23:57 - 0010488 _____ () C:\ProgramData\regid.1997-07.com.scm_B3DEAC5E-9B64-439B-900D-A6941F955BB6.swidtag
2015-03-14 16:08 - 2015-03-14 16:08 - 0001534 _____ () C:\ProgramData\ss.ini
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix fr Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-03-06 12:05
==================== Ende von FRST.txt ============================
Addition: Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-03-2017
durchgeführt von Michel (08-03-2017 21:34:25)
Gestartet von D:\Users\Michel\Desktop
Windows 10 Home Version 1607 (X64) (2016-09-30 22:40:44)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2730625136-293335315-2397054045-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2730625136-293335315-2397054045-503 - Limited - Disabled)
Gast (S-1-5-21-2730625136-293335315-2397054045-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2730625136-293335315-2397054045-1002 - Limited - Enabled)
Michel (S-1-5-21-2730625136-293335315-2397054045-1001 - Administrator - Enabled) => C:\Users\Michel
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.00 (HKLM-x32\...\7-Zip) (Version: 16.00 - Igor Pavlov)
7-Zip 16.00 (x64) (HKLM\...\7-Zip) (Version: 16.00 - Igor Pavlov)
A New Beginning SdJ (HKLM-x32\...\{042E538E-5A72-4C3E-AB53-1DB65596CA33}) (Version: 1.2.1 - Deep Silver)
Adobe Flash Player 21 ActiveX (HKLM-x32\...\{92C34178-B679-4C83-AC33-7EFCE6D36E01}) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\{68E93C1A-9585-4C06-B294-1123FD7929BE}) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
Amsterdam Density Functional (ADF) Program (HKLM-x32\...\{cbdb1e09-8f88-41e2-a050-a86d82e86e9c}) (Version: 16.106.54360 - Scientific Computing & Modelling)
Anna's Quest (HKLM-x32\...\Steam App 327220) (Version: - Daedalic Entertainment)
Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)
Bejeweled® 3 (HKLM-x32\...\{E99C27B2-EB2E-4244-9F5C-A96F55100F0C}) (Version: 1.1.13.4753 - Electronic Arts, Inc.)
Benutzerhandbuch anzeigen (HKLM-x32\...\View User Guide) (Version: 3.60.43.0 - )
Bottle (HKLM\...\Steam App 463030) (Version: - Tonguç Bodur)
Cargo Commander (HKLM-x32\...\Steam App 220460) (Version: - Serious Brew)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deponia: The Complete Journey (HKLM-x32\...\Steam App 292910) (Version: - Daedalic Entertainment)
Dev Guy (HKLM-x32\...\Steam App 351800) (Version: - )
DLC Quest (HKLM-x32\...\Steam App 230050) (Version: - Going Loud Studios)
Dropbox (HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\Dropbox) (Version: 21.4.25 - Dropbox, Inc.)
EgisTec Fingerprint Driver (HKLM-x32\...\InstallShield_{74AB6665-AFFE-4419-BC7D-7EB3A68DE5BC}) (Version: 3.2.7.0 - Egis Technology Inc.)
EPSON XP-810 Series Printer Uninstall (HKLM\...\EPSON XP-810 Series) (Version: - SEIKO EPSON Corporation)
Fingerprint Driver (x32 Version: 3.2.7.0 - Egis Technology Inc.) Hidden
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FotoŸraf Galerisi (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galer*a de fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Geheimakte 2 - Puritas Cordis (HKLM-x32\...\{BE7347AD-2D93-4A74-8DBF-C1B073DAE509}) (Version: 1.00.0000 - Deep Silver)
Geheimakte 3 (HKLM-x32\...\{AC988375-C56F-4B24-A048-90C03DA1C827}) (Version: 1.00 - Deep Silver)
Geheimakte Tunguska (HKLM-x32\...\{3B416FDA-CB3E-4514-9616-763E5B0D1140}) (Version: 1.03.02 - Deep Silver)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Gray Matter (HKLM\...\Steam App 260570) (Version: - WizarBox Production)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Her Story (HKLM\...\Steam App 368370) (Version: - Sam Barlow)
Insyde Airplane Mode HID Mini-Driver (HKLM\...\AirplaneModeHid) (Version: 1.4.0.4 - Insyde Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Jurassic Park: The Game (HKLM\...\Steam App 201830) (Version: - Telltale Games)
KCService.de Fernwartung (HKLM-x32\...\{25D56EF8-ED54-41F2-B3AB-C62F76A54E1E}) (Version: 1.0.0 - KCS Service GmbH)
Life Is Strange„ (HKLM-x32\...\Steam App 319630) (Version: - DONTNOD Entertainment)
Lost Horizon (HKLM\...\Steam App 40350) (Version: - Animation Arts)
Lost Horizon 2 (HKLM\...\Steam App 395560) (Version: - Animation Arts GmbH)
MAGIX Analogue Modelling Suite Plus (HKLM\...\MX.{F485F2FE-1D3D-4F6D-AD4E-13FA5FB22A88}) (Version: 1.0.0.0 - MAGIX Software GmbH)
MAGIX Analogue Modelling Suite Plus (Version: 1.0.0.0 - MAGIX Software GmbH) Hidden
MAGIX Screenshare (HKLM-x32\...\{9E1C4D6B-4600-434D-8B88-1C5657D1FF74}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (MSI) (HKLM-x32\...\{4C128290-346A-476F-B04A-15CFE3F96920}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Vandal VST-PlugIn (HKLM\...\MX.{24F96DED-7B99-49C4-B877-CDCDC37762FA}) (Version: 1.0.0.0 - MAGIX Software GmbH)
MAGIX Vandal VST-PlugIn (Version: 1.0.0.0 - MAGIX Software GmbH) Hidden
MAGIX VariVerb II VST-PlugIn (HKLM\...\MX.{7A97538C-6D3F-4BB5-B2A1-D0ECFB199A4C}) (Version: 1.0.0.0 - MAGIX Software GmbH)
MAGIX VariVerb II VST-PlugIn (Version: 1.0.0.0 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe MX Premium (HKLM-x32\...\MAGIX_MSI_Videodeluxe18_premium) (Version: 11.0.1.4 - MAGIX AG)
MAGIX Video deluxe MX Premium (x32 Version: 11.0.1.4 - MAGIX AG) Hidden
MAGIX Vintage Effects Suite (HKLM\...\MX.{48978B41-9CD5-4274-9519-B622DD89727D}) (Version: 1.0.0.0 - MAGIX Software GmbH)
MAGIX Vintage Effects Suite (Version: 1.0.0.0 - MAGIX Software GmbH) Hidden
ManyCam 4.0.44 (HKLM-x32\...\ManyCam) (Version: 4.0.44 - Visicom Media Inc.)
ManyCam Packages (HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\ManyCam Packages) (Version: - ) <==== ACHTUNG
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4903.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 48.0 (x64 de) (HKLM\...\Mozilla Firefox 48.0 (x64 de)) (Version: 48.0 - Mozilla)
Mozilla Firefox 51.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 51.0.1 (x86 de)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NBTExplorer (HKLM-x32\...\{7FDA6483-6CA9-4A9E-AED2-B8E894B159F0}) (Version: 2.7.5.0 - Justin Aquadro)
NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
NVIDIA Grafiktreiber 376.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.54 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4903.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4903.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4903.1002 - Microsoft Corporation) Hidden
OpenOffice 4.1.3 (HKLM-x32\...\{8D5FCC56-BB9F-4122-923C-71753F50F6F5}) (Version: 4.13.9783 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Origin 2016 (HKLM-x32\...\{DC460501-EEFA-4701-8AD8-5F7DE1B70436}) (Version: 9.30.00 - OriginLab Corporation)
Pixel Boy and the Ever Expanding Dungeon (HKLM-x32\...\Steam App 263080) (Version: - Giant Box Games)
Poczta us‚ugi Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
Raccolta foto (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7629 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform)
RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version: - Enterbrain)
Safecracker: The Ultimate Puzzle Adventure (HKLM-x32\...\Steam App 3260) (Version: - Kheops Studio)
Samplitude Pro X2 Silver (HKLM\...\MX.{C3A3C7A2-0118-4EAA-B51D-E8F26B22D320}) (Version: 13.1.1.164 - MAGIX Software GmbH)
Samplitude Pro X2 Silver (Version: 13.1.1.164 - MAGIX Software GmbH) Hidden
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.0.15 - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.29.00(26.03.2014) - Samsung Electronics Co., Ltd.)
Samsung M2020 Series (HKLM-x32\...\Samsung M2020 Series) (Version: 1.12 (16.04.2014) - Samsung Electronics Co., Ltd.)
Sandboxie 5.16 (64-bit) (HKLM\...\Sandboxie) (Version: 5.16 - Sandboxie Holdings, LLC)
Secret Files: Puritas Cordis (HKLM\...\Steam App 40340) (Version: - Animation Arts)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype„ 7.28 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)
Skyrim Script Extender (SKSE) (HKLM\...\Steam App 365720) (Version: - The SKSE Team)
Slik Subversion 1.8.10 (x64) (HKLM\...\{77E9DE63-9345-4940-A288-0DF70243E2B2}) (Version: 1.8.10017 - SlikSvn & The SharpSvn Project)
Spore (HKLM-x32\...\Steam App 17390) (Version: - Maxis„)
Spotify (HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\Spotify) (Version: 1.0.42.151.g19de0aa6 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Stardew Valley (HKLM-x32\...\Steam App 413150) (Version: - ConcernedApe)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.24.1 - Synaptics Incorporated)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version: - Nicalis, Inc.)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Stanley Parable (HKLM-x32\...\Steam App 221910) (Version: - Galactic Cafe)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.11-4 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinPatrol (HKLM-x32\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 34.11.2016.27 - Ruiware)
žсновн‹е компонен‚‹ Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Ÿо‡‚а Windows Live (x32 Version: 16.4.3528.0331 - šо€по€а†ия œайк€осо„‚) Hidden
Фо‚оалŒбом (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Фо‚ог€а„ии (об‰едос‚ƒпная ве€сия) (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2730625136-293335315-2397054045-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Michel\AppData\Roaming\Dropbox\bin\DropboxExt64.14.0.dll (Dropbox, Inc.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {00789B55-134B-4569-BE6D-9DE374C67C25} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2730625136-293335315-2397054045-1001UA1d2393a13bc93a1 => C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {035708D8-F058-4BB1-A3E9-53F76609B773} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {04650204-B9FB-485E-8AC5-9DF5FD8F88BD} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {06EB9B61-B63D-41DB-AD5A-6D0FD7E31903} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {0E8CC4D7-BDD0-43F6-8A4F-844ECA49E8C0} - System32\Tasks\EPSON XP-810 Series Invitation {1BD83521-B921-4DDD-A61B-CA979DE30223} => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLOE.EXE
Task: {0FB1E33C-43C6-4C43-9C1C-D1281BEF935C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {1029A438-2966-4B62-B12D-AE117E8FF64F} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {146CFBAD-6313-4072-A215-6F8B44841A54} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {175223D0-A330-406C-9678-D56CE186CE44} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {19F8FD3B-0308-4F51-9DD0-55623B1DD661} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> Keine Datei <==== ACHTUNG
Task: {1E06C2D5-9A20-4AE3-AC96-F88742375464} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {212724CC-164D-4F03-B314-38D86C2CBB81} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {255D7F81-219E-4778-BE4F-E3D27A7F3CC6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {3644FC6A-5736-4174-875E-752D67CA3BAF} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe
Task: {48A58670-603B-43FB-92E7-8F2EBB06DE24} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {4ADAE3D4-8087-489F-A0FC-8BF4CA05BE56} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {4B8F6C4D-3637-4C6D-B2D3-C329A5021FC9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {4C0C6E58-8C33-476F-B93B-ED3CF1EA1777} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {5361AB7C-F517-47E9-92A6-DB4D7484AF2D} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {54BA4066-E3C1-4610-85F4-BAF418FAC778} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {56785D5E-5843-4D55-A87D-72D0E96F64E6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {5B420021-2A04-4076-A4DD-E5FBE0794626} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-03-06] (Adobe Systems Incorporated)
Task: {5C7A888B-CF5D-4EE2-8142-83CAC96AC1B2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {61C620C6-BDDB-4F98-9BEF-D7CD58E6DD0A} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe
Task: {645CC495-9A37-4E6A-99C1-4BE0D9F4A3BA} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {648382A2-B259-4547-9646-08CD7FF9546E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {67111CA8-98D6-41AB-B21A-03B122D646F0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {683DFC02-2EE8-4556-AAF7-3EA941B7FF8C} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {73EADE63-3646-4567-B69D-99989BA2093F} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {747EA95F-FE29-4495-A31D-1537DCC20CDD} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {7528A126-8A1D-40F6-AA59-1644C6DB40C8} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {80CEC5FA-DA5C-4AB7-B7BE-B7B1AA236FA8} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {897F82A5-F1E5-404B-BAC3-79F0BB0B8BF5} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => %SystemRoot%\ehome\ehrec.exe
Task: {8B2FC106-7202-4843-98A4-86DDC953225C} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-01-17] (Microsoft Corporation)
Task: {8C462D8B-83FF-425F-9891-6C15EDB8C33E} - \Ghusphckrosy -> Keine Datei <==== ACHTUNG
Task: {91C941A6-82CD-4C48-B3F3-F64CDCD1AD22} - System32\Tasks\EPSON XP-810 Series Update {1BD83521-B921-4DDD-A61B-CA979DE30223} => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLOE.EXE
Task: {9372D208-7301-4582-90A7-ADFB721E8557} - \XZfSlWifHh -> Keine Datei <==== ACHTUNG
Task: {9940C1F2-571E-4F09-B380-15F47E459553} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {9FF2351D-0A88-48B5-9109-815B230D6CF6} - System32\Tasks\{4D7F4E17-5D7E-4BE8-AAFE-8E5F6EBC2BB0} => pcalua.exe -a "D:\Program Files (x86)\Nordic Games\Black Mirror III\BlackMirrorIII.exe" -d "D:\Program Files (x86)\Nordic Games\Black Mirror III"
Task: {A9CD3270-BE34-488D-BECB-6B7384F32E6E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {B6673917-ED48-4801-9B8A-5434FA031B1F} - System32\Tasks\{C3EACEB5-CBD8-4A52-BC5B-ECDC142929FD} => pcalua.exe -a "C:\Program Files (x86)\hdjTLsd0Pp\uninstall.exe"
Task: {B8837E27-5230-4530-9174-DDBB18135D88} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> Keine Datei <==== ACHTUNG
Task: {BB074D4D-AE35-4F80-ABDB-4CD711683289} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {C03C9896-A842-438C-B183-18BC34081CB5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {C15BE67E-A7D6-4BA6-920B-37AFAC705AE6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {C964B598-2514-4708-853A-FD80CC2BD8CE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-01-17] (Microsoft Corporation)
Task: {CA95C21D-CCF1-4F03-A23F-547404065D6C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2730625136-293335315-2397054045-1001Core1d2393a13b17ace => C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {CADA1176-C611-4AF6-9EA0-479A2558CD2F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D2CCDB10-067D-4D77-ACE0-70FFE89771EE} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {D4DFB434-A470-4B04-A732-75101270E78F} - System32\Tasks\Avira\System Speedup\SpeedupSysTray => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe
Task: {D76B1AFB-84BB-43A4-A163-22D7C68028DE} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D79A994A-8791-4292-871B-B9D56AAB575B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D7CCA4B2-E2FD-4C96-88FD-54B599E7A5E4} - System32\Tasks\{7244929C-15AE-4F25-AAC7-8C59A0D0A9F1} => pcalua.exe -a D:\Users\Michel\Downloads\c-design-w7-setup.exe -d D:\Users\Michel\Downloads
Task: {E7DB1019-E6C5-4BFB-8D05-D0EF574A847E} - System32\Tasks\Ghesoing Host => C:\Program Files (x86)\Keqersjoole\xerwut.exe [2017-03-07] (Glarysoft Ltd)
Task: {EC27F53B-6B6F-4E23-B4A0-28D9A34CA8B2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {EC5D5CA5-C02C-492F-B6A7-E16EC008BADD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {ED55CEFC-B318-4B3F-9EE2-A61516BE2321} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Keine Datei <==== ACHTUNG
Task: {EE6920D1-75A9-4894-BD97-273D45392D4C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {F73F0D5E-6DEB-4701-B050-CD16E133DE7F} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> Keine Datei <==== ACHTUNG
Task: {F917E2F7-7D3B-4237-9BC4-A3B8EF5F973E} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2730625136-293335315-2397054045-1001Core1d2393a13b17ace.job => C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2730625136-293335315-2397054045-1001UA1d2393a13bc93a1.job => C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\EPSON XP-810 Series Invitation {1BD83521-B921-4DDD-A61B-CA979DE30223}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLOE.EXE
Task: C:\WINDOWS\Tasks\EPSON XP-810 Series Update {1BD83521-B921-4DDD-A61B-CA979DE30223}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLOE.EXE :/EXE:{1BD83521-B921-4DDD-A61B-CA979DE30223} /F:Update SYSTEM ŠSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-14 20:35 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-11 10:35 - 2013-05-29 12:56 - 00034304 _____ () C:\WINDOWS\System32\ssj2mlm.dll
2016-02-15 20:01 - 2016-02-15 20:01 - 00031256 _____ () C:\WINDOWS\System32\us008lm.dll
2014-04-13 16:12 - 2017-01-17 03:25 - 00117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2016-09-30 23:31 - 2016-12-29 14:16 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-12-14 20:35 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-05-27 14:50 - 2016-05-27 14:50 - 00402520 _____ () C:\WINDOWS\system32\igfxTray.exe
2016-10-01 00:26 - 2016-10-01 00:26 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 23:17 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 23:16 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 23:16 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 23:16 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 23:16 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-12 23:16 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 23:16 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2012-03-09 08:58 - 2012-03-09 08:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 08:58 - 2012-03-09 08:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2017-02-23 21:27 - 2017-02-23 21:28 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-23 21:27 - 2017-02-23 21:28 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-23 21:27 - 2017-02-23 21:28 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 18:53 - 2017-02-06 18:53 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-03-07 17:40 - 2014-05-13 12:04 - 00109400 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2017-03-07 17:40 - 2014-05-13 12:04 - 00167768 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2017-03-07 17:40 - 2014-05-13 12:04 - 00416600 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2017-03-07 17:40 - 2012-08-23 10:38 - 00574840 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2017-03-07 17:40 - 2012-04-03 17:06 - 00565640 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-04-10 20:04 - 2015-03-28 04:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 03:34 - 2017-03-08 21:06 - 00000857 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\kiebel.de\kcsgaming_blueeagle_1920x1200.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: BstHdLogRotatorSvc => 2
MSCONFIG\Services: BstHdUpdaterSvc => 2
MSCONFIG\Services: EPSON_PM_RPCV4_06 => 2
MSCONFIG\Services: FirebirdServerMAGIXInstance => 3
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: Virtual Router => 2
MSCONFIG\Services: WTabletServicePro => 2
MSCONFIG\startupfolder: C:^Users^Michel^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^An OneNote senden.lnk => C:\windows\pss\An OneNote senden.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Michel^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Virtual Router Manager.lnk => C:\windows\pss\Virtual Router Manager.lnk.Startup
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Michel\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: EADM => "D:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: EPLTarget =>
MSCONFIG\startupreg: ManyCam => "C:\Program Files (x86)\ManyCam\ManyCam.exe" --silent
MSCONFIG\startupreg: Spotify => "C:\Users\Michel\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Michel\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
MSCONFIG\startupreg: TrayServer => D:\Program Files (x86)\MAGIX\Video_deluxe_MX_Premium\TrayServer_de.exe
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-2730625136-293335315-2397054045-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{8A197FF7-626B-4F8F-86B4-C624491BEB2E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{13FBCA54-317F-43D0-8900-8CF1FAA5943E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{C330D307-41A6-46F8-B3E2-E1238E70473B}D:\program files\oracle\virtualbox\virtualbox.exe] => (Allow) D:\program files\oracle\virtualbox\virtualbox.exe
FirewallRules: [TCP Query User{46610208-F90A-4D97-8E09-06BEAEC773A7}D:\program files\oracle\virtualbox\virtualbox.exe] => (Allow) D:\program files\oracle\virtualbox\virtualbox.exe
FirewallRules: [{AB480711-2C68-487D-B569-1474C60CB45E}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Gray Matter\config.exe
FirewallRules: [{F074FEF4-779C-4417-AF12-6DC277769FC3}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Gray Matter\config.exe
FirewallRules: [{F57D75E8-19F0-4BEE-A1C4-93DE5DA8380E}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Gray Matter\Game.exe
FirewallRules: [{C5A84557-9C54-478A-8BE0-0F962FBDAE98}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Gray Matter\Game.exe
FirewallRules: [{B1BBCC11-B008-474C-A221-5B11223E3F19}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Secret Files Puritas Cordis\ConfigTool.exe
FirewallRules: [{ED77B66E-ACE0-49A6-9E76-9D4135E9A8DF}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Secret Files Puritas Cordis\ConfigTool.exe
FirewallRules: [{9C56B262-E140-456B-9761-3455A5DBE750}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Secret Files Puritas Cordis\fsasgame.exe
FirewallRules: [{668E9B73-FAFE-42A8-A94E-28945D4EF95F}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Secret Files Puritas Cordis\fsasgame.exe
FirewallRules: [{8591D5A7-7238-4B37-A5AE-CC8B8648FD7F}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{6CA68F42-0B39-4C2E-8006-8168B97D8A5B}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{D30DCE6E-A9DA-4F67-AC91-7CC6CA4811D5}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{2C377540-4EDF-4CAE-BB57-5DB55507A6F3}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{C06F4023-F06A-49AB-9C9B-76E8D5D2FFC6}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F3F394EF-5307-440C-81AF-84245BFEC8C3}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A25E4DC0-207D-4ECB-A35A-14CC43A58515}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{5E63A891-AD6E-4BBC-90FF-B71A76CD26F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{44164FE8-F9C2-4A4E-9C2A-C8EF8B6BCE77}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{2242D3FF-3B5F-476C-BCAB-E987C4779491}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{093A3D02-7B5D-4CDB-9C6D-693A9EE7A94E}] => (Allow) D:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D465ADF2-4D56-4621-82C4-D9F271B4E3B8}] => (Allow) D:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EAA54E05-0F5F-4210-9181-1101C84CA633}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{2D04A848-21F0-4627-A44E-BBE182C7223C}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{D92B6E72-BDCD-47D5-A055-1E9AC9C6E9E6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E86B831B-9B0D-4008-9595-F877A762C3C0}] => (Allow) C:\Users\Michel\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{1E3EF958-8573-4F39-AC35-4B5123396975}] => (Allow) C:\Users\Michel\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{DB7B4CF4-56D9-4FF0-885A-8579CCFB70CB}C:\users\michel\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\michel\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{72AB62D1-A481-4776-BFEA-6944AE2BB791}C:\users\michel\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\michel\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{119ED452-66DA-4AA3-8C53-AACD3E047A96}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\The Stanley Parable\stanley.exe
FirewallRules: [{E68942BB-AD86-4F4C-8E97-2B44EF4EC326}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\The Stanley Parable\stanley.exe
FirewallRules: [{558AFAE0-E9E3-4B51-8383-9F340CDAE789}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Pixel Boy\Pixel Boy.exe
FirewallRules: [{0F686A87-EA43-4026-951E-CA2D5171F0DB}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Pixel Boy\Pixel Boy.exe
FirewallRules: [{10EF2B46-2DB4-4F88-803E-5A007A34F357}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\DLC Quest\DLC.exe
FirewallRules: [{308F8797-5E2A-4A9E-91C7-E0DD3735765D}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\DLC Quest\DLC.exe
FirewallRules: [{895F17FF-0115-4812-872E-CE299EB3C390}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Safecracker 2\Safecracker.exe
FirewallRules: [{16998083-D772-440A-9389-41AB24FF1F27}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Safecracker 2\Safecracker.exe
FirewallRules: [{94D73B1D-1DE1-46B3-A5E2-94D69D06B8FE}] => (Allow) D:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{9C04CA09-991D-4A10-A03E-E0062724DA15}] => (Allow) D:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [TCP Query User{DA430694-85E3-4F3B-90FD-0BD2A75B4DE3}C:\users\michel\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\michel\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E13D1B2A-4AC3-4510-ABAA-315F10F30D1D}C:\users\michel\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\michel\appdata\roaming\spotify\spotify.exe
FirewallRules: [{2E5D4E97-274A-4341-9ED5-A071D9496583}] => (Allow) D:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{9BB9C7CB-A315-4784-8375-98FB949B99B5}] => (Allow) D:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1BCF837B-C483-4ECC-8086-BE63E8E2B4C6}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\RPGVXAce\RPGVXAce.exe
FirewallRules: [{45E48216-688A-4D24-86EA-E14B3B45ACEF}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\RPGVXAce\RPGVXAce.exe
FirewallRules: [{75C37FB8-E325-43C8-A0AD-EABCEE00FA0E}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Spore\SporeBin\SporeApp.exe
FirewallRules: [{F00FC46A-A84B-4B4B-9942-4F9FD6CDF087}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Spore\SporeBin\SporeApp.exe
FirewallRules: [{23885A86-64CA-469E-B4FA-0843F7A61DD6}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\cargo commander\CargoCommander.exe
FirewallRules: [{B5CCB9E2-FCF2-4CF7-96F4-B70E688623BC}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\cargo commander\CargoCommander.exe
FirewallRules: [{EC081FA6-8C39-490A-89B9-026E7A02E81D}] => (Allow) D:\Program Files (x86)\Origin Games\Bejeweled 3\Bejeweled3.exe
FirewallRules: [{3744C4D5-8CFC-45BB-8CCA-A82F2E9438E2}] => (Allow) D:\Program Files (x86)\Origin Games\Bejeweled 3\Bejeweled3.exe
FirewallRules: [TCP Query User{7C5E92E2-F676-45B9-9500-9AD1085FB358}D:\program files (x86)\mozilla firefox\firefox.exe] => (Block) D:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{74A4BDF3-D6F1-4A38-9C6F-CBD0715DCB95}D:\program files (x86)\mozilla firefox\firefox.exe] => (Block) D:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{967822E6-F153-4064-9730-0BCF185BF6CE}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Dev Guy\Binaries\Win64\Dev Guy.exe
FirewallRules: [{E2BC895D-6532-4587-9C90-5CC5D68D1281}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Dev Guy\Binaries\Win64\Dev Guy.exe
FirewallRules: [{04D8EEA3-119A-4F7D-A09B-F0B925B03980}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Deponia The Complete Journey\deponia.exe
FirewallRules: [{5FF98AA9-5EF1-45B3-820F-F8F74A5D52ED}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Deponia The Complete Journey\deponia.exe
FirewallRules: [{833A5849-0C8C-4997-AA2E-0727F13E2864}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Deponia The Complete Journey\VisionaireConfigurationTool.exe
FirewallRules: [{2375186D-B3EB-40FA-B2A8-9F8D51DBB22A}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Deponia The Complete Journey\VisionaireConfigurationTool.exe
FirewallRules: [{25581FA8-979F-4530-86A9-9C5117362F46}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{C673B36F-981D-41BF-B8F2-65A99CE4FE24}] => (Allow) LPort=2869
FirewallRules: [{4290C8C3-52B0-42B4-BE08-EAD701891D92}] => (Allow) LPort=1900
FirewallRules: [{61D2C113-6252-4E7E-AE6C-FF23ADB85714}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1C0FC5B6-11E9-4384-BC52-3716BA63A3AB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E9571195-914B-45A6-8CBC-51F87723D9ED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B240A8D9-1B55-42CD-BD84-08574BC28A7E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{40A52DD0-BA9A-4FBD-841A-73B656076AF8}] => (Allow) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F702946C-287F-49FB-9962-6E976CBFAF7E}] => (Allow) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{A38037A5-AA25-4166-AB4F-D0963C6B5B20}C:\users\michel\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\michel\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{86030269-4F46-44E7-A844-B71E8E8CF065}C:\users\michel\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\michel\appdata\roaming\spotify\spotify.exe
FirewallRules: [{258B3B7E-D201-4A4C-A3A3-1DC7BC52A890}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\anna.exe
FirewallRules: [{239F2CF6-9262-4B87-B242-EF2194A60DB0}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\anna.exe
FirewallRules: [{F12791DA-1903-440E-B7DE-A244F397124F}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\VisionaireConfigurationTool.exe
FirewallRules: [{4E8F9680-4755-4199-9843-4ED11672C23D}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\VisionaireConfigurationTool.exe
FirewallRules: [{6A8BB56E-F052-4932-89DC-5D2EE49A7DFC}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\bonus content\Prologue\ANNAS_QUEST_PROLOGUE.exe
FirewallRules: [{70A9E9E5-3224-45D5-B249-63714C46917D}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Anna's Quest\bonus content\Prologue\ANNAS_QUEST_PROLOGUE.exe
FirewallRules: [{4CC2BAE6-5404-443E-8DC8-366FAC0CE0FB}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{9CCB85A0-2E53-41E0-84EF-7BF95FFCCFFD}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{B602504F-E055-4238-AB03-5AD606E69437}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{744BAF2F-84E4-40EA-A3A7-6B5CD4E31D69}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{40A1E06B-7CF2-4BD7-92B6-C6B388FDB0BC}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{FAAEE6E6-4FD1-4D98-A60F-0A993AAC878E}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{E779442F-9302-4D8B-8AFC-0A484CA3FF98}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{3EFF82D4-E27B-487C-9BEC-911493C26318}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{6EB55C93-A1E4-4198-8C32-44B34F6FFDDF}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{F2B8C7D1-5B99-4B60-956C-26FE7D705633}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{6EF8F1A1-FCC6-4A1A-8E29-8414102B0218}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{BEE93F3B-2433-4304-9008-95DCE2353875}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{BBF65E7C-83F7-4A22-8816-ECDA0F895C3F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{775D4121-46E0-46C4-BF00-BA7790C7F32D}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{19476F49-9EE3-4962-AD61-307891603DB6}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{D7583AB9-400B-4231-AE18-D2824D48EF05}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{453981CC-C022-4648-BEE8-172376E61F0D}] => (Allow) C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{FF326258-D755-4181-BAF2-870E7F08304D}] => (Allow) C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [TCP Query User{10ACB616-6D6A-4DEF-8E0D-0FC5EBDD476C}D:\adf2016.106\bin\intelmpi\bin\smpd.exe] => (Allow) D:\adf2016.106\bin\intelmpi\bin\smpd.exe
FirewallRules: [UDP Query User{CBB18F10-8069-4E5F-94A4-17844798BC35}D:\adf2016.106\bin\intelmpi\bin\smpd.exe] => (Allow) D:\adf2016.106\bin\intelmpi\bin\smpd.exe
FirewallRules: [TCP Query User{5BE1B302-504A-4695-9219-EEE9ED9BFFBF}D:\adf2016.106\bin\scmd.3.exe] => (Allow) D:\adf2016.106\bin\scmd.3.exe
FirewallRules: [UDP Query User{9BB72129-16DB-4FD5-8086-F870156DE6D4}D:\adf2016.106\bin\scmd.3.exe] => (Allow) D:\adf2016.106\bin\scmd.3.exe
FirewallRules: [{548D0424-61AE-4CF6-AE90-4417B90B0EC5}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\HER STORY\HerStory.exe
FirewallRules: [{4A1AC780-1857-4C78-A900-3991FAE36BFB}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\HER STORY\HerStory.exe
FirewallRules: [{0EB610FF-F10B-4ABC-BCF2-0F3557120587}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Skyrim\skse_steam_boot.exe
FirewallRules: [{82226474-BFEE-4599-8895-7BD7720DB0F7}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Skyrim\skse_steam_boot.exe
FirewallRules: [TCP Query User{676D0AC6-633B-4309-ADF8-E5190D469C4D}D:\adf2016.106\bin\intelmpi\bin\mpiexec.smpd.exe] => (Allow) D:\adf2016.106\bin\intelmpi\bin\mpiexec.smpd.exe
FirewallRules: [UDP Query User{0641FA2C-7365-4C00-8EA0-C477094E9D24}D:\adf2016.106\bin\intelmpi\bin\mpiexec.smpd.exe] => (Allow) D:\adf2016.106\bin\intelmpi\bin\mpiexec.smpd.exe
FirewallRules: [{29B6A597-C987-45E8-8880-7942A815D6B4}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{37273BC8-7670-40C2-9EF6-C95B1C426C66}] => (Allow) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{DD8D3735-A882-408B-8407-D9F49B4F0CC5}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Bottle\Bottle.exe
FirewallRules: [{6814FFAD-DD6F-4277-96FC-8D1BB68E138E}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Bottle\Bottle.exe
FirewallRules: [TCP Query User{9D243C85-CBB0-48D4-85A3-9F63BC83390A}D:\program files (x86)\steam\steamapps\common\bottle\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\bottle\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [UDP Query User{3A704431-84C6-4971-B84D-0696FD074D29}D:\program files (x86)\steam\steamapps\common\bottle\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\bottle\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [TCP Query User{841EB67A-3EEE-4C07-84A2-A8DA34505733}D:\program files (x86)\steam\steamapps\common\life is strange\binaries\win32\lifeisstrange.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\life is strange\binaries\win32\lifeisstrange.exe
FirewallRules: [UDP Query User{3607796C-069D-404B-B46A-84A6D9F6CBF6}D:\program files (x86)\steam\steamapps\common\life is strange\binaries\win32\lifeisstrange.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\life is strange\binaries\win32\lifeisstrange.exe
FirewallRules: [{4ACFA48C-AE9F-47EC-852A-ED1C2DC639BA}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\JurassicPark\JurassicPark100.exe
FirewallRules: [{B6B555BD-DB96-42FD-9C3D-86D2F1EB8A9C}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\JurassicPark\JurassicPark100.exe
FirewallRules: [{9A04A606-00A8-426B-ADA5-C6312658ED96}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Lost Horizon\AutoStarter.exe
FirewallRules: [{02861B11-5320-40FE-B7E9-3989FF1C71BE}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Lost Horizon\AutoStarter.exe
FirewallRules: [{BD308268-8893-4FAA-844E-EAF621715D3B}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Lost Horizon 2\LostHorizon2.exe
FirewallRules: [{E13093EA-F0B6-4DA2-86FA-5BDE694855A6}] => (Allow) D:\Program Files (x86)\Steam\SteamApps\common\Lost Horizon 2\LostHorizon2.exe
FirewallRules: [{5CBCF1F6-E7D0-487B-B545-7868F8A8D370}] => (Allow) D:\Program Files (x86)\GameforgeLive\gfl_client.exe
FirewallRules: [{A51EBC03-C4B4-44B0-A1DC-E8C7698F2C65}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{408529B1-6B68-4E99-B93E-802F40691D73}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{764750D9-38DE-41C9-885E-CEA43EA58331}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{E56E93E9-FFBD-4A3F-9F68-8BCA56AB1120}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{EC8872B6-93AC-4E52-9766-27EBC2FA30B7}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe
FirewallRules: [{FF3160C7-D21D-4F40-80BA-908DFE0AA026}] => (Allow) D:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe
StandardProfile\AuthorizedApplications: [D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
08-03-2017 18:08:21 Removed BikaQ Rss
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (03/08/2017 09:14:24 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (03/08/2017 09:14:24 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (03/08/2017 09:14:24 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (03/08/2017 08:24:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Michel-PC)
Description: Bei der Aktivierung der App €žMicrosoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe:App.AppX7mv0s3r0wanj0n66dy6vax24ps6avzvz.mca€œ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll €žMicrosoft-Windows-TWinUI/Betriebsbereit€œ.
Error: (03/08/2017 08:12:44 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (03/08/2017 08:12:44 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (03/08/2017 08:12:44 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (03/08/2017 07:46:29 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (03/08/2017 07:46:29 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (03/08/2017 07:46:28 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Systemfehler:
=============
Error: (03/08/2017 09:17:04 PM) (Source: DCOM) (EventID: 10010) (User: Michel-PC)
Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (03/08/2017 09:14:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HvHost" wurde mit folgendem Fehler beendet:
Ein an das System angeschlossenes Gerät funktioniert nicht.
Error: (03/08/2017 09:14:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SpeedupService" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.
Error: (03/08/2017 09:14:23 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert, nicht als
Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser
Konfiguration nicht gestartet zu sein.
Error: (03/08/2017 09:13:57 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORIT„T)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
Error: (03/08/2017 09:13:57 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORIT„T)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
Error: (03/08/2017 09:13:57 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORIT„T)
Description: Fehler "1084" in DCOM, als der Dienst "dps" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
Error: (03/08/2017 09:13:56 PM) (Source: DCOM) (EventID: 10005) (User: Michel-PC)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (03/08/2017 09:13:56 PM) (Source: DCOM) (EventID: 10005) (User: Michel-PC)
Description: Fehler "1068" in DCOM, als der Dienst "netprofm" mit den Argumenten "Nicht verfügbar" gestartet wurde, um den folgenden Server zu verwenden:
{A47979D2-C419-11D9-A5B4-001185AD2B89}
Error: (03/08/2017 09:13:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der Abhängigkeitsdienst oder die Abhängigkeitsgruppe konnte nicht gestartet werden.
CodeIntegrity:
===================================
Date: 2017-03-08 18:46:06.375
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvcvwu.inf_amd64_ce404631a9227a5b\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-03-07 17:00:56.898
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvcvwu.inf_amd64_ce404631a9227a5b\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-03-07 15:41:26.253
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2017-03-05 17:38:22.110
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvcvwu.inf_amd64_ce404631a9227a5b\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-23 21:46:15.789
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\nvcvwu.inf_amd64_ce404631a9227a5b\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-05 22:36:23.200
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-05 22:36:23.198
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-05 22:36:23.193
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-05 22:36:23.165
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-02-05 22:36:23.159
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 27%
Installierter physikalischer RAM: 8112.08 MB
Verfgbarer physikalischer RAM: 5879.36 MB
Summe virtueller Speicher: 16304.08 MB
Verfgbarer virtueller Speicher: 14061.54 MB
==================== Laufwerke ================================
Drive c: (Windows) (Fixed) (Total:111.06 GB) (Free:57.99 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:740.83 GB) NTFS
Drive e: (Assassin's C.) (CDROM) (Total:6.36 GB) (Free:0 GB) UDF
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: AE535441)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: AE535455)
Partition: GPT.
==================== Ende von Addition.txt ============================
MBAM-Log von gestern: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 07.03.2017
Scan Time: 12:43
Logfile: mbam-log-2017-03-07.txt
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2017.03.07.04
Rootkit Database: v2017.02.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 10
CPU: x64
File System: NTFS
User: Michel
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 450032
Time Elapsed: 6 min, 23 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 13
PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, Quarantined, [4ce47d4af3b588ae2d076b4f59a9b848],
PUP.Optional.Wajam, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, Quarantined, [5ed21fa8189039fd3ef6a21825dd05fb],
PUP.Optional.Wajam, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9, Quarantined, [6cc408bf2d7b0a2ce15332883cc69b65],
Adware.Elex, HKLM\SOFTWARE\jhtrsq, Quarantined, [f23e0eb93c6cf0463c56e3da5da39f61],
Adware.Elex, HKLM\SOFTWARE\WOW6432NODE\jhtrsq, Quarantined, [43edd8ef0d9b65d18d053c8129d75ba5],
PUP.Optional.Trotux, HKLM\SOFTWARE\WOW6432NODE\trotuxSoftware, Quarantined, [0927ebdc07a1e74fb44f6ceba85ace32],
Adware.Elex, HKLM\SOFTWARE\WOW6432NODE\{84416237-6490-494D-9AD6-4994DD978971}, Quarantined, [5bd5784fccdccd69f1c8b718b54ce31d],
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH, Quarantined, [c7692a9d01a742f424e46caeab55d12f],
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\04262113-2A31-48E1-B4BB-3B42174BEA0F, Delete-on-Reboot, [86aa6b5cc2e651e57900580627d93dc3],
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\E24B7131-D039-43CB-9E6F-AD4BE601EC1F, Delete-on-Reboot, [ed439334288049ed1069f56925db2bd5],
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\G12RNBFM, Quarantined, [56da6e5905a33df99ad24343c43ce020],
Adware.Linkury, HKU\.DEFAULT\SOFTWARE\jhtrsq, Quarantined, [74bc6d5ae5c3d165f1f5427a57a939c7],
Adware.Elex, HKU\S-1-5-18\SOFTWARE\jhtrsq, Quarantined, [6bc5784f8028f93d34fa15a732ceaf51],
Registry Values: 4
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH|affid, 1123, Quarantined, [c7692a9d01a742f424e46caeab55d12f]
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\04262113-2a31-48e1-b4bb-3b42174bea0f|Description, One System Care battery save scheme., Delete-on-Reboot, [86aa6b5cc2e651e57900580627d93dc3]
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\e24b7131-d039-43cb-9e6f-ad4be601ec1f|Description, One System Care game scheme., Delete-on-Reboot, [ed439334288049ed1069f56925db2bd5]
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\g12rnbfm|Name, C:\Program Files (x86)\Ghesoing Host\local64spl.dll, Quarantined, [56da6e5905a33df99ad24343c43ce020]
Registry Data: 0
(No malicious items detected)
Folders: 11
Adware.Elex.Generic, C:\Program Files (x86)\Ghesoing Host, Delete-on-Reboot, [2a063b8ceabef83e4e13ccdf41bf768a],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\3533bda4c65ccfbbc76d3b22854fd16c, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\7dbdeeca144283dbd7c74be86bbf5db6, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\41e27cf5-5363-1, Quarantined, [4de3f3d468400234360218cd9a68748c],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\41e27cf5-7ca1-0, Quarantined, [18184e79891f0630e94f70754db52ad6],
Files: 26
Adware.Elex, C:\Program Files (x86)\Ghesoing Host\local64spl.dll, Delete-on-Reboot, [57d94384268269cd567306796c959769],
Adware.OptimizerEliteMax, C:\Users\Michel\AppData\Local\Temp\02FBB823-717C-44FB-BD38-33D18EBF4C4D\onesystemcare.exe, Quarantined, [57d97b4c3375c3737fe0b859857b59a7],
PUP.Optional.DownloadSponsor, C:\Users\Michel\AppData\Local\Temp\DMR\dmr_72.exe, Quarantined, [3bf5b4139f09b383db840f4cd52c9f61],
PUP.Optional.AppTrailers, C:\Users\Michel\AppData\Local\Temp\21A8FC8F-09B1-41BC-9781-E447C37BDDC8\AppTrailers.9.1.10amt.exe, Quarantined, [1c144087b2f64aec321efa7d7c84fe02],
Adware.Elex.Generic, C:\Program Files (x86)\Ghesoing Host\local64spl.dll.ini, Quarantined, [2a063b8ceabef83e4e13ccdf41bf768a],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\gswcszzzjuzvgebx.dat, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\dmr_72.exe, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\3533bda4c65ccfbbc76d3b22854fd16c\1-klick-chip-setup.exe, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Adware.ChinAd, C:\Users\Michel\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\7dbdeeca144283dbd7c74be86bbf5db6\nLite-1.4.9.3.setup.exe, Quarantined, [49e79037e6c2f83e8d627e6048b956aa],
Trojan.Agent, C:\Windows\ca2c432ce8d505fa9cfc080989f4283e.exe, Quarantined, [48e8893e06a2fc3a6c007eb325deb848],
PUP.Optional.Amonetize.Gen, C:\ProgramData\41e27cf5-5363-1\BIT2978.tmp, Quarantined, [ea46606708a0fc3a6cf34e831de67c84],
PUP.Optional.Amonetize.Gen, C:\ProgramData\41e27cf5-7ca1-0\BIT2989.tmp, Quarantined, [66ca3691b8f0251169f6aa27689b659b],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default\prefs.js, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default\profiles.ini, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default\search-metadata.json, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default\search.json, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.FakeFFProfile, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\1dktvl07.default\search.json.mozlz4, Quarantined, [032df3d4b7f18fa7aacbd3e938c8fd03],
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Mozilla\Firefox\Profiles\1dktvl07.default\searchplugins\g12rnbfm.xml, Quarantined, [90a0a22506a28caa57e20f307193718f],
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "hxxp://www.trotux.com/?z=c8cdb5b9597f7b0ca0e2486g8z9bab4bcb8w4e3gcm&from=isr&uid=SamsungXSSDX840XEVOX120GB_S1D5NSBF230651A&type=hp");), Replaced,[230d5077fbad2d096a62cb6e8878eb15]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (.bookmarks.restore_default_bookmarks", false);
user_pre), Replaced,[b7794c7be4c4dc5aece002378f71d32d]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (ation exits.
*
* To make a manual change to preferences, you can visit the URL about:config
*/
user_pref("accessibility.lastLoadDate", 1488743097);
user_pref("accessibi), Replaced,[5ad6b0172d7b2a0cd8f44fea27d9e51b]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: ( is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
*/
user_pref("accessibility.lastLoad), Replaced,[3cf4f6d1d1d70a2c28a4a29722de1be5]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (ferences, you can visit the URL about:config
*/
user_pref("accessibility.lastLoadDate", 1488743097);
user_pref("accessibility.typeaheadfind", true);
user_pref("accessibility.typeaheadfind.flashBa), Replaced,[7db3c70022862214d3f994a50ef27987]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (anges will be overwritten when the application exits.), Replaced,[65cbcafddeca0d293c902b0ed82815eb]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\prefs.js, Good: (), Bad: (areporting-healthreport-lastDailyCollection", 1461702122);
user_pref("app.update.lastUpdateTime.experiments-update-timer", 1488834931);
user_pref("app.update.lastUpdateTi), Replaced,[3ef28245efb9df5779530f2a41bf669a]
PUP.Optional.Trotux, C:\Users\Michel\AppData\Roaming\Profiles\Phefelerojotion.default\searchplugins\g12rnbfm.xml, Quarantined, [0927bb0c30786fc75026cb3f1ee27b85],
Physical Sectors: 0
(No malicious items detected)
(end)
Ich hoffe, der Laptop ist nicht verloren. Vielen Dank im Voraus! |
So funktioniert es:
und 
und speichere die Logdatei auf Deinem Desktop.
