Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Infektion durch Excel Tabelle mit SupTab etc... (https://www.trojaner-board.de/155660-infektion-excel-tabelle-suptab-etc.html)

Melanie_80 24.06.2014 10:24
Infektion durch Excel Tabelle mit SupTab etc...
 
Hallo miteinander,

ich habe leider eine verseuchte Excel Tabelle runtergeladen und leider ausgeführt...

Jetz hab ich den Salat.

hier meine Feststellung unter Verwendung von MBAM:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 24.06.2014
Scan Time: 10:56:06
Logfile: MBAM Logfile 1.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.24.03
Rootkit Database: v2014.06.23.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Buchhaltung

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 274077
Time Elapsed: 6 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1960, , [9ba83448413ada5cb02a6cee99687090]

Modules: 1
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, , [cc77d8a478035fd7e707d4b5ac55857b],

Registry Keys: 11
PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, , [9ba83448413ada5cb02a6cee99687090],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [e162bfbd1f5c62d4edd5955814efb14f],
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, , [7ec59ae2dba0fc3a3a7d86709a699f61],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [083ba6d6f28968ce2f936b82659edb25],
PUP.Optional.Qone8, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [af94a8d4304bbe789d24f5f8aa59ec14],

Registry Values: 0
(No malicious items detected)

Registry Data: 14
PUP.Optional.Skytech.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SupTab\SEARCH~2.DLL, Good: (), Bad: (C:\PROGRA~2\SupTab\SEARCH~2.DLL),,[2f14cfad5f1c85b1cf1f3a4f4bb6ef11]
PUP.Optional.Skytech.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SupTab\SEARCH~1.DLL, Good: (), Bad: (C:\PROGRA~2\SupTab\SEARCH~1.DLL),,[d76c3f3dfb80d85e5c92ed9c907152ae]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[ce7598e43249ef47ac24caba1de706fa]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[f44fc5b797e440f6418e31531de722de]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[62e13e3e9cdf94a225ac61234eb68c74]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[261de4989edd4ceac6e73742a55f837d]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[13303547a9d2b383e980b8cc4eb6f60a]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[da694e2ec7b4df57e8e8d9aba163d22e]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[70d3e7955229290de8e786fe49bb768a]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[291ab3c967142e08a031b2d213f1e21e]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}),,[8fb49fdd9ae12f07dcd1fb7e1ee6ec14]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[88bbb5c73348dd59db8ed7ad73916a96]
PUP.Optional.SweetPage.A, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[46fd7efeeb90e3537854552f07fd01ff]
PUP.Optional.SweetPage.A, HKU\S-1-5-21-1907336366-2592699145-1523498337-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826, Good: (hxxp://www.google.com), Bad: (hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826),,[f152a4d82556a5910fbc1c688e7627d9]

Folders: 100
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\de, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\en, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es_419, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-BE, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CA, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CH, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-LU, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it-CH, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ja, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pl, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_BR, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_PT, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ru, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\tr, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\vi, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_CN, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_TW, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_metadata, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, , [9ea50a72e5964de9e124386eee14f10f],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, , [9ea50a72e5964de9e124386eee14f10f],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger, , [93b0acd01566a6903f6d91159a68d32d],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log, , [93b0acd01566a6903f6d91159a68d32d],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update, , [93b0acd01566a6903f6d91159a68d32d],

Files: 195
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, , [9ba83448413ada5cb02a6cee99687090],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, , [cc77d8a478035fd7e707d4b5ac55857b],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, , [2f14cfad5f1c85b1cf1f3a4f4bb6ef11],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, , [d76c3f3dfb80d85e5c92ed9c907152ae],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, , [88bb6814f3883afc0f08a2a6c0422cd4],
PUP.Optional.GameAd.A, C:\Users\Buchhaltung\AppData\Local\Temp\loygame-pro.exe, , [e45fa8d4b2c987af57c278017e8654ac],
PUP.Optional.GameAd.A, C:\Users\Buchhaltung\AppData\Local\Temp\updatepackasc.exe, , [1b280d6f5d1e0d297e9b8dec5aaa2ad6],
PUP.Optional.SkyTech.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\alilog.dll, , [44ff89f385f66dc96fbb90a2c43c39c7],
PUP.Optional.V9.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\qSE.exe, , [e162a7d5aad113238d22ed5b70904fb1],
PUP.Optional.Skytech.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\UninstallManager.exe, , [b192314b304b5bdb5a94f89132cf44bc],
PUP.Optional.IePluginService.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\tmp\SupTab_Setup302.exe, , [6ad93a42a0db57df3f9bfb5fc33e7d83],
PUP.Optional.WPM.A, C:\Users\Buchhaltung\AppData\Local\Temp\7977173\7977173.zipDir\tmp\wpm_v20.0.0.401.exe, , [a89ba0dc710a3cfabedaf69730d1ab55],
PUP.Optional.InstallCore, C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe, , [a1a24735e3987fb7813e07716a9ac23e],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterfacef32.dll, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\RSHP.exe, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv32.dll, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SpAPPSv64.dll, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WebDataJs, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\arrow.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_add_logo_hover.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\default_logo.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\googlelogo2.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\weather\0.png, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ie8.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, , [f3502e4e1863cf67baf88444639f3dc3],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage, , [d073c6b691eaab8bac9df50c0bf98c74],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage-journal, , [ee55abd17605132399b0ab56e71d946c],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\background.html, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\index.html, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\jump.html, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\manifest.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\bookmarks.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\bookmarks\img\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\classification.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\del.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\main.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\classification\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloud.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloudApp.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\cloudWebsite.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\createWebsite.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\buttonBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\categoryBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\searchLeft.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\cloud\img\skin\tabsBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\dialog\img\skin\headerBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\extensions.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\extensions\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\guide.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\guide\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\lastVisited.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\lastVisited\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\notice.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\notice\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\search.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\search\img\search.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\setup.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin\dialBoxStyle.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\setup\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oBookmarks.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oDownloads.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oExtensions.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oHistory.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\shortcuts\img\oNewtab.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\cloudWallpaper.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\skins.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\categoryBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\delete.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\download.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\icons.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\skins\img\skin\loading.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\weather.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\css\style.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\logo.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\line.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\locationIcon.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\searchButton.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\app\weather\img\skin\weather.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\css\all.css, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\game.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_128.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_16.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\icon_48.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\shopping.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\weather.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\webstore.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\default.jpg, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\iconsprite.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\idialog_s.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\ios5_button.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\left.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\loading.gif, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\loading2.gif, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\qBoxBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_bg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_bg0.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_left.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_left0.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_right.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\q_right0.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\right.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\selected.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\img\skin\titleBg.png, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\all.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\background.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\ga.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\jq.mobi.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\jump.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\pop.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\redirect.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\js\xagainit.js, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\de\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\en\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\es_419\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-BE\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CA\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-CH\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\fr-LU\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\it-CH\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ja\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pl\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_BR\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\pt_PT\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\ru\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\tr\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\vi\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_CN\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_locales\zh_TW\messages.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.QuickStart.A, C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.4.7_0\_metadata\verified_contents.json, , [c57ef785ceadc472e78c2670fc06e21e],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, , [9ea50a72e5964de9e124386eee14f10f],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log\wprotectmanager_2014-06-18[11-08-42-097].log, , [93b0acd01566a6903f6d91159a68d32d],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update\conf, , [93b0acd01566a6903f6d91159a68d32d],

Physical Sectors: 0
(No malicious items detected)


(end)
Soll ich gleich die Tools wie in "Für alle hilfesuchenden...." runterladen und ausführen,
oder lieber warten und auf Anweisungen warten?

Würde mich sehr über eure Hilfe freuen!!! :daumenhoc

Liebe Grüße, Melanie :balla:

Bootsektor 24.06.2014 10:31
:hallo:

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Melanie_80 24.06.2014 12:21
Hallo Sandra!

Erstmal danke für die schnelle Antwort und deine Hilfe!!!

Hier das FRST Logfile:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2014
Ran by Buchhaltung at 2014-06-24 11:37:19
Running from C:\Users\Buchhaltung\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.00 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (x64) (HKLM\...\{5C804EBB-475F-4555-A225-1D6573F158BD}) (Version: 11.2.202.222 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2321 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.2.2321 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.2.3212 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4010 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 4.2.1.4010 - CyberLink Corp.) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Driver Installation Program (x32 Version: 10.0 - Atheros Communications, Inc.) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.3.1.1714 - Hewlett-Packard Company)
HP Client Security Manager (Version: 8.3.1.1714 - Hewlett-Packard Company) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Device Access Manager (HKLM\...\{AD7F97D3-AB72-4A10-B56A-95EC21F854DE}) (Version: 8.2.0.11 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{26EFA34E-7181-44CA-B1A6-8C1F708ED51D}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.3.65 - Hewlett-Packard Company)
HP Drive Encryption (Version: 8.6.3.65 - Hewlett-Packard Company) Hidden
HP File Sanitizer (HKLM-x32\...\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.13.1 - Hewlett-Packard Company)
HP My Display (HKLM-x32\...\{4DCC6015-444F-42A6-9D84-0B8D4B9EFC09}) (Version: 2.06.56.0 - Portrait Displays, Inc.)
HP PageLift (HKLM-x32\...\{ED6CAA18-FCFF-458B-8418-5217F6ABC646}) (Version: 1.0.10.1 - Hewlett-Packard Company)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{49524B48-4FE9-4A62-A9FD-1F2258DF5489}) (Version: 3.4.12.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{11BBD255-39EE-46CE-8BC0-8B820EE943A2}) (Version: 8.6.1.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Theft Recovery (HKLM-x32\...\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.3.0.2 - Hewlett-Packard Company)
HP Theft Recovery (x32 Version: 8.3.0.2 - Hewlett-Packard Company) Hidden
HP Trust Circles (HKLM-x32\...\HP Trust Circles) (Version: 8.3.6.16976 - Hewlett-Packard Company)
HP Trust Circles (Version: 8.3.6.16976 - CryptoMill Technologies Ltd.) Hidden
HP Wireless Keyboard and Mouse Applet (HKLM-x32\...\{C2A98780-3B82-4056-A1FB-7377B3C80AF7}) (Version: 1.0.0.1 - Hewlett-Packard)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Network Connections 18.1.59.0 (HKLM\...\PROSetDX) (Version: 18.1.59.0 - Intel)
Intel(R) Network Connections 18.1.59.0 (Version: 18.1.59.0 - Intel) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.2.9.10 - IObit)
Lexware buchhalter pro 2014 (HKLM-x32\...\{83ea8c4d-19e4-47eb-850c-a7456a411236}) (Version: 14.3.1.195 - Haufe-Lexware GmbH & Co.KG)
Lexware buchhalter pro 2014 (x32 Version: 14.04.01.0221 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware buchhalter pro 2014 Client (HKLM-x32\...\{924e5ec4-7fa5-447b-8d7f-7face98384da}) (Version: 14.3.1.195 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (x32 Version: 13.14.00.0008 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Info Service (x32 Version: 4.01.00.0077 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (x32 Version: 3.01.00.0011 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (HKLM-x32\...\{7F603892-89C9-4EC4-9236-7AD4A798EA41}) (Version: 21.00.00.0039 - Haufe-Lexware GmbH & Co.KG)
Lexware professional Datenbank 2014 (x32 Version: 14.25.00.0055 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Server Pro 2014 (x32 Version: 14.1.0.57 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Services (x32 Version: 2.00.00.0024 - Haufe-Lexware GmbH & Co.KG) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50325 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50330 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.50325 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50325 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.1.36 - PDF Complete, Inc)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.218 - Qualcomm Atheros Communications)
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.00.05 (10.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SDK (x32 Version: 2.39.004 - Portrait Displays, Inc.) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmarThru Office (HKLM-x32\...\{9BC1E722-AE07-46A3-B7A6-556DBE18E22A}) (Version: 2.10.000 - Samsung Electronics Co., Ltd.)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden

==================== Restore Points  =========================

30-05-2014 07:01:21 Windows Update
02-06-2014 07:10:01 Windows Update
05-06-2014 07:25:14 Windows Update
10-06-2014 07:15:34 Windows Update
12-06-2014 15:57:27 Windows Update
16-06-2014 07:03:00 Windows Update
19-06-2014 07:27:55 Windows Update
23-06-2014 07:09:25 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1108ADE8-08C3-4B6A-A64A-0911943F2034} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-10] (Google Inc.)
Task: {2E3A7F05-F7C4-438D-8A45-FA0BAE202D53} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {371F4CC2-2362-4AF8-952B-793163CEFC3B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {4C8550EB-AEE2-4D1B-944C-415C58F62335} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-06] (Hewlett-Packard Company)
Task: {662D8659-C1DA-4E6D-AF12-15EFBED759D4} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-05-14] (IObit)
Task: {68C85550-B30B-473F-A762-9964E7C40E69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-10] (Adobe Systems Incorporated)
Task: {8687CEB8-59B5-423C-9318-9173A00640BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-10] (Google Inc.)
Task: {AC09A5B4-40A0-4F46-ABBD-BDB955E06144} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-03-13 13:36 - 2011-04-11 07:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll
2014-04-24 14:28 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-08-14 23:06 - 2013-08-14 23:06 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2012-12-28 22:04 - 2012-12-28 22:04 - 00084480 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2014-01-10 09:40 - 2012-08-14 20:10 - 00802816 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe
2012-12-28 22:10 - 2012-12-28 22:10 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-12-28 22:04 - 2012-12-28 22:04 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2014-03-13 13:35 - 2013-10-04 06:53 - 00734720 _____ () C:\Windows\system32\SnMinDrv.dll
2014-03-13 13:35 - 2013-06-28 16:36 - 00091136 _____ () C:\Windows\system32\SSDEVM64.DLL
2014-03-13 13:36 - 2013-02-14 06:00 - 00295984 _____ () C:\windows\system32\spool\drivers\x64\3\spe__pi.exe
2013-09-17 21:32 - 2013-09-17 21:32 - 02654936 _____ () C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\ShredContextMenu.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-06-24 08:59 - 2014-06-24 08:59 - 00043008 _____ () c:\Users\Buchhaltung\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf3yasz.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-10 09:49 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 21:34 - 2012-06-08 21:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2013-09-26 13:20 - 2013-09-26 13:20 - 00176168 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Logging.Targets.Etw.dll
2013-09-26 13:20 - 2013-09-26 13:20 - 00043048 _____ () C:\Program Files (x86)\Lexware\Update Manager\Haufe.Core.Diagnostics.Etw.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2012-01-18 02:21 - 2012-01-18 02:21 - 00068104 _____ () C:\Program Files (x86)\Hewlett-Packard\HP My Display\PEGAACPIDLL.dll
2014-01-10 09:38 - 2013-04-12 03:31 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-13 14:30 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/24/2014 10:20:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c4102
ID des fehlerhaften Prozesses: 0x1134
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (06/23/2014 11:56:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EXCEL.EXE, Version 15.0.4623.1000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1af0

Startzeit: 01cf8ec945b125ab

Endzeit: 0

Anwendungspfad: C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE

Berichts-ID: 8af276e6-fabc-11e3-b81a-485ab6895ac2

Error: (06/03/2014 05:35:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm EXCEL.EXE, Version 15.0.4615.1000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1f18

Startzeit: 01cf7f41538c8084

Endzeit: 0

Anwendungspfad: C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE

Berichts-ID: a06a5838-eb34-11e3-b02d-485ab6895ac2

Error: (05/26/2014 05:51:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ContextMenuShim64.dll, Version: 11.0.0.379, Zeitstempel: 0x505fc498
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001ce0e
ID des fehlerhaften Prozesses: 0xc9c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (05/16/2014 11:54:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Framework.exe, Version: 14.4.0.7, Zeitstempel: 0x5316f9e0
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0150010
Fehleroffset: 0x0008482b
ID des fehlerhaften Prozesses: 0x17ec
Startzeit der fehlerhaften Anwendung: 0xFramework.exe0
Pfad der fehlerhaften Anwendung: Framework.exe1
Pfad des fehlerhaften Moduls: Framework.exe2
Berichtskennung: Framework.exe3

Error: (05/16/2014 11:54:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Framework.exe, Version: 14.4.0.7, Zeitstempel: 0x5316f9e0
Name des fehlerhaften Moduls: mfc100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2e0e4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00147cfd
ID des fehlerhaften Prozesses: 0x17ec
Startzeit der fehlerhaften Anwendung: 0xFramework.exe0
Pfad der fehlerhaften Anwendung: Framework.exe1
Pfad des fehlerhaften Moduls: Framework.exe2
Berichtskennung: Framework.exe3

Error: (05/16/2014 11:54:26 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Framework.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66F97CFD
Stack:

Error: (05/16/2014 08:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: outlookdav.exe, Version: 4.0.0.0, Zeitstempel: 0x5350d43d
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x14bc
Startzeit der fehlerhaften Anwendung: 0xoutlookdav.exe0
Pfad der fehlerhaften Anwendung: outlookdav.exe1
Pfad des fehlerhaften Moduls: outlookdav.exe2
Berichtskennung: outlookdav.exe3

Error: (05/16/2014 08:57:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: outlookdav.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException
Stack:
  at System.Diagnostics.FileVersionInfo.GetVersionInfo(System.String)
  at System.Windows.Forms.RichTextBox.get_CreateParams()
  at System.Windows.Forms.Control..ctor(Boolean)
  at System.Windows.Forms.TextBoxBase..ctor()
  at System.Windows.Forms.RichTextBox..ctor()
  at surdav.frmMain.InitializeComponent()
  at surdav.frmMain..ctor()
  at surdav.main.Main()

Error: (05/15/2014 09:14:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: outlookdav.exe, Version: 4.0.0.0, Zeitstempel: 0x5350d43d
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x1584
Startzeit der fehlerhaften Anwendung: 0xoutlookdav.exe0
Pfad der fehlerhaften Anwendung: outlookdav.exe1
Pfad des fehlerhaften Moduls: outlookdav.exe2
Berichtskennung: outlookdav.exe3


System errors:
=============
Error: (06/20/2014 02:01:07 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (06/16/2014 02:23:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet:
%%1115

Error: (06/12/2014 05:57:48 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (06/12/2014 05:28:15 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (06/04/2014 08:55:37 AM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (06/03/2014 09:52:43 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (06/02/2014 02:36:32 PM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (06/02/2014 02:13:59 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (05/26/2014 01:52:08 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (05/23/2014 05:55:47 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "BLACKBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{3C5D36F3-D4D6-49B1-A97A-BFDF03EB2958}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (06/24/2014 10:20:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c000037400000000000c4102113401cf8f79b7fbabffC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll57d0533c-fb78-11e3-a824-485ab6895ac2

Error: (06/23/2014 11:56:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: EXCEL.EXE15.0.4623.10001af001cf8ec945b125ab0C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE8af276e6-fabc-11e3-b81a-485ab6895ac2

Error: (06/03/2014 05:35:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: EXCEL.EXE15.0.4615.10001f1801cf7f41538c80840C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXEa06a5838-eb34-11e3-b02d-485ab6895ac2

Error: (05/26/2014 05:51:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ContextMenuShim64.dll11.0.0.379505fc498c0000005000000000001ce0ec9c01cf78af7267c34cC:\Windows\Explorer.EXEC:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat Elements\ContextMenuShim64.dll94e3b4b7-e4ed-11e3-a860-485ab6895ac2

Error: (05/16/2014 11:54:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Framework.exe14.4.0.75316f9e0ntdll.dll6.1.7601.18247521ea8e7c01500100008482b17ec01cf70dc63dfeb3aC:\Program Files (x86)\Lexware\professional\2014\Framework.exeC:\Windows\SysWOW64\ntdll.dll18cc9a25-dce0-11e3-843f-485ab6895ac2

Error: (05/16/2014 11:54:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Framework.exe14.4.0.75316f9e0mfc100.dll10.0.40219.3254df2e0e4c000000500147cfd17ec01cf70dc63dfeb3aC:\Program Files (x86)\Lexware\professional\2014\Framework.exeC:\Windows\system32\mfc100.dll10726b16-dce0-11e3-843f-485ab6895ac2

Error: (05/16/2014 11:54:26 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Framework.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 66F97CFD
Stack:

Error: (05/16/2014 08:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: outlookdav.exe4.0.0.05350d43dKERNELBASE.dll6.1.7601.1840953159a86e04343520000c42d14bc01cf70d3fcf03213C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exeC:\Windows\syswow64\KERNELBASE.dll4c9f6255-dcc7-11e3-843f-485ab6895ac2

Error: (05/16/2014 08:57:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: outlookdav.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException
Stack:
  at System.Diagnostics.FileVersionInfo.GetVersionInfo(System.String)
  at System.Windows.Forms.RichTextBox.get_CreateParams()
  at System.Windows.Forms.Control..ctor(Boolean)
  at System.Windows.Forms.TextBoxBase..ctor()
  at System.Windows.Forms.RichTextBox..ctor()
  at surdav.frmMain.InitializeComponent()
  at surdav.frmMain..ctor()
  at surdav.main.Main()

Error: (05/15/2014 09:14:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: outlookdav.exe4.0.0.05350d43dKERNELBASE.dll6.1.7601.1822951fb1116e04343520000c41f158401cf700d30bbf909C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exeC:\Windows\syswow64\KERNELBASE.dll89f1361e-dc00-11e3-a7b1-485ab6895ac2


==================== Memory info ===========================

Percentage of memory in use: 60%
Total physical RAM: 4007.56 MB
Available physical RAM: 1602.62 MB
Total Pagefile: 8013.3 MB
Available Pagefile: 5295.56 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows ) (Fixed) (Total:453.08 GB) (Free:402.97 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:11.57 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 21345E49)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=453 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=100 MB) - (Type=27)

==================== End Of Log ============================

Pardon, das war die Adittion.txt hier die richtife Logdatei:


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Buchhaltung (administrator) on BUCHHALTUNG-HP on 24-06-2014 11:36:42
Running from C:\Users\Buchhaltung\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CryptoMill Technologies Ltd.) C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CORESHREDDER.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SmarThru Office\x64\LegacyLauncher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP My Display\DTune.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
() C:\Windows\System32\spool\drivers\x64\3\spe__pi.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7194840 2013-07-27] (Realtek Semiconductor)
HKLM\...\Run: [HPKBDOSD] => C:\Program Files\Hewlett-Packard\HP Wireless Keyboard and Mouse Applet\KBDOSD.exe [802816 2012-08-14] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [CryptoMill Refresh] => C:\Program Files\Hewlett-Packard\HP Trust Circles\ceflauncher -m refresh
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-04-12] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111136 2012-11-21] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [493088 2012-11-21] (CyberLink Corp.)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [683656 2013-04-07] (PDF Complete Inc)
HKLM-x32\...\Run: [YouCam Mirage] => c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2013-04-10] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [167488 2013-04-10] (CyberLink Corp.)
HKLM-x32\...\Run: [HP File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\Coreshredder.exe [2213592 2013-09-17] (Hewlett-Packard)
HKLM-x32\...\Run: [DT_HPO] => C:\Program Files (x86)\Hewlett-Packard\HP My Display\DTuneStartup.exe [142344 2013-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [208424 2013-10-17] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [STO Backup Service] => C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe [199800 2012-09-27] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [STO Launcher Service] => C:\Program Files (x86)\SmarThru Office\x64\LegacyLauncher.exe [405624 2012-09-27] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [129664 2012-12-28] ( (Atheros Communications))
HKU\S-1-5-21-1907336366-2592699145-1523498337-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1907336366-2592699145-1523498337-1001\...\Policies\Explorer: [DisallowRun] 1
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-05-08] (Skytech Co., Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Buchhaltung\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
InternetURL: C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SurGATE Outlook DAV Client.url -> file:///C:\Program Files (x86)\SurGATE Labs\SurGATE Outlook DAV Client\outlookdav.exe
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: +1TBIcon -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: +1TBIcon -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CMDTDFJS
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403082479&from=wld&uid=WDCXWD5000AAKX-60U6AA0_WD-WCC2ESR5982659826&q={searchTerms}
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: HP File Sanitizer - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\components\npChromeDPAgent.dll (DigitalPersona, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome
FF Extension: HP Client Security Manager - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome [2014-01-10]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-29]

Chrome:
=======
CHR HomePage: https://www.google.de/webhp?sourceid=chrome-instant&rlz=1C1CHFX_deDE579DE579&ion=1&espv=2&ie=UTF-8
CHR StartupUrls: "https://www.google.de/webhp?sourceid=chrome-instant&rlz=1C1CHFX_deDE579DE579&ion=1&espv=2&ie=UTF-8"
CHR NewTab: "chrome-extension://pelmeidfhdlhlbjimpabfcbnnojbboma/index.html"
CHR Extension: (Google Docs) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-10]
CHR Extension: (Google Drive) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-10]
CHR Extension: (YouTube) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-10]
CHR Extension: (McAfee Security Scan+) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-03-26]
CHR Extension: (Google-Suche) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-10]
CHR Extension: (Adobe Acrobat – PDF-Datei erstellen) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-29]
CHR Extension: (Amazon-Icon) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2014-06-18]
CHR Extension: (HP Client Security Manager) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncffjdbbodifgldkcbhmiiljfcnbgjab [2014-03-10]
CHR Extension: (Google Wallet) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-10]
CHR Extension: (Quick start) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-06-18]
CHR Extension: (Google Mail) - C:\Users\Buchhaltung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-10]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2012-09-23]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Buchhaltung\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-06-18]
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome.crx [2013-10-03]

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [226944 2012-12-28] (Qualcomm Atheros Commnucations)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
R2 CreoService; C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [1390552 2013-10-03] (CryptoMill Technologies Ltd.)
R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2013-08-14] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2013-10-03] (DigitalPersona, Inc.)
R2 DTuneSrvc; C:\Program Files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe [120328 2013-07-17] (Portrait Displays, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [558392 2013-08-23] (Hewlett-Packard Company)
R2 Haufe FabricHostService; C:\Program Files (x86)\Lexware\services\Haufe.FabricHostService.exe [14848 2013-10-10] (Haufe-Lexware GmbH & Co. KG) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-12] (Intel Corporation)
R2 Lexware_Professional_Datenbank; C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe [141176 2012-06-01] (iAnywhere Solutions, Inc.)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [49664 2013-10-08] (Haufe-Lexware GmbH & Co. KG) [File not signed]
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2153792 2014-05-14] (IObit)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1138824 2013-04-07] (PDF Complete Inc)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-28] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2012-12-28] (Qualcomm Atheros)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-06-13] (Hewlett-Packard Company)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-27] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28656 2013-05-30] (Intel Corporation)
R3 IceKore; C:\Windows\System32\DRIVERS\IceKore.sys [401368 2013-09-30] (CryptoMill Technologies Inc.)
S3 lehidmini; C:\Windows\system32\drivers\leath_hid.sys [39704 2012-12-28] (Atheros)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-24] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2013-08-22] (WinMagic Inc.)
S3 qca_shb; C:\Windows\system32\drivers\qca_shb.sys [99328 2012-12-28] (Qualcomm Atheros Communications Inc.)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [424664 2013-08-03] (Realsil Semiconductor Corporation)
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2013-08-22] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2013-08-22] (WinMagic Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-24 11:36 - 2014-06-24 11:37 - 00029400 _____ () C:\Users\Buchhaltung\Desktop\FRST.txt
2014-06-24 11:36 - 2014-06-24 11:36 - 00000000 ____D () C:\FRST
2014-06-24 11:36 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Desktop\FRST64.exe
2014-06-24 11:35 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Downloads\FRST64.exe
2014-06-24 11:10 - 2014-06-24 11:10 - 00000000 ____D () C:\Users\Buchhaltung\Desktop\Desinfektion
2014-06-24 10:55 - 2014-06-24 10:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-24 10:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-24 10:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-24 10:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-24 10:53 - 2014-06-24 10:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Buchhaltung\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-24 10:16 - 2014-06-24 10:16 - 00009281 _____ () C:\Users\Buchhaltung\Desktop\Mappe1.xlsx
2014-06-23 11:45 - 2014-06-23 11:45 - 00009260 _____ () C:\Users\Buchhaltung\Desktop\Friedels Fairsicher Büro.xlsx
2014-06-19 12:42 - 2014-06-23 17:19 - 00039201 _____ () C:\Users\Buchhaltung\Desktop\Journal Mai 14.xlsx
2014-06-19 09:18 - 2014-06-19 09:18 - 00000024 _____ () C:\Users\Buchhaltung\AppData\Roaming\temp.ini
2014-06-18 11:08 - 2014-06-19 09:50 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\SupTab
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\ChromeExtensions
2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Temp2938445d7de96fb9fbf2aa393d57f57d
2014-06-18 11:05 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-für-Excel-und-OpenOffice
2014-06-18 11:05 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Tempa4a6c201acf7d8ff2b637ea32bd5d7b4
2014-06-18 11:03 - 2014-06-18 11:03 - 01063312 _____ () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-fr-Excel-und-OpenOffice-lnstall.exe
2014-06-18 10:49 - 2014-06-18 10:49 - 00703136 _____ () C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe
2014-06-16 14:07 - 2014-06-16 14:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\OICE_15_974FA576_32C1D314_90F
2014-06-12 09:00 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 09:00 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 09:00 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 09:00 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 09:00 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 09:00 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 09:00 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 09:00 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 09:00 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 09:00 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 09:00 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 09:00 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 09:00 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 09:00 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 09:00 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 09:00 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 09:00 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 09:00 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 09:00 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 09:00 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 09:00 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 09:00 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-12 09:00 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 09:00 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 09:00 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-12 09:00 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 09:00 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 09:00 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 09:00 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 09:00 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 09:00 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 09:00 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 09:00 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-12 09:00 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 09:00 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 09:00 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 09:00 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 09:00 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 09:00 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 09:00 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 09:00 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 09:00 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 09:00 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 09:00 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-12 09:00 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 09:00 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 09:00 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 09:00 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 09:00 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 09:00 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 09:00 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 09:00 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-12 09:00 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 09:00 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 09:00 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 09:00 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 09:00 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 09:00 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 09:00 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 09:00 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 09:00 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 09:00 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 09:00 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 09:00 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-12 09:00 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-06 10:43 - 2014-06-06 10:43 - 00000932 _____ () C:\Users\Buchhaltung\Downloads\Herunterladen (3).csv
2014-06-05 12:14 - 2014-06-05 12:14 - 00028131 _____ () C:\Users\Buchhaltung\Desktop\Kopie von Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid.xlsx
2014-06-03 12:08 - 2014-06-17 18:01 - 00010539 _____ () C:\Users\Buchhaltung\Desktop\Passwort Datenbank.xlsx
2014-06-02 17:23 - 2014-06-02 17:23 - 00027386 _____ () C:\Users\Buchhaltung\Downloads\Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid (3) ohne Summen.xlsx
2014-05-30 14:17 - 2014-05-30 16:02 - 00000000 ____D () C:\Verträge Freelancer
2014-05-28 18:04 - 2014-05-28 18:04 - 00000000 ____D () C:\Kinetic Lights Mastervorlage Angebot
2014-05-28 18:01 - 2014-05-28 18:03 - 00000000 ____D () C:\Logo whitevoid
2014-05-28 18:01 - 2014-05-28 18:03 - 00000000 ____D () C:\Lieferkonditionen Mawa
2014-05-28 18:01 - 2014-05-28 18:02 - 00000000 ____D () C:\Privata Hausverwaltung

==================== One Month Modified Files and Folders =======

2014-06-24 11:37 - 2014-06-24 11:36 - 00029400 _____ () C:\Users\Buchhaltung\Desktop\FRST.txt
2014-06-24 11:36 - 2014-06-24 11:36 - 00000000 ____D () C:\FRST
2014-06-24 11:35 - 2014-06-24 11:36 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Desktop\FRST64.exe
2014-06-24 11:35 - 2014-06-24 11:35 - 02082816 _____ (Farbar) C:\Users\Buchhaltung\Downloads\FRST64.exe
2014-06-24 11:28 - 2014-03-10 14:12 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-24 11:10 - 2014-06-24 11:10 - 00000000 ____D () C:\Users\Buchhaltung\Desktop\Desinfektion
2014-06-24 10:55 - 2014-06-24 10:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-24 10:54 - 2014-06-24 10:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-24 10:54 - 2014-06-24 10:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Buchhaltung\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-24 10:42 - 2014-03-01 18:33 - 00000000 ____D () C:\Datensicherung FiBu
2014-06-24 10:40 - 2014-01-10 09:48 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-24 10:40 - 2014-01-10 09:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-24 10:22 - 2014-02-19 15:44 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1E83FF4F-497D-487F-B446-4692BE77C59D}
2014-06-24 10:17 - 2014-01-10 09:06 - 00716700 _____ () C:\Windows\system32\perfh007.dat
2014-06-24 10:17 - 2014-01-10 09:06 - 00154260 _____ () C:\Windows\system32\perfc007.dat
2014-06-24 10:17 - 2009-07-14 07:13 - 01654312 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-24 10:16 - 2014-06-24 10:16 - 00009281 _____ () C:\Users\Buchhaltung\Desktop\Mappe1.xlsx
2014-06-24 10:13 - 2014-03-13 15:16 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-06-24 09:58 - 2014-01-10 09:50 - 00000000 ____D () C:\ProgramData\PDFC
2014-06-24 09:43 - 2014-05-19 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\E0CDCFA4-A899-4CD1-BF14-C7DAD2D0A520.aplzod
2014-06-24 09:05 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-24 09:05 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-24 09:02 - 2014-02-19 15:41 - 01731627 _____ () C:\Windows\WindowsUpdate.log
2014-06-24 08:59 - 2014-03-20 15:59 - 00000000 ___RD () C:\Users\Buchhaltung\Dropbox
2014-06-24 08:59 - 2014-03-20 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\DropboxMaster
2014-06-24 08:59 - 2014-03-20 15:57 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\Dropbox
2014-06-24 08:58 - 2014-03-10 14:12 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-24 08:58 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.log
2014-06-24 08:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-24 08:58 - 2009-07-14 06:51 - 00044965 _____ () C:\Windows\setupact.log
2014-06-23 17:19 - 2014-06-19 12:42 - 00039201 _____ () C:\Users\Buchhaltung\Desktop\Journal Mai 14.xlsx
2014-06-23 11:45 - 2014-06-23 11:45 - 00009260 _____ () C:\Users\Buchhaltung\Desktop\Friedels Fairsicher Büro.xlsx
2014-06-23 10:57 - 2014-04-09 17:25 - 00000000 ____D () C:\Vorlagen
2014-06-23 10:02 - 2014-02-22 16:03 - 00000000 ____D () C:\ProgramData\Lexware
2014-06-23 09:00 - 2014-05-14 10:49 - 00000000 ____D () C:\ProgramData\ProductData
2014-06-23 08:58 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.001
2014-06-23 08:58 - 2010-11-21 05:47 - 00168256 _____ () C:\Windows\PFRO.log
2014-06-20 09:40 - 2014-04-09 17:27 - 00000000 ____D () C:\Liquidität
2014-06-20 08:52 - 2014-02-19 19:52 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-20 08:52 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.002
2014-06-19 09:50 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-19 09:18 - 2014-06-19 09:18 - 00000024 _____ () C:\Users\Buchhaltung\AppData\Roaming\temp.ini
2014-06-19 09:17 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.003
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\SupTab
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-18 11:08 - 2014-06-18 11:08 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-18 11:08 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-für-Excel-und-OpenOffice
2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\ChromeExtensions
2014-06-18 11:07 - 2014-06-18 11:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Temp2938445d7de96fb9fbf2aa393d57f57d
2014-06-18 11:07 - 2014-02-19 15:43 - 00000000 ____D () C:\Users\Buchhaltung
2014-06-18 11:05 - 2014-06-18 11:05 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Local\Tempa4a6c201acf7d8ff2b637ea32bd5d7b4
2014-06-18 11:03 - 2014-06-18 11:03 - 01063312 _____ () C:\Users\Buchhaltung\Downloads\Urlaubsplaner-fr-Excel-und-OpenOffice-lnstall.exe
2014-06-18 10:49 - 2014-06-18 10:49 - 00703136 _____ () C:\Users\Buchhaltung\Downloads\FileOpenerSetup.exe
2014-06-18 08:55 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.004
2014-06-17 18:01 - 2014-06-03 12:08 - 00010539 _____ () C:\Users\Buchhaltung\Desktop\Passwort Datenbank.xlsx
2014-06-17 08:46 - 2014-01-10 09:53 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.005
2014-06-16 14:07 - 2014-06-16 14:07 - 00000000 ____D () C:\Users\Buchhaltung\AppData\OICE_15_974FA576_32C1D314_90F
2014-06-13 14:30 - 2014-03-10 14:13 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 12:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-12 18:00 - 2014-02-22 16:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 17:59 - 2014-02-22 16:52 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-11 16:43 - 2014-06-11 16:43 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-11 16:43 - 2014-03-25 17:43 - 00001939 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-06-11 16:43 - 2014-03-25 17:43 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-06 10:43 - 2014-06-06 10:43 - 00000932 _____ () C:\Users\Buchhaltung\Downloads\Herunterladen (3).csv
2014-06-05 12:14 - 2014-06-05 12:14 - 00028131 _____ () C:\Users\Buchhaltung\Desktop\Kopie von Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid.xlsx
2014-06-04 10:28 - 2014-04-09 17:27 - 00000000 ____D () C:\Geschäftsdaten
2014-06-02 17:23 - 2014-06-02 17:23 - 00027386 _____ () C:\Users\Buchhaltung\Downloads\Anlage 6_Vorlage Verwendungsnachweis_WHITEvoid (3) ohne Summen.xlsx
2014-05-30 16:02 - 2014-05-30 14:17 - 00000000 ____D () C:\Verträge Freelancer
2014-05-30 12:21 - 2014-06-12 09:00 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-12 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-12 09:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-12 09:00 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-12 09:00 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-12 09:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-12 09:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-12 09:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-12 09:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-12 09:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-12 09:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-12 09:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-12 09:00 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-12 09:00 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-12 09:00 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-12 09:00 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-12 09:00 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-12 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-12 09:00 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-12 09:00 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-12 09:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-12 09:00 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-12 09:00 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-12 09:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-12 09:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 09:00 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-12 09:00 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-12 09:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 09:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-12 09:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-12 09:00 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-12 09:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-12 09:00 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-12 09:00 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-12 09:00 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-12 09:00 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 09:00 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 09:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-12 09:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 09:00 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-12 09:00 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-12 09:00 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-12 09:00 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 09:00 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 09:00 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-12 09:00 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-12 09:00 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-12 09:00 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-12 09:00 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-12 09:00 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-12 09:00 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-12 09:00 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-28 18:04 - 2014-05-28 18:04 - 00000000 ____D () C:\Kinetic Lights Mastervorlage Angebot
2014-05-28 18:03 - 2014-05-28 18:01 - 00000000 ____D () C:\Logo whitevoid
2014-05-28 18:03 - 2014-05-28 18:01 - 00000000 ____D () C:\Lieferkonditionen Mawa
2014-05-28 18:02 - 2014-05-28 18:01 - 00000000 ____D () C:\Privata Hausverwaltung
2014-05-28 17:54 - 2014-03-20 15:59 - 00001005 _____ () C:\Users\Buchhaltung\Desktop\Dropbox.lnk
2014-05-28 17:54 - 2014-03-20 15:58 - 00000000 ____D () C:\Users\Buchhaltung\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-26 17:48 - 2010-11-21 09:16 - 00000000 ___RD () C:\Users\Public\Recorded TV

Some content of TEMP:
====================
C:\Users\Buchhaltung\AppData\Local\Temp\amazonicon_v5.exe
C:\Users\Buchhaltung\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Buchhaltung\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf3yasz.dll
C:\Users\Buchhaltung\AppData\Local\Temp\loygame-pro.exe
C:\Users\Buchhaltung\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Buchhaltung\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Buchhaltung\AppData\Local\Temp\sdapskill.exe
C:\Users\Buchhaltung\AppData\Local\Temp\sdaspwn.exe
C:\Users\Buchhaltung\AppData\Local\Temp\sweetpage294wld_n2.exe
C:\Users\Buchhaltung\AppData\Local\Temp\updatepackasc.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 13:30

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Hallo Sandra,

nochmal danke für deine Schnelle Reaktion, ich wollte Bescheid sagen dass ich
den Rechner zu nem gewerblichem Virenjäger bringe.

Besten Dank, Grüße, Melanie :daumenhoc

Hallo Sandra,

nochmal danke für deine Schnelle Reaktion, ich wollte Bescheid sagen dass ich
den Rechner zu nem gewerblichem Virenjäger bringe.

Besten Dank, Grüße, Melanie :daumenhoc

Bootsektor 24.06.2014 21:25
Ok,

das ist natürlich deine freie Entscheidung.

Alles Gute :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:09 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131